Joe Sandbox Cloud Basic Analysis Report

Loading Joe Sandbox Report ...

Edit tour

Windows Analysis Report
NEVER OPEN!.exe

Overview

General Information

Sample name:NEVER OPEN!.exe
Analysis ID:1556387
MD5:61b5a3066bcf661f69b9e362ef1a1f8c
SHA1:bc6701f2a76cb5db3ea27371240b7e295382d29c
SHA256:2949df50691624e3a64635fbf690527e245d5c83dd3bd8f000f34447a6386ba2
Tags:Empyreanexeuser-likeastar20
Infos:

Detection

Python Stealer, Empyrean, Discord Token Stealer
Score:100
Range:0 - 100
Whitelisted:false
Confidence:100%

Signatures

Antivirus / Scanner detection for submitted sample
Detected Empyrean Stealer
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Yara detected Discord Token Stealer
Yara detected Empyrean
AI detected suspicious sample
Machine Learning detection for sample
Potentially malicious time measurement code found
Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)
Sigma detected: Rare Remote Thread Creation By Uncommon Source Image
Tries to harvest and steal browser information (history, passwords, etc)
Uses cmd line tools excessively to alter registry or file data
Writes many files with high entropy
Yara detected Generic Python Stealer
Binary contains a suspicious time stamp
Contains functionality for execution timing, often used to detect debuggers
Contains functionality to check if a debugger is running (IsDebuggerPresent)
Contains functionality to dynamically determine API calls
Contains functionality to open a port and listen for incoming connection (possibly a backdoor)
Contains functionality to query CPU information (cpuid)
Contains functionality which may be used to detect a debugger (GetProcessHeap)
Creates a process in suspended mode (likely to inject code)
Detected potential crypto function
Drops PE files
Drops files with a non-matching file extension (content does not match file extension)
Enables debug privileges
Extensive use of GetProcAddress (often used to hide API calls)
Found dropped PE file which has not been started or loaded
Found evasive API chain checking for process token information
Found large amount of non-executed APIs
Found potential string decryption / allocating functions
IP address seen in connection with other malware
May check the online IP address of the machine
PE file contains executable resources (Code or Archives)
PE file contains sections with non-standard names
PE file does not import any functions
Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)
Queries sensitive Operating System Information (via WMI, Win32_ComputerSystem, often done to detect virtual machines)
Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)
Queries the volume information (name, serial number etc) of a device
Sample execution stops while process was sleeping (likely an evasion)
Sample file is different than original file name gathered from version info
Sigma detected: CurrentVersion Autorun Keys Modification
Sigma detected: Direct Autorun Keys Modification
Sigma detected: Execution of Suspicious File Type Extension
Sigma detected: Potential Persistence Attempt Via Run Keys Using Reg.EXE
Uses code obfuscation techniques (call, push, ret)
Uses reg.exe to modify the Windows registry

Classification

Process Tree

  • System is w10x64
  • NEVER OPEN!.exe (PID: 7000 cmdline: "C:\Users\user\Desktop\NEVER OPEN!.exe" MD5: 61B5A3066BCF661F69B9E362EF1A1F8C)
    • NEVER OPEN!.exe (PID: 7164 cmdline: "C:\Users\user\Desktop\NEVER OPEN!.exe" MD5: 61B5A3066BCF661F69B9E362EF1A1F8C)
      • cmd.exe (PID: 6244 cmdline: C:\Windows\system32\cmd.exe /c "ver" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)
        • conhost.exe (PID: 6260 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
      • cmd.exe (PID: 600 cmdline: C:\Windows\system32\cmd.exe /c "reg delete HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v empyrean /f" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)
        • conhost.exe (PID: 4320 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
        • reg.exe (PID: 3272 cmdline: reg delete HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v empyrean /f MD5: 227F63E1D9008B36BDBCC4B397780BE4)
      • cmd.exe (PID: 3716 cmdline: C:\Windows\system32\cmd.exe /c "reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v empyrean /t REG_SZ /d C:\Users\user\AppData\Roaming\empyrean\run.bat /f" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)
        • conhost.exe (PID: 4944 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
        • reg.exe (PID: 6164 cmdline: reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v empyrean /t REG_SZ /d C:\Users\user\AppData\Roaming\empyrean\run.bat /f MD5: 227F63E1D9008B36BDBCC4B397780BE4)
      • cmd.exe (PID: 6980 cmdline: C:\Windows\system32\cmd.exe /c "C:\Windows\System32\wbem\WMIC.exe csproduct get uuid" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)
        • conhost.exe (PID: 5432 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
        • WMIC.exe (PID: 4948 cmdline: C:\Windows\System32\wbem\WMIC.exe csproduct get uuid MD5: C37F2F4F4B3CD128BDABCAEB2266A785)
      • cmd.exe (PID: 6388 cmdline: C:\Windows\system32\cmd.exe /c "C:\Windows\System32\wbem\WMIC.exe csproduct get uuid" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)
        • conhost.exe (PID: 1196 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
        • WMIC.exe (PID: 2588 cmdline: C:\Windows\System32\wbem\WMIC.exe csproduct get uuid MD5: C37F2F4F4B3CD128BDABCAEB2266A785)
      • cmd.exe (PID: 2256 cmdline: C:\Windows\system32\cmd.exe /c "C:\Windows\System32\wbem\WMIC.exe csproduct get uuid" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)
        • conhost.exe (PID: 5084 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
        • WMIC.exe (PID: 1620 cmdline: C:\Windows\System32\wbem\WMIC.exe csproduct get uuid MD5: C37F2F4F4B3CD128BDABCAEB2266A785)
  • cmd.exe (PID: 932 cmdline: C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\Roaming\empyrean\run.bat" " MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)
    • conhost.exe (PID: 1860 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
    • dat.txt (PID: 4544 cmdline: C:\Users\user\AppData\Roaming\empyrean\dat.txt MD5: 61B5A3066BCF661F69B9E362EF1A1F8C)
      • dat.txt (PID: 5768 cmdline: C:\Users\user\AppData\Roaming\empyrean\dat.txt MD5: 61B5A3066BCF661F69B9E362EF1A1F8C)
        • cmd.exe (PID: 5264 cmdline: C:\Windows\system32\cmd.exe /c "ver" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)
          • conhost.exe (PID: 3696 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
        • cmd.exe (PID: 5348 cmdline: C:\Windows\system32\cmd.exe /c "C:\Windows\System32\wbem\WMIC.exe csproduct get uuid" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)
          • conhost.exe (PID: 5016 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
          • WMIC.exe (PID: 5432 cmdline: C:\Windows\System32\wbem\WMIC.exe csproduct get uuid MD5: C37F2F4F4B3CD128BDABCAEB2266A785)
        • cmd.exe (PID: 6324 cmdline: C:\Windows\system32\cmd.exe /c "C:\Windows\System32\wbem\WMIC.exe csproduct get uuid" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)
          • conhost.exe (PID: 6016 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
          • WMIC.exe (PID: 2828 cmdline: C:\Windows\System32\wbem\WMIC.exe csproduct get uuid MD5: C37F2F4F4B3CD128BDABCAEB2266A785)
        • cmd.exe (PID: 2800 cmdline: C:\Windows\system32\cmd.exe /c "C:\Windows\System32\wbem\WMIC.exe csproduct get uuid" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)
          • conhost.exe (PID: 1712 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
          • WMIC.exe (PID: 5312 cmdline: C:\Windows\System32\wbem\WMIC.exe csproduct get uuid MD5: C37F2F4F4B3CD128BDABCAEB2266A785)
  • cmd.exe (PID: 1620 cmdline: C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\Roaming\empyrean\run.bat" " MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)
    • conhost.exe (PID: 1436 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
    • dat.txt (PID: 280 cmdline: C:\Users\user\AppData\Roaming\empyrean\dat.txt MD5: 61B5A3066BCF661F69B9E362EF1A1F8C)
      • dat.txt (PID: 5004 cmdline: C:\Users\user\AppData\Roaming\empyrean\dat.txt MD5: 61B5A3066BCF661F69B9E362EF1A1F8C)
        • cmd.exe (PID: 5592 cmdline: C:\Windows\system32\cmd.exe /c "ver" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)
          • conhost.exe (PID: 6104 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
        • cmd.exe (PID: 4336 cmdline: C:\Windows\system32\cmd.exe /c "C:\Windows\System32\wbem\WMIC.exe csproduct get uuid" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)
          • conhost.exe (PID: 6688 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
          • WMIC.exe (PID: 6404 cmdline: C:\Windows\System32\wbem\WMIC.exe csproduct get uuid MD5: C37F2F4F4B3CD128BDABCAEB2266A785)
        • cmd.exe (PID: 3744 cmdline: C:\Windows\system32\cmd.exe /c "C:\Windows\System32\wbem\WMIC.exe csproduct get uuid" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)
          • conhost.exe (PID: 1860 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
          • WMIC.exe (PID: 1376 cmdline: C:\Windows\System32\wbem\WMIC.exe csproduct get uuid MD5: C37F2F4F4B3CD128BDABCAEB2266A785)
        • cmd.exe (PID: 2364 cmdline: C:\Windows\system32\cmd.exe /c "C:\Windows\System32\wbem\WMIC.exe csproduct get uuid" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)
          • conhost.exe (PID: 732 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
          • WMIC.exe (PID: 5592 cmdline: C:\Windows\System32\wbem\WMIC.exe csproduct get uuid MD5: C37F2F4F4B3CD128BDABCAEB2266A785)
  • cleanup

Malware Configuration

⊘No configs have been found

Yara Signatures

Initial Sample

SourceRuleDescriptionAuthorStrings
NEVER OPEN!.exeJoeSecurity_DiscordTokenStealer_1Yara detected Discord Token StealerJoe Security

    Dropped Files

    SourceRuleDescriptionAuthorStrings
    C:\Users\user\AppData\Roaming\empyrean\dat.txtJoeSecurity_DiscordTokenStealer_1Yara detected Discord Token StealerJoe Security

      Memory Dumps

      SourceRuleDescriptionAuthorStrings
      00000020.00000002.2233150692.000001A88A4E0000.00000004.00001000.00020000.00000000.sdmpJoeSecurity_EmpyreanYara detected EmpyreanJoe Security
        0000001A.00000002.2151057596.0000013317E10000.00000004.00001000.00020000.00000000.sdmpJoeSecurity_EmpyreanYara detected EmpyreanJoe Security
          Process Memory Space: NEVER OPEN!.exe PID: 7164JoeSecurity_DiscordTokenStealerYara detected Discord Token StealerJoe Security
            Process Memory Space: NEVER OPEN!.exe PID: 7164JoeSecurity_GenericPythonStealerYara detected Generic Python StealerJoe Security
              Process Memory Space: NEVER OPEN!.exe PID: 7164JoeSecurity_EmpyreanYara detected EmpyreanJoe Security

                Sigma Signatures

                System Summary

                barindex
                Sigma detected: Rare Remote Thread Creation By Uncommon Source Image
                Source: Threat createdAuthor: Perez Diego (@darkquassar), oscd.community: Data: EventID: 8, SourceImage: C:\Windows\System32\wbem\WMIC.exe, SourceProcessId: 5432, StartAddress: 213032B0, TargetImage: C:\Windows\System32\conhost.exe, TargetProcessId: 5432
                Sigma detected: CurrentVersion Autorun Keys Modification
                Source: Registry Key setAuthor: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: C:\Users\user\AppData\Roaming\empyrean\run.bat, EventID: 13, EventType: SetValue, Image: C:\Windows\System32\reg.exe, ProcessId: 6164, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\empyrean
                Sigma detected: Direct Autorun Keys Modification
                Source: Process startedAuthor: Victor Sergeev, Daniil Yugoslavskiy, oscd.community: Data: Command: reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v empyrean /t REG_SZ /d C:\Users\user\AppData\Roaming\empyrean\run.bat /f, CommandLine: reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v empyrean /t REG_SZ /d C:\Users\user\AppData\Roaming\empyrean\run.bat /f, CommandLine|base64offset|contains: , Image: C:\Windows\System32\reg.exe, NewProcessName: C:\Windows\System32\reg.exe, OriginalFileName: C:\Windows\System32\reg.exe, ParentCommandLine: C:\Windows\system32\cmd.exe /c "reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v empyrean /t REG_SZ /d C:\Users\user\AppData\Roaming\empyrean\run.bat /f", ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 3716, ParentProcessName: cmd.exe, ProcessCommandLine: reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v empyrean /t REG_SZ /d C:\Users\user\AppData\Roaming\empyrean\run.bat /f, ProcessId: 6164, ProcessName: reg.exe
                Sigma detected: Execution of Suspicious File Type Extension
                Source: Process startedAuthor: Max Altgelt (Nextron Systems): Data: Command: C:\Users\user\AppData\Roaming\empyrean\dat.txt, CommandLine: C:\Users\user\AppData\Roaming\empyrean\dat.txt, CommandLine|base64offset|contains: , Image: C:\Users\user\AppData\Roaming\empyrean\dat.txt, NewProcessName: C:\Users\user\AppData\Roaming\empyrean\dat.txt, OriginalFileName: C:\Users\user\AppData\Roaming\empyrean\dat.txt, ParentCommandLine: C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\Roaming\empyrean\run.bat" ", ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 932, ParentProcessName: cmd.exe, ProcessCommandLine: C:\Users\user\AppData\Roaming\empyrean\dat.txt, ProcessId: 4544, ProcessName: dat.txt
                Sigma detected: Potential Persistence Attempt Via Run Keys Using Reg.EXE
                Source: Process startedAuthor: Florian Roth (Nextron Systems): Data: Command: C:\Windows\system32\cmd.exe /c "reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v empyrean /t REG_SZ /d C:\Users\user\AppData\Roaming\empyrean\run.bat /f", CommandLine: C:\Windows\system32\cmd.exe /c "reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v empyrean /t REG_SZ /d C:\Users\user\AppData\Roaming\empyrean\run.bat /f", CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: "C:\Users\user\Desktop\NEVER OPEN!.exe", ParentImage: C:\Users\user\Desktop\NEVER OPEN!.exe, ParentProcessId: 7164, ParentProcessName: NEVER OPEN!.exe, ProcessCommandLine: C:\Windows\system32\cmd.exe /c "reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v empyrean /t REG_SZ /d C:\Users\user\AppData\Roaming\empyrean\run.bat /f", ProcessId: 3716, ProcessName: cmd.exe

                Suricata Signatures

                ⊘No Suricata rule has matched

                Joe Sandbox Signatures

                Click to jump to signature section

                Show All Signature Results

                AV Detection

                barindex
                Antivirus / Scanner detection for submitted sample
                Source: NEVER OPEN!.exeAvira: detected
                Multi AV Scanner detection for dropped file
                Source: C:\Users\user\AppData\Local\Temp\_MEI2802\win32ui.pydReversingLabs: Detection: 25%
                Multi AV Scanner detection for submitted file
                Source: NEVER OPEN!.exeReversingLabs: Detection: 57%
                AI detected suspicious sample
                Source: Submited SampleIntegrated Neural Analysis Model: Matched 99.7% probability
                Machine Learning detection for sample
                Source: NEVER OPEN!.exeJoe Sandbox ML: detected
                Source: NEVER OPEN!.exeStatic PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, GUARD_CF, TERMINAL_SERVER_AWARE
                Source: Binary string: C:\A\40\b\bin\amd64\_decimal.pdb$$ source: NEVER OPEN!.exe, 00000001.00000002.1906311543.00007FFE01371000.00000040.00000001.01000000.00000013.sdmp
                Source: Binary string: C:\A\40\b\bin\amd64\sqlite3.pdb source: NEVER OPEN!.exe, dat.txt
                Source: Binary string: compiler: cl /Zi /Fdossl_static.pdb /Gs0 /GF /Gy /MD /W3 /wd4090 /nologo /O2 -DL_ENDIAN -DOPENSSL_PIC -DOPENSSL_CPUID_OBJ -DOPENSSL_IA32_SSE2 -DOPENSSL_BN_ASM_MONT -DOPENSSL_BN_ASM_MONT5 -DOPENSSL_BN_ASM_GF2m -DSHA1_ASM -DSHA256_ASM -DSHA512_ASM -DKECCAK1600_A source: NEVER OPEN!.exe, dat.txt
                Source: Binary string: D:\_w\1\b\libssl-1_1.pdb source: NEVER OPEN!.exe, 00000001.00000002.1903355658.00007FFE007E6000.00000040.00000001.01000000.00000017.sdmp
                Source: Binary string: C:\A\40\b\bin\amd64\_decimal.pdb source: NEVER OPEN!.exe, 00000001.00000002.1906311543.00007FFE01371000.00000040.00000001.01000000.00000013.sdmp
                Source: Binary string: C:\A\40\b\bin\amd64\_uuid.pdb source: NEVER OPEN!.exe, 00000001.00000002.1920987146.00007FFE126C1000.00000040.00000001.01000000.00000014.sdmp
                Source: Binary string: C:\src\pywin32\build\temp.win-amd64-cpython-310\Release\win32crypt.pdb source: NEVER OPEN!.exe, 00000001.00000002.1899389721.00007FFE001C1000.00000040.00000001.01000000.0000003B.sdmp
                Source: Binary string: compiler: cl /Zi /Fdossl_static.pdb /Gs0 /GF /Gy /MD /W3 /wd4090 /nologo /O2 -DL_ENDIAN -DOPENSSL_PIC -DOPENSSL_CPUID_OBJ -DOPENSSL_IA32_SSE2 -DOPENSSL_BN_ASM_MONT -DOPENSSL_BN_ASM_MONT5 -DOPENSSL_BN_ASM_GF2m -DSHA1_ASM -DSHA256_ASM -DSHA512_ASM -DKECCAK1600_ASM -DRC4_ASM -DMD5_ASM -DAESNI_ASM -DVPAES_ASM -DGHASH_ASM -DECP_NISTZ256_ASM -DX25519_ASM -DPOLY1305_ASM source: NEVER OPEN!.exe, 00000001.00000002.1897592652.00007FFDFB30E000.00000040.00000001.01000000.00000018.sdmp
                Source: Binary string: C:\A\40\b\bin\amd64\python3.pdb source: NEVER OPEN!.exe, 00000000.00000003.1722852728.0000027663DF9000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000002.1878698743.000001F093850000.00000002.00000001.01000000.00000006.sdmp
                Source: Binary string: D:\a\_work\1\s\binaries\amd64ret\bin\amd64\\vcruntime140.amd64.pdb source: NEVER OPEN!.exe, 00000000.00000003.1717619222.0000027663DF8000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000002.1924121684.00007FFE1A461000.00000002.00000001.01000000.00000005.sdmp
                Source: Binary string: C:\A\40\b\bin\amd64\_ctypes.pdb source: NEVER OPEN!.exe, 00000001.00000002.1916135326.00007FFE10241000.00000040.00000001.01000000.00000007.sdmp
                Source: Binary string: D:\a\_work\1\s\binaries\amd64ret\bin\amd64\\vcruntime140.amd64.pdbGCTL source: NEVER OPEN!.exe, 00000000.00000003.1717619222.0000027663DF8000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000002.1924121684.00007FFE1A461000.00000002.00000001.01000000.00000005.sdmp
                Source: Binary string: C:\A\40\b\bin\amd64\_queue.pdb source: NEVER OPEN!.exe, 00000001.00000002.1922538367.00007FFE130C1000.00000040.00000001.01000000.0000000E.sdmp
                Source: Binary string: C:\A\40\b\bin\amd64\_sqlite3.pdb source: NEVER OPEN!.exe, 00000001.00000002.1907220479.00007FFE014C1000.00000040.00000001.01000000.0000001D.sdmp
                Source: Binary string: C:\A\40\b\bin\amd64\python310.pdb source: NEVER OPEN!.exe, 00000001.00000002.1898577877.00007FFDFB784000.00000040.00000001.01000000.00000004.sdmp
                Source: Binary string: C:\A\40\b\bin\amd64\_overlapped.pdb source: NEVER OPEN!.exe, 00000001.00000002.1904550109.00007FFE012D1000.00000040.00000001.01000000.00000032.sdmp
                Source: Binary string: C:\src\pywin32\build\temp.win-amd64-cpython-310\Release\pywintypes.pdb source: NEVER OPEN!.exe, 00000001.00000002.1909665891.00007FFE0CFC1000.00000040.00000001.01000000.0000000F.sdmp
                Source: Binary string: D:\a\_work\1\s\binaries\amd64ret\bin\amd64\\vcruntime140_1.amd64.pdb source: NEVER OPEN!.exe, 00000000.00000003.1717788454.0000027663DF8000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000002.1921820675.00007FFE12E15000.00000002.00000001.01000000.00000010.sdmp
                Source: Binary string: C:\A\40\b\bin\amd64\_lzma.pdbNN source: NEVER OPEN!.exe, 00000001.00000002.1915163773.00007FFE0EB5C000.00000040.00000001.01000000.0000000A.sdmp
                Source: Binary string: C:\A\40\b\bin\amd64\_asyncio.pdb source: NEVER OPEN!.exe, 00000001.00000002.1904263516.00007FFE01211000.00000040.00000001.01000000.00000031.sdmp
                Source: Binary string: C:\A\40\b\bin\amd64\_lzma.pdb source: NEVER OPEN!.exe, 00000001.00000002.1915163773.00007FFE0EB5C000.00000040.00000001.01000000.0000000A.sdmp
                Source: Binary string: C:\src\pywin32\build\temp.win-amd64-cpython-310\Release\win32api.pdb!! source: NEVER OPEN!.exe, 00000001.00000002.1909239152.00007FFE0CF91000.00000040.00000001.01000000.00000012.sdmp
                Source: Binary string: C:\A\40\b\bin\amd64\select.pdb source: NEVER OPEN!.exe, 00000001.00000002.1923089438.00007FFE13201000.00000040.00000001.01000000.0000000D.sdmp
                Source: Binary string: C:\A\40\b\bin\amd64\unicodedata.pdb source: NEVER OPEN!.exe, 00000001.00000002.1896873012.00007FFDFB0AC000.00000040.00000001.01000000.0000001C.sdmp
                Source: Binary string: D:\_w\1\b\libssl-1_1.pdb@@ source: NEVER OPEN!.exe, 00000001.00000002.1903355658.00007FFE007E6000.00000040.00000001.01000000.00000017.sdmp
                Source: Binary string: C:\src\pywin32\build\temp.win-amd64-cpython-310\Release\win32api.pdb source: NEVER OPEN!.exe, 00000001.00000002.1909239152.00007FFE0CF91000.00000040.00000001.01000000.00000012.sdmp
                Source: Binary string: C:\A\40\b\bin\amd64\_ssl.pdb source: NEVER OPEN!.exe, 00000001.00000002.1908679287.00007FFE0C0A1000.00000040.00000001.01000000.00000016.sdmp
                Source: Binary string: C:\A\40\b\bin\amd64\_socket.pdb source: NEVER OPEN!.exe, 00000001.00000002.1915478870.00007FFE101D1000.00000040.00000001.01000000.0000000C.sdmp
                Source: Binary string: C:\src\pywin32\build\temp.win-amd64-cpython-310\Release\pywintypes.pdb** source: NEVER OPEN!.exe, 00000001.00000002.1909665891.00007FFE0CFC1000.00000040.00000001.01000000.0000000F.sdmp
                Source: Binary string: C:\A\40\b\bin\amd64\_bz2.pdb source: NEVER OPEN!.exe, 00000001.00000002.1916398193.00007FFE10301000.00000040.00000001.01000000.00000009.sdmp
                Source: Binary string: @ compiler: cl /Zi /Fdossl_static.pdb /Gs0 /GF /Gy /MD /W3 /wd4090 /nologo /O2 -DL_ENDIAN -DOPENSSL_PIC -DOPENSSL_CPUID_OBJ -DOPENSSL_IA32_SSE2 -DOPENSSL_BN_ASM_MONT -DOPENSSL_BN_ASM_MONT5 -DOPENSSL_BN_ASM_GF2m -DSHA1_ASM -DSHA256_ASM -DSHA512_ASM -DKECCAK1600_ASM -DRC4_ASM -DMD5_ASM -DAESNI_ASM -DVPAES_ASM -DGHASH_ASM -DECP_NISTZ256_ASM -DX25519_ASM -DPOLY1305_ASMOpenSSL 1.1.1q 5 Jul 2022built on: Thu Aug 18 20:15:42 2022 UTCplatform: VC-WIN64A-masmOPENSSLDIR: "C:\Program Files\Common Files\SSL"ENGINESDIR: "C:\Program Files\OpenSSL\lib\engines-1_1"not available source: NEVER OPEN!.exe, 00000001.00000002.1897592652.00007FFDFB30E000.00000040.00000001.01000000.00000018.sdmp
                Source: Binary string: D:\a\_work\1\s\binaries\amd64ret\bin\amd64\\vcruntime140_1.amd64.pdbGCTL source: NEVER OPEN!.exe, 00000000.00000003.1717788454.0000027663DF8000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000002.1921820675.00007FFE12E15000.00000002.00000001.01000000.00000010.sdmp
                Source: Binary string: D:\_w\1\b\libcrypto-1_1.pdb source: NEVER OPEN!.exe, dat.txt
                Source: Binary string: C:\A\40\b\bin\amd64\pyexpat.pdb source: NEVER OPEN!.exe, 00000001.00000002.1911150737.00007FFE0E151000.00000040.00000001.01000000.0000000B.sdmp
                Source: Binary string: C:\src\pywin32\build\temp.win-amd64-cpython-310\Release\win32crypt.pdb!! source: NEVER OPEN!.exe, 00000001.00000002.1899389721.00007FFE001C1000.00000040.00000001.01000000.0000003B.sdmp
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeCode function: 0_2_00007FF619BD64A4 _invalid_parameter_noinfo,FindFirstFileExW,GetLastError,_invalid_parameter_noinfo,FindNextFileW,GetLastError,0_2_00007FF619BD64A4
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeCode function: 0_2_00007FF619BC7780 FindFirstFileExW,FindClose,0_2_00007FF619BC7780
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeCode function: 0_2_00007FF619BE0CE4 _invalid_parameter_noinfo,FindFirstFileExW,FindNextFileW,FindClose,FindClose,0_2_00007FF619BE0CE4
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeCode function: 0_2_00007FF619BD64A4 _invalid_parameter_noinfo,FindFirstFileExW,GetLastError,_invalid_parameter_noinfo,FindNextFileW,GetLastError,0_2_00007FF619BD64A4
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeCode function: 1_2_00007FF619BE0CE4 _invalid_parameter_noinfo,FindFirstFileExW,FindNextFileW,FindClose,FindClose,1_2_00007FF619BE0CE4
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeCode function: 1_2_00007FF619BD64A4 _invalid_parameter_noinfo,FindFirstFileExW,GetLastError,_invalid_parameter_noinfo,FindNextFileW,GetLastError,1_2_00007FF619BD64A4
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeCode function: 1_2_00007FF619BD64A4 _invalid_parameter_noinfo,FindFirstFileExW,GetLastError,_invalid_parameter_noinfo,FindNextFileW,GetLastError,1_2_00007FF619BD64A4
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeCode function: 1_2_00007FF619BC7780 FindFirstFileExW,FindClose,1_2_00007FF619BC7780
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeCode function: 1_2_00007FFDFB0C3229 MultiByteToWideChar,GetLastError,MultiByteToWideChar,MultiByteToWideChar,00007FFE1FF9F020,FindFirstFileW,FindNextFileW,WideCharToMultiByte,1_2_00007FFDFB0C3229
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtCode function: 25_2_00007FF670A864A4 _invalid_parameter_noinfo,FindFirstFileExW,GetLastError,_invalid_parameter_noinfo,FindNextFileW,GetLastError,25_2_00007FF670A864A4
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtCode function: 25_2_00007FF670A77780 FindFirstFileExW,FindClose,25_2_00007FF670A77780
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtCode function: 25_2_00007FF670A90CE4 _invalid_parameter_noinfo,FindFirstFileExW,FindNextFileW,FindClose,FindClose,25_2_00007FF670A90CE4
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtCode function: 25_2_00007FF670A864A4 _invalid_parameter_noinfo,FindFirstFileExW,GetLastError,_invalid_parameter_noinfo,FindNextFileW,GetLastError,25_2_00007FF670A864A4
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtCode function: 26_2_00007FF670A90CE4 _invalid_parameter_noinfo,FindFirstFileExW,FindNextFileW,FindClose,FindClose,26_2_00007FF670A90CE4
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtCode function: 26_2_00007FF670A864A4 _invalid_parameter_noinfo,FindFirstFileExW,GetLastError,_invalid_parameter_noinfo,FindNextFileW,GetLastError,26_2_00007FF670A864A4
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtCode function: 26_2_00007FF670A864A4 _invalid_parameter_noinfo,FindFirstFileExW,GetLastError,_invalid_parameter_noinfo,FindNextFileW,GetLastError,26_2_00007FF670A864A4
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtCode function: 26_2_00007FF670A77780 FindFirstFileExW,FindClose,26_2_00007FF670A77780
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtCode function: 26_2_00007FFDFB233229 MultiByteToWideChar,GetLastError,MultiByteToWideChar,MultiByteToWideChar,00007FFE1FF9F020,FindFirstFileW,FindNextFileW,WideCharToMultiByte,26_2_00007FFDFB233229
                Source: Joe Sandbox ViewIP Address: 162.159.137.232 162.159.137.232
                Source: Joe Sandbox ViewIP Address: 185.199.110.133 185.199.110.133
                Source: Joe Sandbox ViewIP Address: 185.199.110.133 185.199.110.133
                Source: Joe Sandbox ViewIP Address: 104.26.9.44 104.26.9.44
                Source: unknownDNS query: name: ipapi.co
                Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
                Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
                Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
                Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
                Source: NEVER OPEN!.exe, 00000001.00000002.1894904086.000001F099640000.00000004.00001000.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000002.1894453507.000001F0985A4000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: `https://www.facebook.com/ equals www.facebook.com (Facebook)
                Source: NEVER OPEN!.exe, 00000001.00000002.1894453507.000001F0985A4000.00000004.00001000.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000002.1894904086.000001F099628000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: `https://www.youtube.com/ equals www.youtube.com (Youtube)
                Source: global trafficDNS traffic detected: DNS query: ipapi.co
                Source: global trafficDNS traffic detected: DNS query: discord.com
                Source: global trafficDNS traffic detected: DNS query: raw.githubusercontent.com
                Source: global trafficDNS traffic detected: DNS query: www.cloudflare.com
                Source: NEVER OPEN!.exe, 00000001.00000003.1867399628.000001F0963D9000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000003.1867569214.000001F096409000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000003.1866887734.000001F0963D8000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000002.1889208036.000001F096645000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000002.1885338288.000001F096412000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000003.1865767129.000001F096645000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000003.1877031715.000001F09662C000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000002.1889135569.000001F09662C000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://blog.cryptographyengineering.com/2012/05/how-to-choose-authenticated-encryption.html
                Source: NEVER OPEN!.exe, 00000000.00000003.1720631750.0000027663DF9000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000000.00000003.1720631750.0000027663E06000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0
                Source: NEVER OPEN!.exe, 00000000.00000003.1718374334.0000027663DF8000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000000.00000003.1718480312.0000027663DF8000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000000.00000003.1722997372.0000027663DF9000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000000.00000003.1718221490.0000027663DF8000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000000.00000003.1722852728.0000027663DF9000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000000.00000003.1718628289.0000027663DF8000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000000.00000003.1724659864.0000027663DF9000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000000.00000003.1718107183.0000027663DF8000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000000.00000003.1720275846.0000027663DF9000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000000.00000003.1718740947.0000027663DF8000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000000.00000003.1718999118.0000027663DF8000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000000.00000003.1719100684.0000027663DF8000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000000.00000003.1720724832.0000027663DF9000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000000.00000003.1718628289.0000027663E05000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000000.00000003.1718010752.0000027663DF8000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000000.00000003.1724481502.0000027663DF9000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000000.00000003.1718813658.0000027663DF8000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000000.00000003.1719208282.0000027663E05000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000000.00000003.1722746625.0000027663DF9000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000000.00000003.1724982936.0000027663DF9000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000000.00000003.1717924924.0000027663DF8000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E
                Source: NEVER OPEN!.exe, 00000000.00000003.1720631750.0000027663DF9000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000000.00000003.1720631750.0000027663E06000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2AssuredIDCodeSigningCA.crt0
                Source: NEVER OPEN!.exe, 00000000.00000003.1718374334.0000027663DF8000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000000.00000003.1718480312.0000027663DF8000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000000.00000003.1722997372.0000027663DF9000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000000.00000003.1718221490.0000027663DF8000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000000.00000003.1722852728.0000027663DF9000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000000.00000003.1718628289.0000027663DF8000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000000.00000003.1724659864.0000027663DF9000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000000.00000003.1718107183.0000027663DF8000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000000.00000003.1720275846.0000027663DF9000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000000.00000003.1718740947.0000027663DF8000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000000.00000003.1718999118.0000027663DF8000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000000.00000003.1719100684.0000027663DF8000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000000.00000003.1720724832.0000027663DF9000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000000.00000003.1718010752.0000027663DF8000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000000.00000003.1724481502.0000027663DF9000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000000.00000003.1718813658.0000027663DF8000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000000.00000003.1722746625.0000027663DF9000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000000.00000003.1724982936.0000027663DF9000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000000.00000003.1717924924.0000027663DF8000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000000.00000003.1719208282.0000027663DF8000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000000.00000003.1718914840.0000027663DF8000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crt0
                Source: NEVER OPEN!.exe, 00000000.00000003.1718374334.0000027663DF8000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000000.00000003.1718480312.0000027663DF8000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000000.00000003.1722997372.0000027663DF9000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000000.00000003.1718221490.0000027663DF8000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000000.00000003.1722852728.0000027663DF9000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000000.00000003.1718628289.0000027663DF8000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000000.00000003.1724659864.0000027663DF9000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000000.00000003.1718107183.0000027663DF8000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000000.00000003.1720275846.0000027663DF9000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000000.00000003.1718740947.0000027663DF8000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000000.00000003.1718999118.0000027663DF8000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000000.00000003.1719100684.0000027663DF8000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000000.00000003.1720724832.0000027663DF9000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000000.00000003.1718010752.0000027663DF8000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000000.00000003.1724481502.0000027663DF9000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000000.00000003.1718813658.0000027663DF8000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000000.00000003.1722746625.0000027663DF9000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000000.00000003.1724982936.0000027663DF9000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000000.00000003.1717924924.0000027663DF8000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000000.00000003.1719208282.0000027663DF8000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000000.00000003.1718914840.0000027663DF8000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0
                Source: NEVER OPEN!.exe, 00000000.00000003.1718374334.0000027663DF8000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000000.00000003.1718480312.0000027663DF8000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000000.00000003.1722997372.0000027663DF9000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000000.00000003.1718221490.0000027663DF8000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000000.00000003.1722852728.0000027663DF9000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000000.00000003.1718628289.0000027663DF8000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000000.00000003.1724659864.0000027663DF9000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000000.00000003.1718107183.0000027663DF8000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000000.00000003.1720275846.0000027663DF9000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000000.00000003.1718740947.0000027663DF8000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000000.00000003.1718999118.0000027663DF8000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000000.00000003.1719100684.0000027663DF8000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000000.00000003.1720724832.0000027663DF9000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000000.00000003.1718628289.0000027663E05000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000000.00000003.1718010752.0000027663DF8000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000000.00000003.1724481502.0000027663DF9000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000000.00000003.1718813658.0000027663DF8000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000000.00000003.1719208282.0000027663E05000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000000.00000003.1722746625.0000027663DF9000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000000.00000003.1724982936.0000027663DF9000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000000.00000003.1717924924.0000027663DF8000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
                Source: NEVER OPEN!.exe, 00000001.00000002.1889788062.000001F096AA0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://chardet.feedparser.org/
                Source: NEVER OPEN!.exe, 00000001.00000002.1889788062.000001F096AA0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://chardet.feedparser.org/p=
                Source: NEVER OPEN!.exe, 00000001.00000003.1875075177.000001F095CE8000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000003.1867285529.000001F096510000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000003.1868292392.000001F095C9E000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000003.1866887734.000001F096510000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000003.1871406964.000001F095CE7000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000003.1872449458.000001F096566000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000003.1869721795.000001F095CBB000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000003.1870753414.000001F09654A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://code.activestate.com/recipes/577452-a-memoize-decorator-for-instance-methods/
                Source: NEVER OPEN!.exe, 00000001.00000003.1869547578.000001F095E13000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000003.1742101263.000001F095DFC000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000003.1742101263.000001F095DAD000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000003.1746818736.000001F095E13000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000003.1874591942.000001F095E1B000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000002.1883341863.000001F095E1E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://code.activestate.com/recipes/577916/
                Source: NEVER OPEN!.exe, 00000001.00000003.1874305117.000001F0974F9000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000003.1869260303.000001F096684000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000003.1874681025.000001F097500000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000003.1863855088.000001F096684000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000003.1788868906.000001F0976A2000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000003.1863985982.000001F0974DC000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000003.1780149602.000001F0976A2000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000003.1793423772.000001F0976A2000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000003.1865696051.000001F095D0D000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000002.1891393968.000001F097504000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000002.1889252951.000001F09668A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl.certigna.fr/certignarootca.crl01
                Source: NEVER OPEN!.exe, 00000001.00000003.1867399628.000001F0963D9000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000002.1892734894.000001F097719000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000003.1867569214.000001F096409000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000003.1865828206.000001F09762E000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000003.1867966006.000001F09764B000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000003.1866887734.000001F0963D8000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000003.1866436381.000001F097716000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000003.1864747713.000001F097602000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000002.1885338288.000001F096412000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000003.1866533702.000001F097644000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000003.1863122925.000001F0975EE000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000003.1865994897.000001F097639000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl.comodoca.com/AAACertificateServices.crl06
                Source: NEVER OPEN!.exe, 00000001.00000003.1766790298.000001F0974DC000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000003.1766273937.000001F0975C8000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000003.1776290730.000001F09763E000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000003.1866390219.000001F097671000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000003.1795315174.000001F097671000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000003.1780149602.000001F09763E000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000003.1866338256.000001F097610000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000003.1863122925.000001F0975EE000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000003.1866509171.000001F097617000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000003.1795186531.000001F097663000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000003.1793423772.000001F09763E000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000003.1873000781.000001F097674000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl.comodoca.com/COMODOCertificationAuthority.crl
                Source: NEVER OPEN!.exe, 00000001.00000003.1793423772.000001F0976A2000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000003.1865696051.000001F095D0D000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000002.1891393968.000001F097504000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl.dhimyotis.com/certignarootca.crl
                Source: NEVER OPEN!.exe, 00000001.00000003.1869260303.000001F096684000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000003.1863855088.000001F096684000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000003.1869038207.000001F09779D000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000003.1859519257.000001F09779D000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000002.1889252951.000001F09668A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl.dhimyotis.com/certignarootca.crl0
                Source: NEVER OPEN!.exe, 00000001.00000003.1766790298.000001F0974DC000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000003.1866338256.000001F097610000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000003.1863122925.000001F0975EE000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl.securetrust.com/SGCA.crl
                Source: NEVER OPEN!.exe, 00000001.00000003.1795042561.000001F0974DC000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000003.1874305117.000001F0974F9000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000003.1874681025.000001F097500000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000003.1863985982.000001F0974DC000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000003.1766790298.000001F0974DC000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000002.1891271962.000001F0974EF000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000002.1891393968.000001F097504000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl.securetrust.com/SGCA.crl0
                Source: NEVER OPEN!.exe, 00000001.00000003.1864747713.000001F097602000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000003.1866412775.000001F097626000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000003.1866338256.000001F097610000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000003.1863122925.000001F0975EE000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl.securetrust.com/SGCA.crlex
                Source: NEVER OPEN!.exe, 00000001.00000003.1795042561.000001F0974DC000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl.securetrust.com/SGCA.crlfts3
                Source: NEVER OPEN!.exe, 00000001.00000003.1795042561.000001F0974DC000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000003.1864747713.000001F097602000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000003.1866412775.000001F097626000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000003.1766790298.000001F0974DC000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000003.1866338256.000001F097610000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000003.1863122925.000001F0975EE000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl.securetrust.com/STCA.crl
                Source: NEVER OPEN!.exe, 00000001.00000003.1795042561.000001F0974DC000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000003.1863985982.000001F0974DC000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000003.1766790298.000001F0974DC000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000002.1891271962.000001F0974EF000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl.securetrust.com/STCA.crl0
                Source: NEVER OPEN!.exe, 00000001.00000003.1864747713.000001F097602000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000003.1866412775.000001F097626000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000003.1866338256.000001F097610000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000003.1863122925.000001F0975EE000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl.securetrust.com/STCA.crldex
                Source: NEVER OPEN!.exe, 00000000.00000003.1720631750.0000027663DF9000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl.thawte.com/ThawteTimestampingCA.crl0
                Source: NEVER OPEN!.exe, 00000001.00000003.1795042561.000001F0974DC000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl.xrampsec
                Source: NEVER OPEN!.exe, 00000001.00000003.1795042561.000001F0974DC000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000003.1864747713.000001F097602000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000003.1866412775.000001F097626000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000003.1766790298.000001F0974DC000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000003.1866338256.000001F097610000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000003.1863122925.000001F0975EE000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl.xrampsecurity.com/XGCA.crl
                Source: NEVER OPEN!.exe, 00000001.00000003.1865828206.000001F09762E000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000003.1795108227.000001F09763E000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000003.1867966006.000001F09764B000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000003.1864747713.000001F097602000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000002.1892221361.000001F09764E000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000003.1766790298.000001F0974DC000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000003.1776290730.000001F09763E000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000003.1866533702.000001F097644000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000003.1780149602.000001F09763E000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000003.1863122925.000001F0975EE000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000003.1865994897.000001F097639000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000003.1795348868.000001F097645000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000003.1793423772.000001F09763E000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000003.1873148359.000001F09764E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl.xrampsecurity.com/XGCA.crl0
                Source: NEVER OPEN!.exe, 00000000.00000003.1718999118.0000027663DF8000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl3.digicert.com/Dig
                Source: NEVER OPEN!.exe, 00000000.00000003.1718374334.0000027663DF8000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000000.00000003.1718480312.0000027663DF8000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000000.00000003.1722997372.0000027663DF9000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000000.00000003.1718221490.0000027663DF8000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000000.00000003.1722852728.0000027663DF9000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000000.00000003.1718628289.0000027663DF8000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000000.00000003.1724659864.0000027663DF9000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000000.00000003.1718107183.0000027663DF8000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000000.00000003.1720275846.0000027663DF9000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000000.00000003.1718740947.0000027663DF8000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000000.00000003.1718999118.0000027663DF8000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000000.00000003.1719100684.0000027663DF8000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000000.00000003.1720724832.0000027663DF9000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000000.00000003.1718628289.0000027663E05000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000000.00000003.1718010752.0000027663DF8000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000000.00000003.1724481502.0000027663DF9000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000000.00000003.1718813658.0000027663DF8000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000000.00000003.1719208282.0000027663E05000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000000.00000003.1722746625.0000027663DF9000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000000.00000003.1724982936.0000027663DF9000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000000.00000003.1717924924.0000027663DF8000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0
                Source: NEVER OPEN!.exe, 00000000.00000003.1720631750.0000027663DF9000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000000.00000003.1720631750.0000027663E06000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0O
                Source: NEVER OPEN!.exe, 00000000.00000003.1718374334.0000027663DF8000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000000.00000003.1718480312.0000027663DF8000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000000.00000003.1722997372.0000027663DF9000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000000.00000003.1718221490.0000027663DF8000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000000.00000003.1722852728.0000027663DF9000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000000.00000003.1718628289.0000027663DF8000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000000.00000003.1724659864.0000027663DF9000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000000.00000003.1718107183.0000027663DF8000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000000.00000003.1720275846.0000027663DF9000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000000.00000003.1718740947.0000027663DF8000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000000.00000003.1718999118.0000027663DF8000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000000.00000003.1719100684.0000027663DF8000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000000.00000003.1720724832.0000027663DF9000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000000.00000003.1718010752.0000027663DF8000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000000.00000003.1724481502.0000027663DF9000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000000.00000003.1718813658.0000027663DF8000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000000.00000003.1722746625.0000027663DF9000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000000.00000003.1724982936.0000027663DF9000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000000.00000003.1717924924.0000027663DF8000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000000.00000003.1719208282.0000027663DF8000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000000.00000003.1718914840.0000027663DF8000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0S
                Source: NEVER OPEN!.exe, 00000000.00000003.1718374334.0000027663DF8000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000000.00000003.1718480312.0000027663DF8000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000000.00000003.1722997372.0000027663DF9000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000000.00000003.1718221490.0000027663DF8000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000000.00000003.1722852728.0000027663DF9000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000000.00000003.1718628289.0000027663DF8000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000000.00000003.1724659864.0000027663DF9000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000000.00000003.1718107183.0000027663DF8000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000000.00000003.1720275846.0000027663DF9000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000000.00000003.1718740947.0000027663DF8000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000000.00000003.1718999118.0000027663DF8000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000000.00000003.1719100684.0000027663DF8000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000000.00000003.1720724832.0000027663DF9000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000000.00000003.1718010752.0000027663DF8000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000000.00000003.1724481502.0000027663DF9000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000000.00000003.1718813658.0000027663DF8000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000000.00000003.1722746625.0000027663DF9000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000000.00000003.1724982936.0000027663DF9000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000000.00000003.1717924924.0000027663DF8000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000000.00000003.1719208282.0000027663DF8000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000000.00000003.1718914840.0000027663DF8000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0
                Source: dat.txt, 0000001F.00000003.2025585356.000001E72D468000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
                Source: NEVER OPEN!.exe, 00000000.00000003.1720631750.0000027663DF9000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000000.00000003.1720631750.0000027663E06000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl3.digicert.com/sha2-assured-cs-g1.crl05
                Source: NEVER OPEN!.exe, 00000000.00000003.1720631750.0000027663E06000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl4.digicert.com/DigiCertAssuredIDRootCA.crl0:
                Source: NEVER OPEN!.exe, 00000000.00000003.1718374334.0000027663DF8000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000000.00000003.1718480312.0000027663DF8000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000000.00000003.1722997372.0000027663DF9000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000000.00000003.1718221490.0000027663DF8000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000000.00000003.1722852728.0000027663DF9000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000000.00000003.1718628289.0000027663DF8000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000000.00000003.1724659864.0000027663DF9000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000000.00000003.1718107183.0000027663DF8000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000000.00000003.1720275846.0000027663DF9000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000000.00000003.1718740947.0000027663DF8000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000000.00000003.1718999118.0000027663DF8000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000000.00000003.1719100684.0000027663DF8000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000000.00000003.1720724832.0000027663DF9000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000000.00000003.1718010752.0000027663DF8000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000000.00000003.1724481502.0000027663DF9000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000000.00000003.1718813658.0000027663DF8000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000000.00000003.1722746625.0000027663DF9000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000000.00000003.1724982936.0000027663DF9000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000000.00000003.1717924924.0000027663DF8000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000000.00000003.1719208282.0000027663DF8000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000000.00000003.1718914840.0000027663DF8000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl4.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0
                Source: NEVER OPEN!.exe, 00000000.00000003.1720631750.0000027663DF9000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000000.00000003.1720631750.0000027663E06000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl4.digicert.com/sha2-assured-cs-g1.crl0L
                Source: NEVER OPEN!.exe, 00000001.00000003.1867399628.000001F0963D9000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000003.1867569214.000001F096409000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000003.1866887734.000001F0963D8000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000002.1885338288.000001F096412000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000003.1877031715.000001F09662C000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000002.1889135569.000001F09662C000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://csrc.nist.gov/groups/ST/toolkit/BCM/documents/proposedmodes/eax/eax-spec.pdf
                Source: NEVER OPEN!.exe, 00000001.00000003.1867399628.000001F0963D9000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000003.1867569214.000001F096409000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000003.1866887734.000001F0963D8000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000002.1885338288.000001F096412000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000003.1877031715.000001F09662C000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000002.1889135569.000001F09662C000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://csrc.nist.gov/publications/nistpubs/800-38C/SP800-38C.pdf
                Source: NEVER OPEN!.exe, 00000001.00000003.1867399628.000001F0963D9000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000003.1867569214.000001F096409000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000003.1866887734.000001F0963D8000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000002.1889208036.000001F096645000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000002.1885338288.000001F096412000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000003.1865767129.000001F096645000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://csrc.nist.gov/publications/nistpubs/800-38D/SP-800-38D.pdf
                Source: NEVER OPEN!.exe, 00000001.00000003.1874724322.000001F096584000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000003.1867285529.000001F096510000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000002.1889788062.000001F096AA0000.00000004.00001000.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000003.1866887734.000001F096510000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000003.1872449458.000001F096566000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000002.1890206695.000001F096FF0000.00000004.00001000.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000002.1889596330.000001F0968A0000.00000004.00001000.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000002.1888533425.000001F096587000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000002.1890308306.000001F0970F0000.00000004.00001000.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000003.1877031715.000001F09662C000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000003.1875471356.000001F095888000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000002.1889135569.000001F09662C000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000003.1873753770.000001F09656C000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000003.1875150816.000001F095857000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000003.1870753414.000001F09654A000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000002.1880951206.000001F09588B000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://csrc.nist.gov/publications/nistpubs/800-38a/sp800-38a.pdf
                Source: NEVER OPEN!.exe, 00000001.00000002.1890206695.000001F096FF0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://curl.haxx.se/rfc/cookie_spec.html
                Source: NEVER OPEN!.exe, 00000001.00000002.1893418081.000001F097A50000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://docs.python.org/3/library/subprocess#subprocess.Popen.kill
                Source: NEVER OPEN!.exe, 00000001.00000002.1890308306.000001F0970F0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://docs.python.org/3/library/subprocess#subprocess.Popen.returncode
                Source: NEVER OPEN!.exe, 00000001.00000002.1889881614.000001F096BA0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://docs.python.org/3/library/subprocess#subprocess.Popen.terminate
                Source: NEVER OPEN!.exe, 00000001.00000003.1746818736.000001F095D1D000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000003.1748289517.000001F095DAC000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000002.1883696004.000001F095E40000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://docs.python.org/library/itertools.html#recipes
                Source: NEVER OPEN!.exe, 00000001.00000002.1883832510.000001F095F40000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://github.com/ActiveState/appdirs
                Source: NEVER OPEN!.exe, 00000001.00000002.1889881614.000001F096BA0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://goo.gl/zeJZl
                Source: NEVER OPEN!.exe, 00000001.00000003.1867399628.000001F0963D9000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000003.1867569214.000001F096409000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000003.1866887734.000001F0963D8000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000002.1885338288.000001F096412000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://google.com/
                Source: NEVER OPEN!.exe, 00000001.00000003.1874217754.000001F095D70000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000003.1875606707.000001F095DA1000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000003.1869627513.000001F095D5F000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000003.1876866086.000001F095DA7000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://google.com/mail/
                Source: NEVER OPEN!.exe, 00000001.00000003.1874217754.000001F095D70000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000003.1875606707.000001F095DA1000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000003.1870689292.000001F095922000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000003.1867207825.000001F09591C000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000003.1869627513.000001F095D5F000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000003.1877251993.000001F095DAB000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000003.1876866086.000001F095DA7000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000002.1881418163.000001F095923000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://hg.python.org/cpython/file/603b4d593758/Lib/socket.py#l535
                Source: NEVER OPEN!.exe, 00000001.00000003.1872946214.000001F0971F1000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://httpbin.org/post
                Source: NEVER OPEN!.exe, 00000001.00000002.1889692319.000001F0969A0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://mail.python.org/pipermail/python-dev/2012-June/120787.html
                Source: NEVER OPEN!.exe, 00000001.00000003.1766273937.000001F0975C8000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000003.1776290730.000001F09763E000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000003.1780149602.000001F09763E000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000003.1795186531.000001F097663000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000003.1793423772.000001F09763E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://ocsp.accv.es
                Source: NEVER OPEN!.exe, 00000001.00000003.1795108227.000001F09763E000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000003.1873103669.000001F095D16000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000002.1891810964.000001F0975A2000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000003.1776290730.000001F09763E000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000003.1780149602.000001F09763E000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000003.1865696051.000001F095D0D000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000003.1795348868.000001F097645000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000003.1793423772.000001F09763E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://ocsp.accv.es0
                Source: NEVER OPEN!.exe, 00000001.00000002.1892734894.000001F097719000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000003.1795276580.000001F097677000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000003.1795108227.000001F09763E000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000003.1866436381.000001F097716000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000003.1795396100.000001F09767F000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000003.1776290730.000001F09763E000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000003.1780149602.000001F09763E000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000003.1795186531.000001F097663000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000003.1793423772.000001F09763E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://ocsp.accv.ese
                Source: NEVER OPEN!.exe, 00000000.00000003.1718374334.0000027663DF8000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000000.00000003.1718480312.0000027663DF8000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000000.00000003.1722997372.0000027663DF9000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000000.00000003.1718221490.0000027663DF8000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000000.00000003.1722852728.0000027663DF9000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000000.00000003.1718628289.0000027663DF8000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000000.00000003.1724659864.0000027663DF9000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000000.00000003.1718107183.0000027663DF8000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000000.00000003.1720275846.0000027663DF9000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000000.00000003.1718740947.0000027663DF8000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000000.00000003.1718999118.0000027663DF8000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000000.00000003.1719100684.0000027663DF8000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000000.00000003.1720724832.0000027663DF9000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000000.00000003.1718010752.0000027663DF8000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000000.00000003.1724481502.0000027663DF9000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000000.00000003.1718813658.0000027663DF8000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000000.00000003.1722746625.0000027663DF9000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000000.00000003.1724982936.0000027663DF9000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000000.00000003.1717924924.0000027663DF8000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000000.00000003.1719208282.0000027663DF8000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000000.00000003.1718914840.0000027663DF8000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://ocsp.digicert.com0
                Source: NEVER OPEN!.exe, 00000000.00000003.1718374334.0000027663DF8000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000000.00000003.1718480312.0000027663DF8000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000000.00000003.1722997372.0000027663DF9000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000000.00000003.1718221490.0000027663DF8000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000000.00000003.1722852728.0000027663DF9000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000000.00000003.1718628289.0000027663DF8000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000000.00000003.1724659864.0000027663DF9000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000000.00000003.1718107183.0000027663DF8000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000000.00000003.1720275846.0000027663DF9000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000000.00000003.1718740947.0000027663DF8000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000000.00000003.1718999118.0000027663DF8000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000000.00000003.1719100684.0000027663DF8000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000000.00000003.1720724832.0000027663DF9000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000000.00000003.1718628289.0000027663E05000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000000.00000003.1718010752.0000027663DF8000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000000.00000003.1724481502.0000027663DF9000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000000.00000003.1718813658.0000027663DF8000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000000.00000003.1719208282.0000027663E05000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000000.00000003.1722746625.0000027663DF9000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000000.00000003.1724982936.0000027663DF9000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000000.00000003.1717924924.0000027663DF8000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://ocsp.digicert.com0A
                Source: NEVER OPEN!.exe, 00000000.00000003.1718374334.0000027663DF8000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000000.00000003.1718480312.0000027663DF8000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000000.00000003.1720631750.0000027663DF9000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000000.00000003.1722997372.0000027663DF9000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000000.00000003.1718221490.0000027663DF8000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000000.00000003.1722852728.0000027663DF9000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000000.00000003.1718628289.0000027663DF8000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000000.00000003.1724659864.0000027663DF9000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000000.00000003.1718107183.0000027663DF8000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000000.00000003.1720275846.0000027663DF9000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000000.00000003.1718740947.0000027663DF8000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000000.00000003.1718999118.0000027663DF8000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000000.00000003.1719100684.0000027663DF8000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000000.00000003.1720724832.0000027663DF9000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000000.00000003.1718628289.0000027663E05000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000000.00000003.1718010752.0000027663DF8000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000000.00000003.1724481502.0000027663DF9000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000000.00000003.1718813658.0000027663DF8000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000000.00000003.1719208282.0000027663E05000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000000.00000003.1722746625.0000027663DF9000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000000.00000003.1724982936.0000027663DF9000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://ocsp.digicert.com0C
                Source: NEVER OPEN!.exe, 00000000.00000003.1720631750.0000027663DF9000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000000.00000003.1720631750.0000027663E06000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://ocsp.digicert.com0N
                Source: NEVER OPEN!.exe, 00000000.00000003.1718374334.0000027663DF8000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000000.00000003.1718480312.0000027663DF8000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000000.00000003.1722997372.0000027663DF9000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000000.00000003.1718221490.0000027663DF8000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000000.00000003.1722852728.0000027663DF9000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000000.00000003.1718628289.0000027663DF8000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000000.00000003.1724659864.0000027663DF9000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000000.00000003.1718107183.0000027663DF8000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000000.00000003.1720275846.0000027663DF9000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000000.00000003.1718740947.0000027663DF8000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000000.00000003.1718999118.0000027663DF8000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000000.00000003.1719100684.0000027663DF8000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000000.00000003.1720724832.0000027663DF9000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000000.00000003.1718010752.0000027663DF8000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000000.00000003.1724481502.0000027663DF9000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000000.00000003.1718813658.0000027663DF8000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000000.00000003.1722746625.0000027663DF9000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000000.00000003.1724982936.0000027663DF9000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000000.00000003.1717924924.0000027663DF8000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000000.00000003.1719208282.0000027663DF8000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000000.00000003.1718914840.0000027663DF8000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://ocsp.digicert.com0X
                Source: NEVER OPEN!.exe, 00000000.00000003.1720631750.0000027663DF9000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://ocsp.thawte.com0
                Source: NEVER OPEN!.exe, 00000001.00000002.1881898101.000001F095B40000.00000004.00001000.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000002.1879835755.000001F095130000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://opensource.apple.com/source/CF/CF-744.18/CFBinaryPList.c
                Source: NEVER OPEN!.exe, 00000000.00000003.1727627941.0000027663DF9000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://packages.python.org/altgraph
                Source: NEVER OPEN!.exe, 00000000.00000003.1727627941.0000027663DF9000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://pypi.python.org/pypi/altgraph
                Source: NEVER OPEN!.exe, 00000000.00000003.1727627941.0000027663DF9000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://pypi.python.org/pypi/sphinx
                Source: NEVER OPEN!.exe, 00000001.00000002.1893515704.000001F097C40000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://python.org
                Source: NEVER OPEN!.exe, 00000001.00000003.1872384714.000001F09725C000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://python.org/
                Source: NEVER OPEN!.exe, 00000001.00000002.1893515704.000001F097C40000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://python.org:80
                Source: NEVER OPEN!.exe, 00000001.00000003.1766790298.000001F0974DC000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000003.1776290730.000001F09763E000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000003.1780149602.000001F09763E000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000003.1866338256.000001F097610000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000003.1863122925.000001F0975EE000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000003.1866509171.000001F097617000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000003.1795186531.000001F097663000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000003.1793423772.000001F09763E000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000002.1892598384.000001F0976B4000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://repository.swisssign.com/
                Source: NEVER OPEN!.exe, 00000001.00000003.1795108227.000001F09763E000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000003.1776290730.000001F09763E000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000003.1780149602.000001F09763E000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000003.1795186531.000001F097663000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000003.1793423772.000001F09763E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://repository.swisssign.com/1;
                Source: NEVER OPEN!.exe, 00000001.00000003.1865464973.000001F0976A2000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000003.1866464509.000001F0976B1000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000002.1892598384.000001F0976B4000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://repository.swisssign.com/7
                Source: NEVER OPEN!.exe, 00000001.00000003.1795108227.000001F09763E000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000003.1776290730.000001F09763E000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000003.1780149602.000001F09763E000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000003.1795186531.000001F097663000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000003.1793423772.000001F09763E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://repository.swisssign.com/U
                Source: dat.txtString found in binary or memory: http://schemas.mi
                Source: NEVER OPEN!.exe, 00000001.00000002.1894215353.000001F0982D0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://timgolden.me.uk/python/wmi.html
                Source: NEVER OPEN!.exe, 00000001.00000002.1894215353.000001F0982D0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://timgolden.me.uk/python/wmi.htmlread
                Source: NEVER OPEN!.exe, 00000001.00000003.1869811293.000001F0964B7000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000003.1867399628.000001F0963D9000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000003.1867569214.000001F096409000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000003.1866887734.000001F0963D8000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000002.1885338288.000001F096412000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000002.1886398465.000001F0964BA000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://tools.ietf.org/html/rfc4880
                Source: NEVER OPEN!.exe, 00000001.00000002.1890206695.000001F096FF0000.00000004.00001000.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000002.1893418081.000001F097A50000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://tools.ietf.org/html/rfc5297
                Source: NEVER OPEN!.exe, 00000001.00000003.1867399628.000001F0963D9000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000003.1867569214.000001F096409000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000003.1866887734.000001F0963D8000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000002.1885338288.000001F096412000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://tools.ietf.org/html/rfc5869
                Source: NEVER OPEN!.exe, 00000001.00000002.1890102466.000001F096EF0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://tools.ietf.org/html/rfc6125#section-6.4.3
                Source: NEVER OPEN!.exe, 00000000.00000003.1720631750.0000027663DF9000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://ts-aia.ws.symantec.com/tss-ca-g2.cer0
                Source: NEVER OPEN!.exe, 00000000.00000003.1720631750.0000027663DF9000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://ts-crl.ws.symantec.com/tss-ca-g2.crl0(
                Source: NEVER OPEN!.exe, 00000000.00000003.1720631750.0000027663DF9000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://ts-ocsp.ws.symantec.com07
                Source: NEVER OPEN!.exe, 00000001.00000003.1872946214.000001F0971F1000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000002.1890431124.000001F097203000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://web.cs.ucdavis.edu/~rogaway/ocb/license.htm
                Source: NEVER OPEN!.exe, 00000001.00000002.1892734894.000001F097719000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000003.1795276580.000001F097677000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000003.1795108227.000001F09763E000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000003.1866436381.000001F097716000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000003.1795396100.000001F09767F000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000003.1873103669.000001F095D16000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000002.1891810964.000001F0975A2000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000003.1766273937.000001F0975C8000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000003.1776290730.000001F09763E000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000003.1780149602.000001F09763E000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000003.1865696051.000001F095D0D000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000003.1795348868.000001F097645000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000003.1795186531.000001F097663000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000003.1793423772.000001F09763E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.accv.es/fileadmin/Archivos/certificados/raizaccv1.crt0
                Source: NEVER OPEN!.exe, 00000001.00000003.1793423772.000001F09763E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.accv.es/fileadmin/Archivos/certificados/raizaccv1_der.crl
                Source: NEVER OPEN!.exe, 00000001.00000002.1892323666.000001F097687000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000003.1795108227.000001F09763E000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000003.1864747713.000001F097602000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000003.1865464973.000001F097663000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000003.1873103669.000001F095D16000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000002.1891810964.000001F0975A2000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000003.1776290730.000001F09763E000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000003.1780149602.000001F09763E000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000003.1865696051.000001F095D0D000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000003.1863122925.000001F0975EE000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000003.1795348868.000001F097645000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000003.1793423772.000001F09763E000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000003.1866659826.000001F097686000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000003.1866191590.000001F09767F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.accv.es/fileadmin/Archivos/certificados/raizaccv1_der.crl0
                Source: NEVER OPEN!.exe, 00000001.00000003.1766790298.000001F0974DC000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.accv.es/fileadmin/Archivos/certificados/raizaccv1_der.crlP
                Source: NEVER OPEN!.exe, 00000001.00000003.1873000781.000001F09766C000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000003.1864747713.000001F097602000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000003.1865464973.000001F097663000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000003.1863122925.000001F0975EE000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000002.1892292252.000001F09766C000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.accv.es/fileadmin/Archivos/certificados/raizaccv1_der.crlv
                Source: NEVER OPEN!.exe, 00000001.00000003.1872946214.000001F0971F1000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000002.1890462247.000001F097216000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.accv.es/legislacion_c.htm
                Source: NEVER OPEN!.exe, 00000001.00000002.1892323666.000001F097687000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000003.1795108227.000001F09763E000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000003.1864747713.000001F097602000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000003.1865464973.000001F097663000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000003.1873103669.000001F095D16000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000002.1891810964.000001F0975A2000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000003.1776290730.000001F09763E000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000003.1780149602.000001F09763E000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000003.1865696051.000001F095D0D000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000003.1863122925.000001F0975EE000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000003.1795348868.000001F097645000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000003.1793423772.000001F09763E000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000003.1866659826.000001F097686000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000003.1866191590.000001F09767F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.accv.es/legislacion_c.htm0U
                Source: NEVER OPEN!.exe, 00000001.00000003.1872946214.000001F0971F1000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000002.1890462247.000001F097216000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.accv.es/legislacion_c.htmz1
                Source: NEVER OPEN!.exe, 00000001.00000003.1872946214.000001F0971F1000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000003.1795108227.000001F09763E000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000003.1873103669.000001F095D16000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000002.1891810964.000001F0975A2000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000003.1776290730.000001F09763E000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000002.1890462247.000001F097216000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000003.1780149602.000001F09763E000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000003.1865696051.000001F095D0D000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000003.1795348868.000001F097645000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000003.1793423772.000001F09763E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.accv.es00
                Source: NEVER OPEN!.exe, 00000000.00000003.1732075571.0000027663DF9000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.apache.org/licenses/
                Source: NEVER OPEN!.exe, 00000000.00000003.1732075571.0000027663E06000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000000.00000003.1732075571.0000027663DF9000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0
                Source: NEVER OPEN!.exe, 00000001.00000002.1883696004.000001F095E40000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://www.apple.com/DTDs/PropertyList-1.0.dtd
                Source: NEVER OPEN!.exe, 00000001.00000003.1873581283.000001F097495000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000003.1864747713.000001F097602000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000003.1874932917.000001F0974B0000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000003.1866412775.000001F097626000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000003.1766273937.000001F0975C8000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000003.1866338256.000001F097610000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000003.1863122925.000001F0975EE000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.cert.fnmt.es/dpcs/
                Source: NEVER OPEN!.exe, 00000001.00000003.1766273937.000001F0975C8000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.cert.fnmt.es/dpcs/egVn
                Source: NEVER OPEN!.exe, 00000001.00000003.1867399628.000001F0963D9000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000003.1867569214.000001F096409000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000003.1866887734.000001F0963D8000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000002.1889208036.000001F096645000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000002.1885338288.000001F096412000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000003.1865767129.000001F096645000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.cs.ucdavis.edu/~rogaway/papers/keywrap.pdf
                Source: NEVER OPEN!.exe, 00000000.00000003.1718374334.0000027663DF8000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000000.00000003.1718480312.0000027663DF8000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000000.00000003.1722997372.0000027663DF9000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000000.00000003.1718221490.0000027663DF8000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000000.00000003.1722852728.0000027663DF9000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000000.00000003.1718628289.0000027663DF8000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000000.00000003.1724659864.0000027663DF9000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000000.00000003.1718107183.0000027663DF8000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000000.00000003.1720275846.0000027663DF9000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000000.00000003.1718740947.0000027663DF8000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000000.00000003.1718999118.0000027663DF8000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000000.00000003.1719100684.0000027663DF8000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000000.00000003.1720724832.0000027663DF9000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000000.00000003.1718010752.0000027663DF8000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000000.00000003.1724481502.0000027663DF9000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000000.00000003.1718813658.0000027663DF8000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000000.00000003.1722746625.0000027663DF9000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000000.00000003.1724982936.0000027663DF9000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000000.00000003.1717924924.0000027663DF8000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000000.00000003.1719208282.0000027663DF8000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000000.00000003.1718914840.0000027663DF8000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.digicert.com/CPS0
                Source: NEVER OPEN!.exe, 00000001.00000003.1872946214.000001F0971F1000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000003.1795276580.000001F0976A2000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000003.1795331629.000001F0976B1000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000002.1890619309.000001F0972FC000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000003.1788868906.000001F0976A2000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000003.1865464973.000001F0976A2000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000003.1866464509.000001F0976B1000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000003.1780149602.000001F0976A2000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000003.1766273937.000001F0975C8000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000002.1890462247.000001F097216000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000003.1793423772.000001F0976A2000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000002.1892598384.000001F0976B4000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.firmaprofesional.com/cps0
                Source: NEVER OPEN!.exe, 00000001.00000003.1874217754.000001F095D70000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000003.1875606707.000001F095DA1000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000003.1869627513.000001F095D5F000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000003.1876866086.000001F095DA7000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.iana.org/assignments/tls-parameters/tls-parameters.xml#tls-parameters-6
                Source: NEVER OPEN!.exe, 00000001.00000003.1869811293.000001F0964B7000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000003.1867399628.000001F0963D9000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000003.1867569214.000001F096409000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000003.1866887734.000001F0963D8000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000003.1875247294.000001F0964C3000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000003.1871028242.000001F0964C1000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.opensource.org/licenses/mit-license.php
                Source: NEVER OPEN!.exe, 00000000.00000003.1733101901.0000027663DF9000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.pyinstaller.org/
                Source: NEVER OPEN!.exe, 00000000.00000003.1733101901.0000027663DF9000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.pyinstaller.org/support.html
                Source: NEVER OPEN!.exe, 00000001.00000003.1874418076.000001F095904000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000003.1868261871.000001F095903000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.quovadisglobal.com/cps
                Source: NEVER OPEN!.exe, 00000001.00000003.1875330985.000001F097460000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000003.1877208570.000001F097472000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000003.1766457914.000001F097363000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000003.1874148217.000001F097453000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.quovadisglobal.com/cps0
                Source: NEVER OPEN!.exe, 00000001.00000003.1872946214.000001F0971F1000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000002.1890431124.000001F097203000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.rfc-editor.org/info/rfc7253
                Source: NEVER OPEN!.exe, 00000001.00000003.1867399628.000001F0963D9000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000003.1867569214.000001F096409000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000003.1866887734.000001F0963D8000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000002.1885338288.000001F096412000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.tarsnap.com/scrypt/scrypt-slides.pdf
                Source: NEVER OPEN!.exe, 00000001.00000003.1874724322.000001F096584000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000003.1867285529.000001F096510000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000003.1866887734.000001F096510000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000003.1872449458.000001F096566000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000002.1888533425.000001F096587000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000003.1873753770.000001F09656C000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000003.1870753414.000001F09654A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://wwwsearch.sf.net/):
                Source: NEVER OPEN!.exe, 00000001.00000003.1867399628.000001F0963D9000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000003.1874724322.000001F096584000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000003.1867569214.000001F096409000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000003.1867285529.000001F096510000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000003.1866887734.000001F0963D8000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000003.1866887734.000001F096510000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000002.1888632190.000001F0965A4000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000003.1872449458.000001F096566000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000002.1885338288.000001F096412000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000003.1876289881.000001F0965A2000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000003.1873753770.000001F09656C000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000003.1870753414.000001F09654A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://127.0.0.1:8443
                Source: NEVER OPEN!.exe, 00000001.00000002.1894453507.000001F0985C0000.00000004.00001000.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000002.1894904086.000001F099640000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://MD8.mozilla.org/1/m
                Source: NEVER OPEN!.exe, 00000001.00000002.1892734894.000001F097770000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000002.1894904086.000001F0996D4000.00000004.00001000.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000002.1894904086.000001F099628000.00000004.00001000.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000003.1792420967.000001F097770000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://account.bellmedia.c
                Source: NEVER OPEN!.exe, 00000001.00000002.1894904086.000001F099640000.00000004.00001000.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000002.1894453507.000001F0985A4000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://allegro.pl/
                Source: NEVER OPEN!.exe, 00000000.00000003.1727627941.0000027663DF9000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://altgraph.readthedocs.io
                Source: NEVER OPEN!.exe, 00000000.00000003.1727627941.0000027663DF9000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://altgraph.readthedocs.io/en/latest/
                Source: NEVER OPEN!.exe, 00000001.00000002.1893515704.000001F097C40000.00000004.00001000.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000002.1890619309.000001F0972AF000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://bugs.python.org/issue37179
                Source: NEVER OPEN!.exe, 00000001.00000002.1894340923.000001F0983D0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://bugzilla.mo
                Source: NEVER OPEN!.exe, 00000001.00000002.1893884891.000001F097FD0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://cdn.discordapp.com
                Source: NEVER OPEN!.exe, 00000001.00000003.1867399628.000001F0963D9000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000003.1867569214.000001F096409000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000003.1866887734.000001F0963D8000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000002.1885338288.000001F096412000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://cdnjs.cloudflare.com/ajax/libs/firacode/6.2.0/woff/FiraCode-Bold.woff
                Source: NEVER OPEN!.exe, 00000001.00000003.1867399628.000001F0963D9000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000003.1867569214.000001F096409000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000003.1866887734.000001F0963D8000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000002.1885338288.000001F096412000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://cdnjs.cloudflare.com/ajax/libs/firacode/6.2.0/woff/FiraCode-Regular.woff
                Source: NEVER OPEN!.exe, 00000001.00000003.1867399628.000001F0963D9000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000003.1867569214.000001F096409000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000003.1866887734.000001F0963D8000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000002.1885338288.000001F096412000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://cdnjs.cloudflare.com/ajax/libs/firacode/6.2.0/woff2/FiraCode-Bold.woff2
                Source: NEVER OPEN!.exe, 00000001.00000003.1867399628.000001F0963D9000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000003.1867569214.000001F096409000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000003.1866887734.000001F0963D8000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000002.1885338288.000001F096412000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://cdnjs.cloudflare.com/ajax/libs/firacode/6.2.0/woff2/FiraCode-Regular.woff2
                Source: NEVER OPEN!.exe, 00000001.00000003.1867399628.000001F0963D9000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000003.1867569214.000001F096409000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000003.1866887734.000001F0963D8000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000002.1885338288.000001F096412000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://click.palletsprojects.com/
                Source: NEVER OPEN!.exe, 00000001.00000003.1867399628.000001F0963D9000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000003.1874724322.000001F096584000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000003.1867569214.000001F096409000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000003.1867285529.000001F096510000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000003.1866887734.000001F0963D8000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000003.1866887734.000001F096510000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000002.1888632190.000001F0965A4000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000003.1872449458.000001F096566000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000002.1885338288.000001F096412000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000003.1876289881.000001F0965A2000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000003.1873753770.000001F09656C000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000003.1870753414.000001F09654A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://datatracker.ietf.org/doc/html/rfc3986#section-3.2.2
                Source: NEVER OPEN!.exe, 00000001.00000003.1874724322.000001F096584000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000003.1867285529.000001F096510000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000003.1866887734.000001F096510000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000002.1888632190.000001F0965A4000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000003.1872449458.000001F096566000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000003.1876289881.000001F0965A2000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000003.1873753770.000001F09656C000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000003.1870753414.000001F09654A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://datatracker.ietf.org/doc/html/rfc3986#section-3.2.3
                Source: NEVER OPEN!.exe, 00000001.00000002.1893994482.000001F0980D0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://discord.com/api/guilds/
                Source: NEVER OPEN!.exe, 00000001.00000002.1893884891.000001F097FD0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://discord.com/api/v
                Source: NEVER OPEN!.exe, 00000001.00000002.1893884891.000001F097FD0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://discord.com/api/v10
                Source: NEVER OPEN!.exe, 00000001.00000002.1893994482.000001F0980D0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://discord.com/api/v10/webhooks/1306712102454689894/mUtZxcKqgD0QOzmILD3IjZstQhJ4wDZAz0fITuzSl_A
                Source: NEVER OPEN!.exe, 00000001.00000002.1894215353.000001F098348000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://discord.com/api/webhooks/1306712102454689894/mUtZxcKqgD0QOzmILD3IjZstQhJ4wDZAz0fITuzSl_AZIun
                Source: NEVER OPEN!.exe, 00000001.00000002.1893994482.000001F0980D0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://discord.com/channels/
                Source: NEVER OPEN!.exe, 00000001.00000002.1890308306.000001F0970F0000.00000004.00001000.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000003.1877031715.000001F09662C000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000002.1889135569.000001F09662C000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://discord.com/developers/applications/
                Source: NEVER OPEN!.exe, 00000001.00000002.1893884891.000001F097FD0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://discord.com/events/
                Source: NEVER OPEN!.exe, 00000001.00000002.1893776235.000001F097EC0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://discord.com/oauth2/authorize?client_id=
                Source: NEVER OPEN!.exe, 00000001.00000002.1893884891.000001F097FD0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://discord.gg
                Source: NEVER OPEN!.exe, 00000001.00000002.1893884891.000001F097FD0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://discord.new/
                Source: NEVER OPEN!.exe, 00000001.00000002.1890619309.000001F0972FC000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://docs.aiohttp.org/en/stable
                Source: NEVER OPEN!.exe, 00000001.00000003.1795042561.000001F0974DC000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000003.1874305117.000001F0974F9000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000003.1872946214.000001F0971F1000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000003.1863985982.000001F0974DC000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000003.1766790298.000001F0974DC000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://docs.aiohttp.org/en/stable/client_advanced.html#client-tracing
                Source: NEVER OPEN!.exe, 00000001.00000002.1893515704.000001F097C40000.00000004.00001000.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000002.1890619309.000001F0972AF000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://docs.aiohttp.org/en/stable/client_advanced.html#proxy-support
                Source: NEVER OPEN!.exe, 00000000.00000003.1728329882.0000027663DF9000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://docs.github.com/en/account-and-profile/setting-up-and-managing-your-github-profile/customizi
                Source: NEVER OPEN!.exe, 00000001.00000002.1893515704.000001F097C40000.00000004.00001000.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000003.1874724322.000001F096584000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000003.1867285529.000001F096510000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000003.1866887734.000001F096510000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000002.1888632190.000001F0965A4000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000003.1872449458.000001F096566000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000003.1876289881.000001F0965A2000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000003.1873753770.000001F09656C000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000003.1870753414.000001F09654A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://docs.python.org/3/library/asyncio-eventloop.html
                Source: NEVER OPEN!.exe, 00000001.00000002.1884370641.000001F0962A0000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://docs.python.org/3/library/pprint.html
                Source: NEVER OPEN!.exe, 00000001.00000002.1884370641.000001F0962A0000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://docs.python.org/3/library/pprint.html#pprint.pprint
                Source: NEVER OPEN!.exe, 00000001.00000003.1743000479.000001F0962F5000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://docs.python.org/3/library/re.html
                Source: NEVER OPEN!.exe, 00000001.00000003.1743000479.000001F096335000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000002.1881898101.000001F095B40000.00000004.00001000.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000003.1743000479.000001F0962F5000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://docs.python.org/3/library/re.html#re.sub
                Source: NEVER OPEN!.exe, 00000001.00000003.1875330985.000001F097460000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000003.1877208570.000001F097472000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000003.1874148217.000001F097453000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://docs.rs/regex/latest/regex/#syntax
                Source: NEVER OPEN!.exe, 00000000.00000003.1728329882.0000027663DF9000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://filepreviews.io/
                Source: NEVER OPEN!.exe, 00000001.00000003.1867285529.000001F096510000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000003.1866887734.000001F096510000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000003.1871513780.000001F096512000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000003.1871824181.000001F096535000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000002.1887451073.000001F096536000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://foss.heptapod.net/pypy/pypy/-/issues/3539#
                Source: NEVER OPEN!.exe, 00000001.00000002.1885338288.000001F096412000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://gist.github.com/XVilka/8346728
                Source: NEVER OPEN!.exe, 00000001.00000002.1883696004.000001F095E40000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://gist.github.com/lyssdod/f51579ae8d93c8657a5564aefc2ffbca
                Source: NEVER OPEN!.exe, 00000001.00000002.1893515704.000001F097C40000.00000004.00001000.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000002.1890206695.000001F096FF0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com
                Source: NEVER OPEN!.exe, 00000001.00000003.1874724322.000001F096584000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000003.1867285529.000001F096510000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000003.1866887734.000001F096510000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000003.1872449458.000001F096566000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000003.1876289881.000001F0965A2000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000003.1873753770.000001F09656C000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000003.1870753414.000001F09654A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/Ousret/charset_normalizer
                Source: NEVER OPEN!.exe, 00000001.00000002.1893884891.000001F097FD0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/Rapptz/discord.py
                Source: NEVER OPEN!.exe, 00000001.00000003.1737866877.000001F093927000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000003.1870519237.000001F093913000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000003.1737990293.000001F093916000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000002.1879447015.000001F093915000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000003.1738161329.000001F093927000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000003.1738161329.000001F093916000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/Unidata/MetPy/blob/a3424de66a44bf3a92b0dcacf4dff82ad7b86712/src/metpy/plots/wx_sy
                Source: NEVER OPEN!.exe, 00000001.00000002.1893515704.000001F097C40000.00000004.00001000.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000002.1890619309.000001F0972AF000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/aio-libs/aiohttp/discussions/6044
                Source: NEVER OPEN!.exe, 00000001.00000003.1874724322.000001F096584000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000003.1867285529.000001F096510000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000003.1866887734.000001F096510000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000002.1890619309.000001F0972FC000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000003.1876188142.000001F0965AC000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000003.1872449458.000001F096566000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000003.1873753770.000001F09656C000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000003.1870753414.000001F09654A000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000002.1888675099.000001F0965AD000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/freyacodes/Lavalink
                Source: NEVER OPEN!.exe, 00000001.00000002.1889881614.000001F096BA0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/giampaolo/psutil/issues/875.
                Source: NEVER OPEN!.exe, 00000001.00000002.1883696004.000001F095E40000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/jaraco/jaraco.functools/issues/5
                Source: NEVER OPEN!.exe, 00000000.00000003.1725542997.0000027663DF9000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000000.00000003.1719318901.0000027663E05000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000000.00000003.1723670795.0000027663DF9000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000000.00000003.1726594155.0000027663DF9000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000000.00000003.1724000360.0000027663DF9000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000000.00000003.1725938350.0000027663DF9000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000000.00000003.1719318901.0000027663DF8000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000000.00000003.1725185679.0000027663DF9000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000000.00000003.1725333388.0000027663DF9000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000000.00000003.1725938350.0000027663E06000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000002.1899711383.00007FFE001E6000.00000004.00000001.01000000.0000003B.sdmp, NEVER OPEN!.exe, 00000001.00000002.1907121579.00007FFE01475000.00000004.00000001.01000000.00000011.sdmp, NEVER OPEN!.exe, 00000001.00000002.1909564751.00007FFE0CFBA000.00000004.00000001.01000000.00000012.sdmpString found in binary or memory: https://github.com/mhammond/pywin32
                Source: NEVER OPEN!.exe, 00000000.00000003.1728423649.0000027663E07000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000000.00000003.1728329882.0000027663E07000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000000.00000003.1728329882.0000027663DF9000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/microsoft/pyright/)).
                Source: NEVER OPEN!.exe, 00000000.00000003.1733101901.0000027663DF9000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/naufraghi/tinyaes-py
                Source: NEVER OPEN!.exe, 00000001.00000003.1867399628.000001F0963D9000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000003.1867569214.000001F096409000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000003.1866887734.000001F0963D8000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000002.1885338288.000001F096412000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/pygments/pygments/archive/master.zip#egg=Pygments-dev
                Source: NEVER OPEN!.exe, 00000000.00000003.1733101901.0000027663DF9000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/pyinstaller/pyinstaller
                Source: NEVER OPEN!.exe, 00000000.00000003.1732075571.0000027663DF9000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/pyinstaller/pyinstaller.
                Source: NEVER OPEN!.exe, 00000001.00000002.1884428139.000001F0962C9000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/pyparsing/pyparsing/wiki
                Source: NEVER OPEN!.exe, 00000000.00000003.1728329882.0000027663DF9000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/python-attrs/attrs
                Source: NEVER OPEN!.exe, 00000000.00000003.1728329882.0000027663DF9000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/python-attrs/attrs)
                Source: NEVER OPEN!.exe, 00000000.00000003.1728329882.0000027663DF9000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/python-attrs/attrs/blob/main/.github/CONTRIBUTING.md)
                Source: NEVER OPEN!.exe, 00000000.00000003.1728329882.0000027663DF9000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/python-attrs/attrs/issues
                Source: NEVER OPEN!.exe, 00000000.00000003.1728423649.0000027663E07000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000000.00000003.1728329882.0000027663E07000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000000.00000003.1728329882.0000027663DF9000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/python-attrs/attrs/issues/1068)
                Source: NEVER OPEN!.exe, 00000000.00000003.1728423649.0000027663E07000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000000.00000003.1728329882.0000027663E07000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000000.00000003.1728329882.0000027663DF9000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/python-attrs/attrs/issues/1079)
                Source: NEVER OPEN!.exe, 00000000.00000003.1728423649.0000027663E07000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000000.00000003.1728329882.0000027663E07000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000000.00000003.1728329882.0000027663DF9000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/python-attrs/attrs/issues/1081)
                Source: NEVER OPEN!.exe, 00000000.00000003.1728423649.0000027663E07000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000000.00000003.1728329882.0000027663E07000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000000.00000003.1728329882.0000027663DF9000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/python-attrs/attrs/issues/1084)
                Source: NEVER OPEN!.exe, 00000000.00000003.1728423649.0000027663E07000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000000.00000003.1728329882.0000027663E07000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000000.00000003.1728329882.0000027663DF9000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/python-attrs/attrs/issues/1085)
                Source: NEVER OPEN!.exe, 00000000.00000003.1728423649.0000027663E07000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000000.00000003.1728329882.0000027663E07000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000000.00000003.1728329882.0000027663DF9000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/python-attrs/attrs/issues/1090)
                Source: NEVER OPEN!.exe, 00000000.00000003.1728423649.0000027663E07000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000000.00000003.1728329882.0000027663E07000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000000.00000003.1728329882.0000027663DF9000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/python-attrs/attrs/issues/1092)
                Source: NEVER OPEN!.exe, 00000000.00000003.1728423649.0000027663E07000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000000.00000003.1728329882.0000027663E07000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000000.00000003.1728329882.0000027663DF9000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/python-attrs/attrs/issues/1099)
                Source: NEVER OPEN!.exe, 00000000.00000003.1728423649.0000027663E07000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000000.00000003.1728329882.0000027663E07000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000000.00000003.1728329882.0000027663DF9000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/python-attrs/attrs/issues/1105)
                Source: NEVER OPEN!.exe, 00000000.00000003.1728423649.0000027663E07000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000000.00000003.1728329882.0000027663E07000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000000.00000003.1728329882.0000027663DF9000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/python-attrs/attrs/issues/1107)
                Source: NEVER OPEN!.exe, 00000000.00000003.1728423649.0000027663E07000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000000.00000003.1728329882.0000027663E07000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000000.00000003.1728329882.0000027663DF9000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/python-attrs/attrs/issues/1117)
                Source: NEVER OPEN!.exe, 00000000.00000003.1728423649.0000027663E07000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000000.00000003.1728329882.0000027663E07000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000000.00000003.1728329882.0000027663DF9000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/python-attrs/attrs/issues/1120)
                Source: NEVER OPEN!.exe, 00000000.00000003.1728423649.0000027663E07000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000000.00000003.1728329882.0000027663E07000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000000.00000003.1728329882.0000027663DF9000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/python-attrs/attrs/issues/1122)
                Source: NEVER OPEN!.exe, 00000001.00000003.1867399628.000001F0963D9000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000003.1867569214.000001F096409000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000003.1866887734.000001F0963D8000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000002.1885338288.000001F096412000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/python-attrs/attrs/issues/136
                Source: NEVER OPEN!.exe, 00000001.00000003.1867285529.000001F096510000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000003.1866887734.000001F096510000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000003.1747162433.000001F096510000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000003.1870753414.000001F09654A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/python-attrs/attrs/issues/251
                Source: NEVER OPEN!.exe, 00000001.00000003.1867399628.000001F0963D9000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000003.1867569214.000001F096409000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000003.1866887734.000001F0963D8000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000002.1885338288.000001F096412000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/python-attrs/attrs/issues/428
                Source: NEVER OPEN!.exe, 00000000.00000003.1728423649.0000027663E07000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000000.00000003.1728329882.0000027663E07000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000000.00000003.1728329882.0000027663DF9000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/python-attrs/attrs/issues/993)
                Source: NEVER OPEN!.exe, 00000000.00000003.1728329882.0000027663DF9000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/python-attrs/attrs/wiki/Extensions-to-attrs)
                Source: NEVER OPEN!.exe, 00000001.00000002.1893884891.000001F097FD0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/python-pillow/Pillow/
                Source: NEVER OPEN!.exe, 00000001.00000003.1737990293.000001F093916000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000002.1879835755.000001F095130000.00000004.00001000.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000003.1738161329.000001F093916000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/python/cpython/blob/3.9/Lib/importlib/_bootstrap_external.py#L679-L688
                Source: NEVER OPEN!.exe, 00000001.00000003.1738161329.000001F093916000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/python/cpython/blob/839d7893943782ee803536a47f1d4de160314f85/Lib/importlib/abc.py
                Source: NEVER OPEN!.exe, 00000001.00000003.1737866877.000001F093927000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000003.1870519237.000001F093913000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000002.1879447015.000001F093915000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000003.1738161329.000001F093927000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/python/cpython/blob/839d7893943782ee803536a47f1d4de160314f85/Lib/importlib/reader
                Source: NEVER OPEN!.exe, 00000001.00000002.1893515704.000001F097C40000.00000004.00001000.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000002.1890619309.000001F0972AF000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/python/cpython/pull/28073
                Source: NEVER OPEN!.exe, 00000000.00000003.1727627941.0000027663DF9000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/ronaldoussoren/altgraph
                Source: NEVER OPEN!.exe, 00000000.00000003.1727627941.0000027663DF9000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/ronaldoussoren/altgraph/
                Source: NEVER OPEN!.exe, 00000000.00000003.1727627941.0000027663DF9000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/ronaldoussoren/altgraph/issues
                Source: NEVER OPEN!.exe, 00000000.00000003.1728329882.0000027663DF9000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/sponsors/hynek
                Source: NEVER OPEN!.exe, 00000000.00000003.1728329882.0000027663DF9000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/sponsors/hynek).
                Source: NEVER OPEN!.exe, 00000001.00000003.1737866877.000001F093927000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000003.1870519237.000001F093913000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000002.1879447015.000001F093915000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000003.1738161329.000001F093927000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/tensorflow/datasets/blob/master/tensorflow_datasets/core/utils/resource_utils.py#
                Source: NEVER OPEN!.exe, 00000001.00000003.1867285529.000001F096510000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000003.1866887734.000001F096510000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000003.1871513780.000001F096512000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000003.1871824181.000001F096535000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000002.1887451073.000001F096536000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/urllib3/urllib3/issues/2192#issuecomment-821832963
                Source: NEVER OPEN!.exe, 00000001.00000003.1867285529.000001F096510000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000003.1866887734.000001F096510000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000003.1871513780.000001F096512000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000003.1871824181.000001F096535000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000002.1887451073.000001F096536000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/urllib3/urllib3/issues/2513#issuecomment-1152559900.
                Source: NEVER OPEN!.exe, 00000000.00000003.1732075571.0000027663DF9000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://gnu.org/licenses/gpl-2.0.html
                Source: NEVER OPEN!.exe, 00000001.00000003.1870753414.000001F09654A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://google.com/
                Source: NEVER OPEN!.exe, 00000001.00000003.1867399628.000001F0963D9000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000003.1874724322.000001F096584000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000003.1867569214.000001F096409000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000003.1867285529.000001F096510000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000003.1866887734.000001F0963D8000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000003.1866887734.000001F096510000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000003.1872449458.000001F096566000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000002.1888533425.000001F096587000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000002.1885338288.000001F096412000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000003.1873753770.000001F09656C000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000003.1870753414.000001F09654A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://google.com/mail
                Source: NEVER OPEN!.exe, 00000001.00000002.1885338288.000001F096412000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://google.com/mail/
                Source: NEVER OPEN!.exe, 00000000.00000003.1728423649.0000027663E07000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000000.00000003.1728329882.0000027663E07000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000000.00000003.1728329882.0000027663DF9000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://hatch.pypa.io/latest/).
                Source: NEVER OPEN!.exe, 00000001.00000003.1867285529.000001F096510000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000003.1866887734.000001F096510000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000003.1871513780.000001F096512000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000003.1871824181.000001F096535000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000002.1887451073.000001F096536000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://html.spec.whatwg.org/multipage/
                Source: NEVER OPEN!.exe, 00000001.00000003.1870753414.000001F09654A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://httpbin.org/
                Source: NEVER OPEN!.exe, 00000001.00000002.1890308306.000001F0970F0000.00000004.00001000.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000003.1868129600.000001F095E34000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000003.1876289881.000001F0965A2000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000003.1873753770.000001F09656C000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000002.1883569338.000001F095E36000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000003.1870753414.000001F09654A000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000003.1871347871.000001F096692000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000002.1889286989.000001F096695000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000002.1888959073.000001F096608000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://httpbin.org/get
                Source: NEVER OPEN!.exe, 00000001.00000003.1868292392.000001F095C9E000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000002.1882409318.000001F095CD1000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000003.1876359841.000001F095CD1000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000003.1869721795.000001F095CBB000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://httpbin.org/post
                Source: NEVER OPEN!.exe, 00000000.00000003.1728329882.0000027663DF9000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://hynek.me/articles/import-attrs/)
                Source: NEVER OPEN!.exe, 00000001.00000002.1894453507.000001F098584000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://i.imgu
                Source: NEVER OPEN!.exe, 00000001.00000003.1795042561.000001F0974DC000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://i.imgur.com/HjzfjfR.png
                Source: NEVER OPEN!.exe, 00000001.00000002.1893884891.000001F097FD0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://i.scdn.co/image/
                Source: NEVER OPEN!.exe, 00000001.00000002.1894340923.000001F0983D0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://ipapi.co/ip/
                Source: NEVER OPEN!.exe, 00000001.00000003.1870753414.000001F09654A000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000003.1871824181.000001F096535000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000002.1887451073.000001F096536000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://json.org
                Source: NEVER OPEN!.exe, 00000001.00000002.1892734894.000001F097770000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000002.1894453507.000001F0985C0000.00000004.00001000.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000003.1792420967.000001F097770000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000002.1894904086.000001F0996C0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://login.live.com
                Source: NEVER OPEN!.exe, 00000001.00000002.1892734894.000001F097770000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000002.1894453507.000001F0985C0000.00000004.00001000.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000003.1795006849.000001F097608000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000003.1794679097.000001F0975C8000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000002.1894904086.000001F099640000.00000004.00001000.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000002.1894904086.000001F0996E8000.00000004.00001000.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000003.1792420967.000001F097770000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.microsoftonline.com
                Source: NEVER OPEN!.exe, 00000001.00000003.1874724322.000001F096584000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000003.1867285529.000001F096510000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000003.1866887734.000001F096510000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000003.1876188142.000001F0965AC000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000003.1872449458.000001F096566000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000003.1873753770.000001F09656C000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000003.1870753414.000001F09654A000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000002.1888675099.000001F0965AD000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://mahler:8092/site-updates.py
                Source: NEVER OPEN!.exe, 00000001.00000002.1893884891.000001F097FD0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://media.discordapp.net/
                Source: NEVER OPEN!.exe, 00000001.00000003.1867399628.000001F0963D9000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000003.1867569214.000001F096409000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000003.1866887734.000001F0963D8000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000002.1885338288.000001F096412000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-108r1.pdf
                Source: NEVER OPEN!.exe, 00000001.00000002.1893884891.000001F097FD0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://open.spotify.com/track/
                Source: NEVER OPEN!.exe, 00000001.00000003.1747162433.000001F0964D1000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000002.1889788062.000001F096AA0000.00000004.00001000.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000002.1889596330.000001F0968A0000.00000004.00001000.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000003.1747162433.000001F096510000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000003.1747339602.000001F0964BB000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://packaging.python.org/specifications/entry-points/
                Source: NEVER OPEN!.exe, 00000000.00000003.1728423649.0000027663E07000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000000.00000003.1728329882.0000027663E07000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000000.00000003.1728329882.0000027663DF9000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://peps.python.org/pep-0681/)
                Source: NEVER OPEN!.exe, 00000001.00000003.1875330985.000001F097460000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000003.1877208570.000001F097472000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000002.1890861032.000001F097400000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000003.1874148217.000001F097453000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://projectfluent.org
                Source: NEVER OPEN!.exe, 00000001.00000003.1867285529.000001F096510000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000003.1866887734.000001F096510000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000003.1872449458.000001F096566000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000003.1876003232.000001F096543000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000003.1871513780.000001F096512000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000003.1870753414.000001F09654A000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000003.1871824181.000001F096535000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://pygments.org/docs/lexers/)
                Source: NEVER OPEN!.exe, 00000001.00000003.1870753414.000001F09654A000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000003.1871824181.000001F096535000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://pygments.org/docs/styles/#getting-a-list-of-available-styles).
                Source: NEVER OPEN!.exe, 00000000.00000003.1733101901.0000027663DF9000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://pyinstaller.readthedocs.io/
                Source: NEVER OPEN!.exe, 00000000.00000003.1733101901.0000027663DF9000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://pyinstaller.readthedocs.io/en/v5.0.1/
                Source: NEVER OPEN!.exe, 00000000.00000003.1733101901.0000027663DF9000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://pyinstaller.readthedocs.io/en/v5.0.1/CHANGES.html
                Source: NEVER OPEN!.exe, 00000000.00000003.1728329882.0000027663DF9000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://pypi.org/project/attrs/)
                Source: NEVER OPEN!.exe, 00000001.00000002.1898577877.00007FFDFB784000.00000040.00000001.01000000.00000004.sdmpString found in binary or memory: https://python.org/dev/peps/pep-0263/
                Source: NEVER OPEN!.exe, 00000001.00000002.1894453507.000001F09858C000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://raw.githubusercontent.com/addi00000/empyrean-injection/main/obfuscated.js
                Source: NEVER OPEN!.exe, 00000001.00000002.1894453507.000001F09858C000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://raw.githubusercontent.com/addi00000/empyrean-injection/main/obfuscated.js0
                Source: NEVER OPEN!.exe, 00000000.00000003.1728329882.0000027663DF9000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://raw.githubusercontent.com/python-attrs/attrs/main/.github/sponsors/FilePreviews.svg
                Source: NEVER OPEN!.exe, 00000000.00000003.1728329882.0000027663DF9000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://raw.githubusercontent.com/python-attrs/attrs/main/.github/sponsors/Sentry.svg
                Source: NEVER OPEN!.exe, 00000000.00000003.1728329882.0000027663DF9000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://raw.githubusercontent.com/python-attrs/attrs/main/.github/sponsors/Tidelift.svg
                Source: NEVER OPEN!.exe, 00000000.00000003.1728329882.0000027663DF9000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://raw.githubusercontent.com/python-attrs/attrs/main/.github/sponsors/Variomedia.svg
                Source: NEVER OPEN!.exe, 00000000.00000003.1728329882.0000027663DF9000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://raw.githubusercontent.com/python-attrs/attrs/main/docs/_static/attrs_logo.svg
                Source: NEVER OPEN!.exe, 00000001.00000002.1883696004.000001F095E40000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://refspecs.linuxfoundation.org/elf/gabi4
                Source: NEVER OPEN!.exe, 00000001.00000003.1868292392.000001F095C9E000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000003.1869721795.000001F095CBB000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000002.1890308306.000001F0970F0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://requests.readthedocs.io
                Source: NEVER OPEN!.exe, 00000000.00000003.1728329882.0000027663DF9000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://sentry.io/
                Source: NEVER OPEN!.exe, 00000001.00000003.1740139596.000001F095CC7000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000003.1740139596.000001F095C77000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000003.1740708415.000001F09590C000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000003.1739985681.000001F095CC7000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000003.1870689292.000001F095922000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000003.1867207825.000001F09591C000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000003.1741731970.000001F0958E9000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000002.1881418163.000001F095923000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000003.1742208369.000001F09590B000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://setuptools.pypa.io/en/latest/pkg_resources.html#basic-resource-access
                Source: NEVER OPEN!.exe, 00000001.00000003.1871162140.000001F0962C8000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000003.1743000479.000001F096335000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000002.1884370641.000001F0962A0000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000002.1884428139.000001F0962C9000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000003.1743000479.000001F0962F5000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://stackoverflow.com/questions/267399/how-do-you-match-only-valid-roman-numerals-with-a-regular
                Source: NEVER OPEN!.exe, 00000001.00000002.1889881614.000001F096BA0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://stackoverflow.com/questions/4457745#4457745
                Source: NEVER OPEN!.exe, 00000000.00000003.1728329882.0000027663DF9000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://stackoverflow.com/questions/tagged/python-attrs)
                Source: NEVER OPEN!.exe, 00000001.00000003.1787469521.000001F098677000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000003.1787469521.000001F098690000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000003.1787469521.000001F0986AE000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://support.mozilla.org
                Source: NEVER OPEN!.exe, 00000001.00000003.1785503716.000001F09772A000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000003.1787469521.000001F0986BD000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000003.1776290730.000001F09763E000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000003.1780149602.000001F09763E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
                Source: NEVER OPEN!.exe, 00000001.00000003.1795042561.000001F0974DC000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000002.1891496753.000001F09751A000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000003.1863985982.000001F0974DC000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://support.mozilla.org/products/firefox
                Source: NEVER OPEN!.exe, 00000001.00000003.1785503716.000001F09772A000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000003.1787469521.000001F0986BD000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://support.mozilla.org/products/firefoxgro.allizom.troppus.zvXrErQ5GYDF
                Source: NEVER OPEN!.exe, 00000001.00000003.1787469521.000001F098677000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://support.mozilla.orgo9
                Source: NEVER OPEN!.exe, 00000001.00000003.1795042561.000001F0974DC000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000002.1894340923.000001F0983D0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016
                Source: NEVER OPEN!.exe, 00000001.00000003.1795042561.000001F0974DC000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000002.1894340923.000001F0983D0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17
                Source: NEVER OPEN!.exe, 00000001.00000002.1894340923.000001F0983D0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17P
                Source: NEVER OPEN!.exe, 00000000.00000003.1728329882.0000027663DF9000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://tidelift.com/subscripti
                Source: NEVER OPEN!.exe, 00000000.00000003.1728329882.0000027663DF9000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://tidelift.com/subscription/pkg/pypi-attrs?utm_source=pypi-attrs&utm_medium=pypi
                Source: NEVER OPEN!.exe, 00000000.00000003.1728329882.0000027663DF9000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://tidelift.com/subscription/pkg/pypi-attrs?utm_source=pypi-attrs&utm_medium=referral&utm_campa
                Source: NEVER OPEN!.exe, 00000001.00000003.1871162140.000001F0962C8000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000002.1884428139.000001F0962C9000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://tools.ietf.org/html/rfc2388#section-4.4
                Source: NEVER OPEN!.exe, 00000001.00000003.1867399628.000001F0963D9000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000003.1867569214.000001F096409000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000003.1866887734.000001F0963D8000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000002.1885338288.000001F096412000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000003.1877031715.000001F09662C000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000002.1889135569.000001F09662C000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://tools.ietf.org/html/rfc3610
                Source: NEVER OPEN!.exe, 00000001.00000003.1867399628.000001F0963D9000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000003.1867569214.000001F096409000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000003.1866887734.000001F0963D8000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000002.1889208036.000001F096645000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000002.1885338288.000001F096412000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000003.1865767129.000001F096645000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://tools.ietf.org/html/rfc5297
                Source: NEVER OPEN!.exe, 00000001.00000003.1874724322.000001F096584000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000003.1867285529.000001F096510000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000003.1866887734.000001F096510000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000003.1872449458.000001F096566000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000002.1894453507.000001F0985A4000.00000004.00001000.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000003.1876289881.000001F0965A2000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000002.1894904086.000001F099628000.00000004.00001000.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000003.1873753770.000001F09656C000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000003.1875150816.000001F095857000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000003.1870753414.000001F09654A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://twitter.com/
                Source: NEVER OPEN!.exe, 00000001.00000002.1889881614.000001F096BA0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://urllib3.readthedocs.io/en/latest/advanced-usage.html#tls-warnings
                Source: NEVER OPEN!.exe, 00000001.00000002.1894453507.000001F0985C0000.00000004.00001000.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000002.1894904086.000001F099640000.00000004.00001000.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000002.1894453507.000001F0985A4000.00000004.00001000.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000002.1894904086.000001F09967C000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://weibo.com/
                Source: NEVER OPEN!.exe, 00000001.00000002.1880785392.000001F095840000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://wiki.debian.org/XDGBaseDirectorySpecification#state
                Source: NEVER OPEN!.exe, 00000001.00000002.1894904086.000001F099640000.00000004.00001000.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000002.1894453507.000001F0985A4000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://www.aliexpress.com/
                Source: NEVER OPEN!.exe, 00000001.00000002.1894904086.000001F099640000.00000004.00001000.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000002.1894453507.000001F09858C000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://www.amazon.ca/
                Source: NEVER OPEN!.exe, 00000001.00000002.1894904086.000001F099640000.00000004.00001000.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000002.1894453507.000001F09858C000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://www.amazon.co.uk/
                Source: NEVER OPEN!.exe, 00000001.00000002.1894904086.000001F099640000.00000004.00001000.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000002.1894453507.000001F09858C000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://www.amazon.com/
                Source: NEVER OPEN!.exe, 00000001.00000002.1894453507.000001F0985C0000.00000004.00001000.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000002.1894904086.000001F099640000.00000004.00001000.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000002.1894453507.000001F09858C000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://www.amazon.de/
                Source: NEVER OPEN!.exe, 00000001.00000002.1894904086.000001F099640000.00000004.00001000.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000002.1894453507.000001F09858C000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://www.amazon.fr/
                Source: NEVER OPEN!.exe, 00000000.00000003.1728329882.0000027663DF9000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.attrs.org/
                Source: NEVER OPEN!.exe, 00000000.00000003.1728329882.0000027663DF9000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.attrs.org/)
                Source: NEVER OPEN!.exe, 00000000.00000003.1728329882.0000027663DF9000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.attrs.org/en/latest/glossary.html#term-dunder-methods)).
                Source: NEVER OPEN!.exe, 00000000.00000003.1728329882.0000027663DF9000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.attrs.org/en/latest/license.html)
                Source: NEVER OPEN!.exe, 00000000.00000003.1728329882.0000027663DF9000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.attrs.org/en/latest/names.html)
                Source: NEVER OPEN!.exe, 00000000.00000003.1728329882.0000027663DF9000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.attrs.org/en/stable/changelog.html
                Source: NEVER OPEN!.exe, 00000000.00000003.1728329882.0000027663DF9000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.attrs.org/en/stable/changelog.html)
                Source: NEVER OPEN!.exe, 00000000.00000003.1728329882.0000027663DF9000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.attrs.org/en/stable/comparison.html#customization)
                Source: NEVER OPEN!.exe, 00000000.00000003.1728329882.0000027663DF9000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.attrs.org/en/stable/init.html#hooking-yourself-into-initialization).
                Source: NEVER OPEN!.exe, 00000000.00000003.1728329882.0000027663DF9000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.attrs.org/en/stable/why.html#data-classes).
                Source: NEVER OPEN!.exe, 00000001.00000002.1894453507.000001F0985C0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://www.avito.ru/
                Source: NEVER OPEN!.exe, 00000001.00000002.1894453507.000001F0985A4000.00000004.00001000.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000002.1894904086.000001F099628000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://www.baidu.com/
                Source: NEVER OPEN!.exe, 00000001.00000002.1894904086.000001F099640000.00000004.00001000.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000002.1894453507.000001F0985A4000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://www.bbc.co.uk/
                Source: NEVER OPEN!.exe, 00000001.00000002.1894340923.000001F0983D0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://www.cloudflare.com/cdn-cgi/trace
                Source: NEVER OPEN!.exe, 00000001.00000002.1894340923.000001F0983D0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://www.cloudflare.com/cdn-cgi/tracep8B
                Source: NEVER OPEN!.exe, 00000001.00000002.1894453507.000001F0985A4000.00000004.00001000.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000002.1894904086.000001F099628000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://www.ctrip.com/
                Source: NEVER OPEN!.exe, 00000000.00000003.1720631750.0000027663DF9000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000000.00000003.1720631750.0000027663E06000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.digicert.com/CPS0
                Source: NEVER OPEN!.exe, 00000001.00000002.1894453507.000001F0985A4000.00000004.00001000.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000002.1894904086.000001F099628000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://www.ebay.co.uk/
                Source: NEVER OPEN!.exe, 00000001.00000002.1894904086.000001F099640000.00000004.00001000.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000002.1894453507.000001F0985A4000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://www.ebay.de/
                Source: NEVER OPEN!.exe, 00000001.00000002.1894453507.000001F0985C0000.00000004.00001000.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000002.1894453507.000001F0985A4000.00000004.00001000.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000002.1894904086.000001F09967C000.00000004.00001000.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000002.1894904086.000001F099628000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://www.google.com/
                Source: NEVER OPEN!.exe, 00000001.00000002.1894453507.000001F0985A4000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://www.google.com/complete/
                Source: NEVER OPEN!.exe, 00000001.00000003.1867399628.000001F0963D9000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000003.1867569214.000001F096409000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000003.1866887734.000001F0963D8000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000002.1885338288.000001F096412000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.ietf.org/rfc/rfc2898.txt
                Source: NEVER OPEN!.exe, 00000001.00000002.1894904086.000001F099640000.00000004.00001000.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000002.1894453507.000001F0985A4000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://www.ifeng.com/
                Source: NEVER OPEN!.exe, 00000001.00000002.1894904086.000001F099640000.00000004.00001000.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000002.1894453507.000001F0985A4000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://www.iqiyi.com/
                Source: NEVER OPEN!.exe, 00000001.00000002.1894904086.000001F099640000.00000004.00001000.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000002.1894453507.000001F0985A4000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://www.leboncoin.fr/
                Source: NEVER OPEN!.exe, 00000001.00000002.1894453507.000001F0985C0000.00000004.00001000.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000003.1787469521.000001F098677000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000003.1787469521.000001F098690000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000002.1894904086.000001F09967C000.00000004.00001000.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000003.1787469521.000001F0986AE000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.mozilla.org
                Source: NEVER OPEN!.exe, 00000001.00000003.1785503716.000001F09772A000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000003.1787469521.000001F0986BD000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.mozilla.org/about/gro.allizom.www.VsJpOAWrHqB2
                Source: NEVER OPEN!.exe, 00000001.00000003.1776290730.000001F09763E000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000003.1780149602.000001F09763E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.mozilla.org/contribute/
                Source: NEVER OPEN!.exe, 00000001.00000003.1785503716.000001F09772A000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000003.1787469521.000001F0986BD000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.mozilla.org/contribute/gro.allizom.www.n0g9CLHwD9nR
                Source: NEVER OPEN!.exe, 00000001.00000003.1785503716.000001F09772A000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000003.1787469521.000001F0986BD000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000003.1780302825.000001F09761D000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/Firefox
                Source: NEVER OPEN!.exe, 00000001.00000003.1785503716.000001F09772A000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000003.1787469521.000001F0986BD000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.mozilla.org/firefox/?utm_medium=firefox-desktop&utm_source=bookmarks-toolbar&utm_campaig
                Source: NEVER OPEN!.exe, 00000001.00000003.1785503716.000001F09772A000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000003.1787469521.000001F0986BD000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.mozilla.org/privacy/firefox/gro.allizom.www.
                Source: NEVER OPEN!.exe, 00000001.00000002.1892734894.000001F097770000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000002.1894453507.000001F0985C0000.00000004.00001000.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000002.1894904086.000001F0996D4000.00000004.00001000.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000003.1792420967.000001F097770000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.msn.com
                Source: NEVER OPEN!.exe, 00000001.00000002.1894453507.000001F0985C0000.00000004.00001000.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000002.1894904086.000001F099640000.00000004.00001000.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000002.1894453507.000001F0985A4000.00000004.00001000.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000002.1894904086.000001F09967C000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://www.olx.pl/
                Source: NEVER OPEN!.exe, 00000000.00000003.1720724832.0000027663DF9000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000002.1898503424.00007FFDFB414000.00000004.00000001.01000000.00000018.sdmp, NEVER OPEN!.exe, 00000001.00000002.1904170665.00007FFE00823000.00000004.00000001.01000000.00000017.sdmpString found in binary or memory: https://www.openssl.org/H
                Source: NEVER OPEN!.exe, 00000001.00000002.1889692319.000001F0969A0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://www.oreilly.com/library/view/regular-expressions-cookbook/9781449327453/ch04s07.html
                Source: NEVER OPEN!.exe, 00000000.00000003.1733101901.0000027663DF9000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.pyinstaller.org/
                Source: NEVER OPEN!.exe, 00000001.00000003.1868292392.000001F095C9E000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000002.1882409318.000001F095CD1000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000003.1876359841.000001F095CD1000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000003.1869721795.000001F095CBB000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.python.org
                Source: NEVER OPEN!.exe, 00000001.00000003.1874724322.000001F096584000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000003.1867285529.000001F096510000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000003.1866887734.000001F096510000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000003.1876188142.000001F0965AC000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000003.1872449458.000001F096566000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000003.1873753770.000001F09656C000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000003.1870753414.000001F09654A000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000002.1888675099.000001F0965AD000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.python.org/
                Source: NEVER OPEN!.exe, 00000000.00000003.1730086551.0000027663DF9000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000002.1883696004.000001F095E40000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://www.python.org/dev/peps/pep-0205/
                Source: NEVER OPEN!.exe, 00000001.00000002.1879835755.000001F095130000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://www.python.org/download/releases/2.3/mro/.
                Source: NEVER OPEN!.exe, 00000001.00000002.1894904086.000001F099640000.00000004.00001000.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000002.1894453507.000001F0985A4000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://www.reddit.com/
                Source: NEVER OPEN!.exe, 00000001.00000003.1867399628.000001F0963D9000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000003.1867569214.000001F096409000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000003.1866887734.000001F0963D8000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000002.1885338288.000001F096412000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.textualize.io
                Source: NEVER OPEN!.exe, 00000000.00000003.1728329882.0000027663DF9000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.variomedia.de/
                Source: NEVER OPEN!.exe, 00000001.00000002.1894453507.000001F0985C0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://www.wykop.pl/
                Source: NEVER OPEN!.exe, 00000001.00000002.1894453507.000001F0985A4000.00000004.00001000.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000002.1894904086.000001F099628000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://www.youtube.com/
                Source: NEVER OPEN!.exe, 00000001.00000002.1894453507.000001F0985C0000.00000004.00001000.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000002.1894904086.000001F09967C000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://www.zhihu.com/
                Source: NEVER OPEN!.exe, 00000001.00000003.1873000781.000001F09766C000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000003.1864747713.000001F097602000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000003.1865464973.000001F097663000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000003.1788868906.000001F0976A2000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000003.1780149602.000001F0976A2000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000003.1793423772.000001F0976A2000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000003.1863122925.000001F0975EE000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000002.1892292252.000001F09766C000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://wwww.certigna.fr/autorites/
                Source: NEVER OPEN!.exe, 00000001.00000003.1869260303.000001F096684000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000003.1863855088.000001F096684000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000003.1788868906.000001F0976A2000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000003.1780149602.000001F0976A2000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000003.1793423772.000001F0976A2000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000003.1865696051.000001F095D0D000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000002.1889252951.000001F09668A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://wwww.certigna.fr/autorites/0m
                Source: NEVER OPEN!.exe, 00000001.00000003.1867399628.000001F0963D9000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000003.1874724322.000001F096584000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000003.1867569214.000001F096409000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000003.1867285529.000001F096510000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000003.1866887734.000001F0963D8000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000003.1866887734.000001F096510000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000003.1872449458.000001F096566000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000002.1888533425.000001F096587000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000002.1885338288.000001F096412000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000003.1873753770.000001F09656C000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000003.1870753414.000001F09654A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://yahoo.com/
                Source: NEVER OPEN!.exe, 00000001.00000002.1883414803.000001F095E2A000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000003.1746818736.000001F095E27000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000003.1869759132.000001F095E27000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000003.1748289517.000001F095E27000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://zopeinterface.readthedocs.io/en/latest/
                Source: unknownNetwork traffic detected: HTTP traffic on port 49733 -> 443
                Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49744
                Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49743
                Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49742
                Source: unknownNetwork traffic detected: HTTP traffic on port 49731 -> 443
                Source: unknownNetwork traffic detected: HTTP traffic on port 57195 -> 443
                Source: unknownNetwork traffic detected: HTTP traffic on port 49748 -> 443
                Source: unknownNetwork traffic detected: HTTP traffic on port 49743 -> 443
                Source: unknownNetwork traffic detected: HTTP traffic on port 49746 -> 443
                Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 57195
                Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49735
                Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49733
                Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49732
                Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49731
                Source: unknownNetwork traffic detected: HTTP traffic on port 49732 -> 443
                Source: unknownNetwork traffic detected: HTTP traffic on port 49742 -> 443
                Source: unknownNetwork traffic detected: HTTP traffic on port 49749 -> 443
                Source: unknownNetwork traffic detected: HTTP traffic on port 49747 -> 443
                Source: unknownNetwork traffic detected: HTTP traffic on port 49744 -> 443
                Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49749
                Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49748
                Source: unknownNetwork traffic detected: HTTP traffic on port 49735 -> 443
                Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49747
                Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49746

                Spam, unwanted Advertisements and Ransom Demands

                barindex
                Writes many files with high entropy
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI70002\Crypto\PublicKey\_ec_ws.pyd entropy: 7.99846974006Jump to dropped file
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI70002\PIL\_imaging.cp310-win_amd64.pyd entropy: 7.99826858376Jump to dropped file
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI70002\PIL\_imagingft.cp310-win_amd64.pyd entropy: 7.9983793163Jump to dropped file
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI70002\python310.dll entropy: 7.9920074107Jump to dropped file
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI70002\sqlite3.dll entropy: 7.99354820268Jump to dropped file
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeFile created: C:\Users\user\AppData\Roaming\empyrean\dat.txt entropy: 7.99798119644Jump to dropped file
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtFile created: C:\Users\user\AppData\Local\Temp\_MEI45442\Crypto\PublicKey\_ec_ws.pyd entropy: 7.99846974006Jump to dropped file
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtFile created: C:\Users\user\AppData\Local\Temp\_MEI45442\PIL\_imaging.cp310-win_amd64.pyd entropy: 7.99826858376Jump to dropped file
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtFile created: C:\Users\user\AppData\Local\Temp\_MEI45442\PIL\_imagingft.cp310-win_amd64.pyd entropy: 7.9983793163Jump to dropped file
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtFile created: C:\Users\user\AppData\Local\Temp\_MEI45442\python310.dll entropy: 7.9920074107Jump to dropped file
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtFile created: C:\Users\user\AppData\Local\Temp\_MEI45442\sqlite3.dll entropy: 7.99354820268Jump to dropped file
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtFile created: C:\Users\user\AppData\Local\Temp\_MEI2802\Crypto\PublicKey\_ec_ws.pyd entropy: 7.99846974006Jump to dropped file
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtFile created: C:\Users\user\AppData\Local\Temp\_MEI2802\PIL\_imaging.cp310-win_amd64.pyd entropy: 7.99826858376Jump to dropped file
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtFile created: C:\Users\user\AppData\Local\Temp\_MEI2802\PIL\_imagingft.cp310-win_amd64.pyd entropy: 7.9983793163Jump to dropped file
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtFile created: C:\Users\user\AppData\Local\Temp\_MEI2802\python310.dll entropy: 7.9920074107Jump to dropped file
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtFile created: C:\Users\user\AppData\Local\Temp\_MEI2802\sqlite3.dll entropy: 7.99354820268Jump to dropped file
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeCode function: 0_2_00007FF619BDB28C0_2_00007FF619BDB28C
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeCode function: 0_2_00007FF619BD64A40_2_00007FF619BD64A4
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeCode function: 0_2_00007FF619BE4D480_2_00007FF619BE4D48
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeCode function: 0_2_00007FF619BC67400_2_00007FF619BC6740
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeCode function: 0_2_00007FF619BD72FC0_2_00007FF619BD72FC
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeCode function: 0_2_00007FF619BDDAB80_2_00007FF619BDDAB8
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeCode function: 0_2_00007FF619BD62F00_2_00007FF619BD62F0
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeCode function: 0_2_00007FF619BE8A880_2_00007FF619BE8A88
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeCode function: 0_2_00007FF619BD0A4C0_2_00007FF619BD0A4C
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeCode function: 0_2_00007FF619BD29E40_2_00007FF619BD29E4
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeCode function: 0_2_00007FF619BD11F40_2_00007FF619BD11F4
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeCode function: 0_2_00007FF619BE314C0_2_00007FF619BE314C
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeCode function: 0_2_00007FF619BD4D000_2_00007FF619BD4D00
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeCode function: 0_2_00007FF619BE2CC00_2_00007FF619BE2CC0
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeCode function: 0_2_00007FF619BE0CE40_2_00007FF619BE0CE4
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeCode function: 0_2_00007FF619BD1CA00_2_00007FF619BD1CA0
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeCode function: 0_2_00007FF619BC9CB00_2_00007FF619BC9CB0
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeCode function: 0_2_00007FF619BD0C380_2_00007FF619BD0C38
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeCode function: 0_2_00007FF619BDD4380_2_00007FF619BDD438
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeCode function: 0_2_00007FF619BC1B900_2_00007FF619BC1B90
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeCode function: 0_2_00007FF619BD8F000_2_00007FF619BD8F00
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeCode function: 0_2_00007FF619BD0E200_2_00007FF619BD0E20
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeCode function: 0_2_00007FF619BD26180_2_00007FF619BD2618
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeCode function: 0_2_00007FF619BD64A40_2_00007FF619BD64A4
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeCode function: 0_2_00007FF619BDFD480_2_00007FF619BDFD48
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeCode function: 0_2_00007FF619BDFD480_2_00007FF619BDFD48
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeCode function: 0_2_00007FF619BD08640_2_00007FF619BD0864
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeCode function: 0_2_00007FF619BD100C0_2_00007FF619BD100C
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeCode function: 0_2_00007FF619BE4FC40_2_00007FF619BE4FC4
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeCode function: 0_2_00007FF619BDCF880_2_00007FF619BDCF88
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeCode function: 0_2_00007FF619BE57400_2_00007FF619BE5740
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeCode function: 1_2_00007FF619BDB28C1_2_00007FF619BDB28C
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeCode function: 1_2_00007FF619BD72FC1_2_00007FF619BD72FC
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeCode function: 1_2_00007FF619BDDAB81_2_00007FF619BDDAB8
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeCode function: 1_2_00007FF619BD62F01_2_00007FF619BD62F0
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeCode function: 1_2_00007FF619BE8A881_2_00007FF619BE8A88
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeCode function: 1_2_00007FF619BD0A4C1_2_00007FF619BD0A4C
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeCode function: 1_2_00007FF619BD29E41_2_00007FF619BD29E4
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeCode function: 1_2_00007FF619BD11F41_2_00007FF619BD11F4
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeCode function: 1_2_00007FF619BE314C1_2_00007FF619BE314C
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeCode function: 1_2_00007FF619BD4D001_2_00007FF619BD4D00
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeCode function: 1_2_00007FF619BE2CC01_2_00007FF619BE2CC0
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeCode function: 1_2_00007FF619BE0CE41_2_00007FF619BE0CE4
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeCode function: 1_2_00007FF619BD64A41_2_00007FF619BD64A4
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeCode function: 1_2_00007FF619BD1CA01_2_00007FF619BD1CA0
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeCode function: 1_2_00007FF619BC9CB01_2_00007FF619BC9CB0
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeCode function: 1_2_00007FF619BD0C381_2_00007FF619BD0C38
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeCode function: 1_2_00007FF619BDD4381_2_00007FF619BDD438
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeCode function: 1_2_00007FF619BC1B901_2_00007FF619BC1B90
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeCode function: 1_2_00007FF619BD8F001_2_00007FF619BD8F00
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeCode function: 1_2_00007FF619BD0E201_2_00007FF619BD0E20
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeCode function: 1_2_00007FF619BD26181_2_00007FF619BD2618
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeCode function: 1_2_00007FF619BD64A41_2_00007FF619BD64A4
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeCode function: 1_2_00007FF619BDFD481_2_00007FF619BDFD48
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeCode function: 1_2_00007FF619BE4D481_2_00007FF619BE4D48
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeCode function: 1_2_00007FF619BDFD481_2_00007FF619BDFD48
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeCode function: 1_2_00007FF619BD08641_2_00007FF619BD0864
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeCode function: 1_2_00007FF619BD100C1_2_00007FF619BD100C
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeCode function: 1_2_00007FF619BE4FC41_2_00007FF619BE4FC4
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeCode function: 1_2_00007FF619BDCF881_2_00007FF619BDCF88
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeCode function: 1_2_00007FF619BC67401_2_00007FF619BC6740
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeCode function: 1_2_00007FF619BE57401_2_00007FF619BE5740
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeCode function: 1_2_00007FFDFAE0F9201_2_00007FFDFAE0F920
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeCode function: 1_2_00007FFDFAE3FF201_2_00007FFDFAE3FF20
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeCode function: 1_2_00007FFDFAE9ED101_2_00007FFDFAE9ED10
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeCode function: 1_2_00007FFDFAE28AB01_2_00007FFDFAE28AB0
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeCode function: 1_2_00007FFDFAEDBBA01_2_00007FFDFAEDBBA0
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeCode function: 1_2_00007FFDFAE4B9101_2_00007FFDFAE4B910
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeCode function: 1_2_00007FFDFAEA58B01_2_00007FFDFAEA58B0
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeCode function: 1_2_00007FFDFAE668801_2_00007FFDFAE66880
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeCode function: 1_2_00007FFDFAEA48701_2_00007FFDFAEA4870
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeCode function: 1_2_00007FFDFAE23A501_2_00007FFDFAE23A50
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeCode function: 1_2_00007FFDFAE86A001_2_00007FFDFAE86A00
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeCode function: 1_2_00007FFDFAE269A21_2_00007FFDFAE269A2
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeCode function: 1_2_00007FFDFAE7B9801_2_00007FFDFAE7B980
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeCode function: 1_2_00007FFDFAE34F201_2_00007FFDFAE34F20
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeCode function: 1_2_00007FFDFAE23F101_2_00007FFDFAE23F10
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeCode function: 1_2_00007FFDFAE6BEC01_2_00007FFDFAE6BEC0
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeCode function: 1_2_00007FFDFAE7FEA01_2_00007FFDFAE7FEA0
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeCode function: 1_2_00007FFDFAE61E601_2_00007FFDFAE61E60
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeCode function: 1_2_00007FFDFAE2E0401_2_00007FFDFAE2E040
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeCode function: 1_2_00007FFDFAE3B0101_2_00007FFDFAE3B010
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeCode function: 1_2_00007FFDFAE6CCF01_2_00007FFDFAE6CCF0
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeCode function: 1_2_00007FFDFAE31CB01_2_00007FFDFAE31CB0
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeCode function: 1_2_00007FFDFAE76C701_2_00007FFDFAE76C70
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeCode function: 1_2_00007FFDFAECCC701_2_00007FFDFAECCC70
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeCode function: 1_2_00007FFDFAE8EE501_2_00007FFDFAE8EE50
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeCode function: 1_2_00007FFDFAEBDE301_2_00007FFDFAEBDE30
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeCode function: 1_2_00007FFDFAE97D801_2_00007FFDFAE97D80
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeCode function: 1_2_00007FFDFAE96D701_2_00007FFDFAE96D70
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeCode function: 1_2_00007FFDFAE7DD601_2_00007FFDFAE7DD60
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeCode function: 1_2_00007FFDFAE8BD601_2_00007FFDFAE8BD60
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeCode function: 1_2_00007FFDFAE6B3001_2_00007FFDFAE6B300
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeCode function: 1_2_00007FFDFAE772C01_2_00007FFDFAE772C0
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeCode function: 1_2_00007FFDFAE382901_2_00007FFDFAE38290
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeCode function: 1_2_00007FFDFAE422801_2_00007FFDFAE42280
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeCode function: 1_2_00007FFDFAE642701_2_00007FFDFAE64270
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeCode function: 1_2_00007FFDFAE2F4001_2_00007FFDFAE2F400
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeCode function: 1_2_00007FFDFAE4B1501_2_00007FFDFAE4B150
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeCode function: 1_2_00007FFDFAE470B01_2_00007FFDFAE470B0
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeCode function: 1_2_00007FFDFAEB10701_2_00007FFDFAEB1070
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeCode function: 1_2_00007FFDFAE2A0601_2_00007FFDFAE2A060
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeCode function: 1_2_00007FFDFAE260601_2_00007FFDFAE26060
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeCode function: 1_2_00007FFDFAEA40601_2_00007FFDFAEA4060
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeCode function: 1_2_00007FFDFAE781A01_2_00007FFDFAE781A0
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeCode function: 1_2_00007FFDFAE227581_2_00007FFDFAE22758
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeCode function: 1_2_00007FFDFAE367401_2_00007FFDFAE36740
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeCode function: 1_2_00007FFDFAE4E7101_2_00007FFDFAE4E710
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeCode function: 1_2_00007FFDFAE3B6B01_2_00007FFDFAE3B6B0
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeCode function: 1_2_00007FFDFAE4C6901_2_00007FFDFAE4C690
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeCode function: 1_2_00007FFDFAECA8501_2_00007FFDFAECA850
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeCode function: 1_2_00007FFDFAE448101_2_00007FFDFAE44810
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeCode function: 1_2_00007FFDFAE458001_2_00007FFDFAE45800
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeCode function: 1_2_00007FFDFAE3A7B01_2_00007FFDFAE3A7B0
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeCode function: 1_2_00007FFDFAE4A7701_2_00007FFDFAE4A770
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeCode function: 1_2_00007FFDFAE535101_2_00007FFDFAE53510
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeCode function: 1_2_00007FFDFAE824F01_2_00007FFDFAE824F0
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeCode function: 1_2_00007FFDFAEB14601_2_00007FFDFAEB1460
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeCode function: 1_2_00007FFDFAE925D01_2_00007FFDFAE925D0
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeCode function: 1_2_00007FFDFAE265DB1_2_00007FFDFAE265DB
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeCode function: 1_2_00007FFDFAFA18801_2_00007FFDFAFA1880
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeCode function: 1_2_00007FFDFB4132301_2_00007FFDFB413230
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeCode function: 1_2_00007FFDFB0C30C11_2_00007FFDFB0C30C1
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeCode function: 1_2_00007FFDFB1F7AF01_2_00007FFDFB1F7AF0
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeCode function: 1_2_00007FFDFB2639D01_2_00007FFDFB2639D0
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeCode function: 1_2_00007FFDFB277A101_2_00007FFDFB277A10
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeCode function: 1_2_00007FFDFB0C41651_2_00007FFDFB0C4165
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeCode function: 1_2_00007FFDFB0C3FDA1_2_00007FFDFB0C3FDA
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeCode function: 1_2_00007FFDFB0C6A821_2_00007FFDFB0C6A82
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeCode function: 1_2_00007FFDFB0C655A1_2_00007FFDFB0C655A
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeCode function: 1_2_00007FFDFB0C4C371_2_00007FFDFB0C4C37
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeCode function: 1_2_00007FFDFB0DBF201_2_00007FFDFB0DBF20
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeCode function: 1_2_00007FFDFB0DBD601_2_00007FFDFB0DBD60
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeCode function: 1_2_00007FFDFB0C22891_2_00007FFDFB0C2289
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeCode function: 1_2_00007FFDFB0C27661_2_00007FFDFB0C2766
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeCode function: 1_2_00007FFDFB1EFE301_2_00007FFDFB1EFE30
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeCode function: 1_2_00007FFDFB0C32E71_2_00007FFDFB0C32E7
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtCode function: 25_2_00007FF670A8B28C25_2_00007FF670A8B28C
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtCode function: 25_2_00007FF670A864A425_2_00007FF670A864A4
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtCode function: 25_2_00007FF670A8FD4825_2_00007FF670A8FD48
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtCode function: 25_2_00007FF670A94D4825_2_00007FF670A94D48
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtCode function: 25_2_00007FF670A7674025_2_00007FF670A76740
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtCode function: 25_2_00007FF670A811F425_2_00007FF670A811F4
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtCode function: 25_2_00007FF670A829E425_2_00007FF670A829E4
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtCode function: 25_2_00007FF670A9314C25_2_00007FF670A9314C
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtCode function: 25_2_00007FF670A862F025_2_00007FF670A862F0
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtCode function: 25_2_00007FF670A8DAB825_2_00007FF670A8DAB8
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtCode function: 25_2_00007FF670A872FC25_2_00007FF670A872FC
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtCode function: 25_2_00007FF670A80A4C25_2_00007FF670A80A4C
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtCode function: 25_2_00007FF670A98A8825_2_00007FF670A98A88
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtCode function: 25_2_00007FF670A71B9025_2_00007FF670A71B90
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtCode function: 25_2_00007FF670A90CE425_2_00007FF670A90CE4
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtCode function: 25_2_00007FF670A92CC025_2_00007FF670A92CC0
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtCode function: 25_2_00007FF670A84D0025_2_00007FF670A84D00
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtCode function: 25_2_00007FF670A80C3825_2_00007FF670A80C38
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtCode function: 25_2_00007FF670A8D43825_2_00007FF670A8D438
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtCode function: 25_2_00007FF670A79CB025_2_00007FF670A79CB0
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtCode function: 25_2_00007FF670A81CA025_2_00007FF670A81CA0
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtCode function: 25_2_00007FF670A864A425_2_00007FF670A864A4
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtCode function: 25_2_00007FF670A8261825_2_00007FF670A82618
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtCode function: 25_2_00007FF670A80E2025_2_00007FF670A80E20
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtCode function: 25_2_00007FF670A88F0025_2_00007FF670A88F00
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtCode function: 25_2_00007FF670A94FC425_2_00007FF670A94FC4
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtCode function: 25_2_00007FF670A8100C25_2_00007FF670A8100C
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtCode function: 25_2_00007FF670A9574025_2_00007FF670A95740
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtCode function: 25_2_00007FF670A8CF8825_2_00007FF670A8CF88
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtCode function: 25_2_00007FF670A8086425_2_00007FF670A80864
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtCode function: 25_2_00007FF670A8FD4825_2_00007FF670A8FD48
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtCode function: 26_2_00007FF670A8B28C26_2_00007FF670A8B28C
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtCode function: 26_2_00007FF670A811F426_2_00007FF670A811F4
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtCode function: 26_2_00007FF670A829E426_2_00007FF670A829E4
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtCode function: 26_2_00007FF670A9314C26_2_00007FF670A9314C
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtCode function: 26_2_00007FF670A862F026_2_00007FF670A862F0
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtCode function: 26_2_00007FF670A8DAB826_2_00007FF670A8DAB8
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtCode function: 26_2_00007FF670A872FC26_2_00007FF670A872FC
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtCode function: 26_2_00007FF670A80A4C26_2_00007FF670A80A4C
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtCode function: 26_2_00007FF670A98A8826_2_00007FF670A98A88
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtCode function: 26_2_00007FF670A71B9026_2_00007FF670A71B90
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtCode function: 26_2_00007FF670A90CE426_2_00007FF670A90CE4
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtCode function: 26_2_00007FF670A92CC026_2_00007FF670A92CC0
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtCode function: 26_2_00007FF670A84D0026_2_00007FF670A84D00
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtCode function: 26_2_00007FF670A80C3826_2_00007FF670A80C38
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtCode function: 26_2_00007FF670A8D43826_2_00007FF670A8D438
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtCode function: 26_2_00007FF670A79CB026_2_00007FF670A79CB0
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtCode function: 26_2_00007FF670A864A426_2_00007FF670A864A4
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtCode function: 26_2_00007FF670A81CA026_2_00007FF670A81CA0
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtCode function: 26_2_00007FF670A864A426_2_00007FF670A864A4
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtCode function: 26_2_00007FF670A8261826_2_00007FF670A82618
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtCode function: 26_2_00007FF670A80E2026_2_00007FF670A80E20
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtCode function: 26_2_00007FF670A8FD4826_2_00007FF670A8FD48
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtCode function: 26_2_00007FF670A94D4826_2_00007FF670A94D48
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtCode function: 26_2_00007FF670A88F0026_2_00007FF670A88F00
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtCode function: 26_2_00007FF670A94FC426_2_00007FF670A94FC4
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtCode function: 26_2_00007FF670A8100C26_2_00007FF670A8100C
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtCode function: 26_2_00007FF670A9574026_2_00007FF670A95740
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtCode function: 26_2_00007FF670A7674026_2_00007FF670A76740
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtCode function: 26_2_00007FF670A8CF8826_2_00007FF670A8CF88
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtCode function: 26_2_00007FF670A8086426_2_00007FF670A80864
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtCode function: 26_2_00007FF670A8FD4826_2_00007FF670A8FD48
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtCode function: 26_2_00007FFDFAF7F92026_2_00007FFDFAF7F920
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtCode function: 26_2_00007FFDFAFAFF2026_2_00007FFDFAFAFF20
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtCode function: 26_2_00007FFDFB00ED1026_2_00007FFDFB00ED10
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtCode function: 26_2_00007FFDFB04BBA026_2_00007FFDFB04BBA0
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtCode function: 26_2_00007FFDFAF98AB026_2_00007FFDFAF98AB0
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtCode function: 26_2_00007FFDFAFEB98026_2_00007FFDFAFEB980
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtCode function: 26_2_00007FFDFAF969A226_2_00007FFDFAF969A2
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtCode function: 26_2_00007FFDFAFF6A0026_2_00007FFDFAFF6A00
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtCode function: 26_2_00007FFDFAF93A5026_2_00007FFDFAF93A50
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtCode function: 26_2_00007FFDFB01487026_2_00007FFDFB014870
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtCode function: 26_2_00007FFDFAFD688026_2_00007FFDFAFD6880
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtCode function: 26_2_00007FFDFB0158B026_2_00007FFDFB0158B0
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtCode function: 26_2_00007FFDFAFBB91026_2_00007FFDFAFBB910
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtCode function: 26_2_00007FFDFAFAB01026_2_00007FFDFAFAB010
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtCode function: 26_2_00007FFDFAF9E04026_2_00007FFDFAF9E040
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtCode function: 26_2_00007FFDFAFD1E6026_2_00007FFDFAFD1E60
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtCode function: 26_2_00007FFDFAFEFEA026_2_00007FFDFAFEFEA0
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtCode function: 26_2_00007FFDFAFDBEC026_2_00007FFDFAFDBEC0
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtCode function: 26_2_00007FFDFAF93F1026_2_00007FFDFAF93F10
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtCode function: 26_2_00007FFDFAFA4F2026_2_00007FFDFAFA4F20
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtCode function: 26_2_00007FFDFAFFBD6026_2_00007FFDFAFFBD60
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtCode function: 26_2_00007FFDFAFEDD6026_2_00007FFDFAFEDD60
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtCode function: 26_2_00007FFDFB006D7026_2_00007FFDFB006D70
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtCode function: 26_2_00007FFDFB007D8026_2_00007FFDFB007D80
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtCode function: 26_2_00007FFDFB02DE3026_2_00007FFDFB02DE30
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtCode function: 26_2_00007FFDFAFFEE5026_2_00007FFDFAFFEE50
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtCode function: 26_2_00007FFDFB03CC7026_2_00007FFDFB03CC70
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtCode function: 26_2_00007FFDFAFE6C7026_2_00007FFDFAFE6C70
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtCode function: 26_2_00007FFDFAFA1CB026_2_00007FFDFAFA1CB0
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtCode function: 26_2_00007FFDFAFDCCF026_2_00007FFDFAFDCCF0
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtCode function: 26_2_00007FFDFAF9F40026_2_00007FFDFAF9F400
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtCode function: 26_2_00007FFDFAFD427026_2_00007FFDFAFD4270
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtCode function: 26_2_00007FFDFAFB228026_2_00007FFDFAFB2280
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtCode function: 26_2_00007FFDFAFA829026_2_00007FFDFAFA8290
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtCode function: 26_2_00007FFDFAFE72C026_2_00007FFDFAFE72C0
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtCode function: 26_2_00007FFDFAFDB30026_2_00007FFDFAFDB300
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtCode function: 26_2_00007FFDFAFE81A026_2_00007FFDFAFE81A0
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtCode function: 26_2_00007FFDFB02107026_2_00007FFDFB021070
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtCode function: 26_2_00007FFDFAF9A06026_2_00007FFDFAF9A060
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtCode function: 26_2_00007FFDFAF9606026_2_00007FFDFAF96060
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtCode function: 26_2_00007FFDFB01406026_2_00007FFDFB014060
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtCode function: 26_2_00007FFDFAFB70B026_2_00007FFDFAFB70B0
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtCode function: 26_2_00007FFDFAFBB15026_2_00007FFDFAFBB150
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtCode function: 26_2_00007FFDFAFBA77026_2_00007FFDFAFBA770
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtCode function: 26_2_00007FFDFAFAA7B026_2_00007FFDFAFAA7B0
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtCode function: 26_2_00007FFDFAFB580026_2_00007FFDFAFB5800
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtCode function: 26_2_00007FFDFAFB481026_2_00007FFDFAFB4810
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtCode function: 26_2_00007FFDFB03A85026_2_00007FFDFB03A850
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtCode function: 26_2_00007FFDFAFBC69026_2_00007FFDFAFBC690
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtCode function: 26_2_00007FFDFAFAB6B026_2_00007FFDFAFAB6B0
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtCode function: 26_2_00007FFDFAFBE71026_2_00007FFDFAFBE710
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtCode function: 26_2_00007FFDFAFA674026_2_00007FFDFAFA6740
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtCode function: 26_2_00007FFDFAF9275826_2_00007FFDFAF92758
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtCode function: 26_2_00007FFDFAF965DB26_2_00007FFDFAF965DB
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtCode function: 26_2_00007FFDFB0025D026_2_00007FFDFB0025D0
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtCode function: 26_2_00007FFDFB02146026_2_00007FFDFB021460
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtCode function: 26_2_00007FFDFAFF24F026_2_00007FFDFAFF24F0
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtCode function: 26_2_00007FFDFAFC351026_2_00007FFDFAFC3510
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtCode function: 26_2_00007FFDFB11188026_2_00007FFDFB111880
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtCode function: 26_2_00007FFDFB58323026_2_00007FFDFB583230
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtCode function: 26_2_00007FFDFB2330C126_2_00007FFDFB2330C1
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtCode function: 26_2_00007FFDFB367AF026_2_00007FFDFB367AF0
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtCode function: 26_2_00007FFDFB3D39D026_2_00007FFDFB3D39D0
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtCode function: 26_2_00007FFDFB23416526_2_00007FFDFB234165
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtCode function: 26_2_00007FFDFB3E7A1026_2_00007FFDFB3E7A10
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtCode function: 26_2_00007FFDFB233FDA26_2_00007FFDFB233FDA
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtCode function: 26_2_00007FFDFB236A8226_2_00007FFDFB236A82
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtCode function: 26_2_00007FFDFB23655A26_2_00007FFDFB23655A
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtCode function: 26_2_00007FFDFB234C3726_2_00007FFDFB234C37
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtCode function: 26_2_00007FFDFB24BF2026_2_00007FFDFB24BF20
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtCode function: 26_2_00007FFDFB24BD6026_2_00007FFDFB24BD60
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtCode function: 26_2_00007FFDFB23228926_2_00007FFDFB232289
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtCode function: 26_2_00007FFDFB35FE3026_2_00007FFDFB35FE30
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtCode function: 26_2_00007FFDFB23276626_2_00007FFDFB232766
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtCode function: 26_2_00007FFDFB2332E726_2_00007FFDFB2332E7
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtCode function: 26_2_00007FFDFB235D8526_2_00007FFDFB235D85
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtCode function: 26_2_00007FFDFB36731026_2_00007FFDFB367310
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtCode function: 26_2_00007FFDFB23516926_2_00007FFDFB235169
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtCode function: 26_2_00007FFDFB233B9326_2_00007FFDFB233B93
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtCode function: 26_2_00007FFDFB23114F26_2_00007FFDFB23114F
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtCode function: 26_2_00007FFDFB25B1C026_2_00007FFDFB25B1C0
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtCode function: 26_2_00007FFDFB24F20026_2_00007FFDFB24F200
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtCode function: 26_2_00007FFDFB2329CD26_2_00007FFDFB2329CD
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtCode function: 26_2_00007FFDFB24F06026_2_00007FFDFB24F060
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtCode function: 26_2_00007FFDFB236CB726_2_00007FFDFB236CB7
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtCode function: 26_2_00007FFDFB23609B26_2_00007FFDFB23609B
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtCode function: 26_2_00007FFDFB2321B726_2_00007FFDFB2321B7
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtCode function: 26_2_00007FFDFB236F2326_2_00007FFDFB236F23
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtCode function: 26_2_00007FFDFB29F70026_2_00007FFDFB29F700
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtCode function: 26_2_00007FFDFB2322E826_2_00007FFDFB2322E8
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtCode function: 26_2_00007FFDFB23704526_2_00007FFDFB237045
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtCode function: 26_2_00007FFDFB231EA126_2_00007FFDFB231EA1
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtCode function: 26_2_00007FFDFB46F46026_2_00007FFDFB46F460
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtCode function: 26_2_00007FFDFB25B55026_2_00007FFDFB25B550
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtCode function: 26_2_00007FFDFB235B0F26_2_00007FFDFB235B0F
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtCode function: 26_2_00007FFDFB231B2226_2_00007FFDFB231B22
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtCode function: 26_2_00007FFDFB3D2A9026_2_00007FFDFB3D2A90
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtCode function: 26_2_00007FFDFB234D0426_2_00007FFDFB234D04
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtCode function: 26_2_00007FFDFB312B4026_2_00007FFDFB312B40
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtCode function: 26_2_00007FFDFB235D9E26_2_00007FFDFB235D9E
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtCode function: 26_2_00007FFDFB2323F126_2_00007FFDFB2323F1
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtCode function: 26_2_00007FFDFB36B02026_2_00007FFDFB36B020
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtCode function: 26_2_00007FFDFB236EEC26_2_00007FFDFB236EEC
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtCode function: 26_2_00007FFDFB23213F26_2_00007FFDFB23213F
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtCode function: 26_2_00007FFDFB24EF0026_2_00007FFDFB24EF00
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtCode function: 26_2_00007FFDFB23463326_2_00007FFDFB234633
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtCode function: 26_2_00007FFDFB2372C026_2_00007FFDFB2372C0
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtCode function: 26_2_00007FFDFB231A4B26_2_00007FFDFB231A4B
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtCode function: 26_2_00007FFDFB23707726_2_00007FFDFB237077
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtCode function: 26_2_00007FFDFB236FFA26_2_00007FFDFB236FFA
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtCode function: 26_2_00007FFDFB23369326_2_00007FFDFB233693
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtCode function: 26_2_00007FFDFB23348626_2_00007FFDFB233486
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtCode function: 26_2_00007FFDFB231B3126_2_00007FFDFB231B31
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtCode function: 26_2_00007FFDFB36613026_2_00007FFDFB366130
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtCode function: 26_2_00007FFDFB235E2026_2_00007FFDFB235E20
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtCode function: 26_2_00007FFDFB2360D726_2_00007FFDFB2360D7
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtCode function: 26_2_00007FFDFB36267026_2_00007FFDFB362670
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtCode function: 26_2_00007FFDFB234E4E26_2_00007FFDFB234E4E
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtCode function: 26_2_00007FFDFB231CC126_2_00007FFDFB231CC1
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtCode function: 26_2_00007FFDFB235A6026_2_00007FFDFB235A60
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtCode function: 26_2_00007FFDFB23725226_2_00007FFDFB237252
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtCode function: 26_2_00007FFDFB23383226_2_00007FFDFB233832
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtCode function: 26_2_00007FFDFB2335FD26_2_00007FFDFB2335FD
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtCode function: 26_2_00007FFDFB231CFD26_2_00007FFDFB231CFD
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtCode function: 26_2_00007FFDFB2359F726_2_00007FFDFB2359F7
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtCode function: 26_2_00007FFDFB233A8526_2_00007FFDFB233A85
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtCode function: 26_2_00007FFDFB2350AB26_2_00007FFDFB2350AB
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtCode function: 26_2_00007FFDFB3E99E026_2_00007FFDFB3E99E0
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtCode function: 26_2_00007FFDFB3D192026_2_00007FFDFB3D1920
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtCode function: 26_2_00007FFDFB23474626_2_00007FFDFB234746
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtCode function: 26_2_00007FFDFB2357D126_2_00007FFDFB2357D1
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtCode function: 26_2_00007FFDFB23378D26_2_00007FFDFB23378D
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtCode function: 26_2_00007FFDFB23435926_2_00007FFDFB234359
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtCode function: 26_2_00007FFDFB231D8326_2_00007FFDFB231D83
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtCode function: 26_2_00007FFDFB23736526_2_00007FFDFB237365
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtCode function: 26_2_00007FFDFB365E3026_2_00007FFDFB365E30
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtCode function: 26_2_00007FFDFB2372A726_2_00007FFDFB2372A7
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtCode function: 26_2_00007FFDFB23266C26_2_00007FFDFB23266C
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtCode function: 26_2_00007FFDFB23298226_2_00007FFDFB232982
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtCode function: 26_2_00007FFDFB232D0B26_2_00007FFDFB232D0B
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtCode function: 26_2_00007FFDFB23162226_2_00007FFDFB231622
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtCode function: 26_2_00007FFDFB233BA226_2_00007FFDFB233BA2
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtCode function: 26_2_00007FFDFB235F0B26_2_00007FFDFB235F0B
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtCode function: 26_2_00007FFDFB23551026_2_00007FFDFB235510
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtCode function: 26_2_00007FFDFB23428726_2_00007FFDFB234287
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtCode function: 26_2_00007FFDFB2353A826_2_00007FFDFB2353A8
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtCode function: 26_2_00007FFDFB24D26026_2_00007FFDFB24D260
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtCode function: 26_2_00007FFDFB2344C626_2_00007FFDFB2344C6
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeCode function: String function: 00007FF619BC2770 appears 82 times
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeCode function: String function: 00007FFDFAE29310 appears 158 times
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeCode function: String function: 00007FFDFAE286B0 appears 119 times
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeCode function: String function: 00007FFDFB0C1EF1 appears 165 times
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeCode function: String function: 00007FFDFB0C4057 appears 130 times
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeCode function: String function: 00007FFDFB0C2734 appears 75 times
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtCode function: String function: 00007FFDFAF99310 appears 158 times
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtCode function: String function: 00007FFDFB232734 appears 355 times
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtCode function: String function: 00007FFDFB23300D appears 50 times
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtCode function: String function: 00007FF670A72770 appears 82 times
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtCode function: String function: 00007FFDFB236988 appears 31 times
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtCode function: String function: 00007FFDFAF986B0 appears 119 times
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtCode function: String function: 00007FFDFB232A04 appears 78 times
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtCode function: String function: 00007FFDFB234057 appears 524 times
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtCode function: String function: 00007FFDFB231EF1 appears 890 times
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtCode function: String function: 00007FFDFB23483B appears 92 times
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtCode function: String function: 00007FFDFB2324B9 appears 60 times
                Source: _overlapped.pyd.0.drStatic PE information: Resource name: RT_VERSION type: COM executable for DOS
                Source: unicodedata.pyd.0.drStatic PE information: Resource name: RT_VERSION type: COM executable for DOS
                Source: win32ui.pyd.0.drStatic PE information: Resource name: RT_MENU type: COM executable for DOS
                Source: win32ui.pyd.0.drStatic PE information: Resource name: RT_GROUP_CURSOR type: DOS executable (COM, 0x8C-variant)
                Source: python3.dll.0.drStatic PE information: No import functions for PE file found
                Source: python3.dll.25.drStatic PE information: No import functions for PE file found
                Source: NEVER OPEN!.exe, 00000000.00000003.1718374334.0000027663DF8000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilename_hashlib.pyd. vs NEVER OPEN!.exe
                Source: NEVER OPEN!.exe, 00000000.00000003.1718480312.0000027663DF8000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilename_lzma.pyd. vs NEVER OPEN!.exe
                Source: NEVER OPEN!.exe, 00000000.00000003.1725542997.0000027663DF9000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenamewin32crypt.pyd0 vs NEVER OPEN!.exe
                Source: NEVER OPEN!.exe, 00000000.00000003.1719318901.0000027663E05000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilename_win32sysloader.pyd0 vs NEVER OPEN!.exe
                Source: NEVER OPEN!.exe, 00000000.00000003.1723670795.0000027663DF9000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenamepythoncom310.dll0 vs NEVER OPEN!.exe
                Source: NEVER OPEN!.exe, 00000000.00000003.1718221490.0000027663DF8000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilename_decimal.pyd. vs NEVER OPEN!.exe
                Source: NEVER OPEN!.exe, 00000000.00000003.1726594155.0000027663DF9000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenamewin32ui.pyd0 vs NEVER OPEN!.exe
                Source: NEVER OPEN!.exe, 00000000.00000003.1722852728.0000027663DF9000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenamepython3.dll. vs NEVER OPEN!.exe
                Source: NEVER OPEN!.exe, 00000000.00000003.1717788454.0000027663DF8000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenamevcruntime140_1.dllT vs NEVER OPEN!.exe
                Source: NEVER OPEN!.exe, 00000000.00000003.1718628289.0000027663DF8000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilename_multiprocessing.pyd. vs NEVER OPEN!.exe
                Source: NEVER OPEN!.exe, 00000000.00000003.1724659864.0000027663DF9000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenamesqlite3.dll0 vs NEVER OPEN!.exe
                Source: NEVER OPEN!.exe, 00000000.00000003.1724000360.0000027663DF9000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenamepywintypes310.dll0 vs NEVER OPEN!.exe
                Source: NEVER OPEN!.exe, 00000000.00000003.1717619222.0000027663DF8000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenamevcruntime140.dllT vs NEVER OPEN!.exe
                Source: NEVER OPEN!.exe, 00000000.00000003.1718107183.0000027663DF8000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilename_ctypes.pyd. vs NEVER OPEN!.exe
                Source: NEVER OPEN!.exe, 00000000.00000003.1718740947.0000027663DF8000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilename_overlapped.pyd. vs NEVER OPEN!.exe
                Source: NEVER OPEN!.exe, 00000000.00000003.1718999118.0000027663DF8000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilename_sqlite3.pyd. vs NEVER OPEN!.exe
                Source: NEVER OPEN!.exe, 00000000.00000003.1719100684.0000027663DF8000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilename_ssl.pyd. vs NEVER OPEN!.exe
                Source: NEVER OPEN!.exe, 00000000.00000003.1720724832.0000027663DF9000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenamelibsslH vs NEVER OPEN!.exe
                Source: NEVER OPEN!.exe, 00000000.00000003.1718010752.0000027663DF8000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilename_bz2.pyd. vs NEVER OPEN!.exe
                Source: NEVER OPEN!.exe, 00000000.00000003.1724481502.0000027663DF9000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameselect.pyd. vs NEVER OPEN!.exe
                Source: NEVER OPEN!.exe, 00000000.00000003.1718813658.0000027663DF8000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilename_queue.pyd. vs NEVER OPEN!.exe
                Source: NEVER OPEN!.exe, 00000000.00000003.1725938350.0000027663DF9000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenamewin32trace.pyd0 vs NEVER OPEN!.exe
                Source: NEVER OPEN!.exe, 00000000.00000003.1719318901.0000027663DF8000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilename_win32sysloader.pyd0 vs NEVER OPEN!.exe
                Source: NEVER OPEN!.exe, 00000000.00000003.1722746625.0000027663DF9000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenamepyexpat.pyd. vs NEVER OPEN!.exe
                Source: NEVER OPEN!.exe, 00000000.00000003.1725185679.0000027663DF9000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenamewin32api.pyd0 vs NEVER OPEN!.exe
                Source: NEVER OPEN!.exe, 00000000.00000003.1725333388.0000027663DF9000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameshell.pyd0 vs NEVER OPEN!.exe
                Source: NEVER OPEN!.exe, 00000000.00000003.1724982936.0000027663DF9000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameunicodedata.pyd. vs NEVER OPEN!.exe
                Source: NEVER OPEN!.exe, 00000000.00000003.1717924924.0000027663DF8000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilename_asyncio.pyd. vs NEVER OPEN!.exe
                Source: NEVER OPEN!.exe, 00000000.00000003.1719208282.0000027663DF8000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilename_uuid.pyd. vs NEVER OPEN!.exe
                Source: NEVER OPEN!.exe, 00000000.00000003.1718914840.0000027663DF8000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilename_socket.pyd. vs NEVER OPEN!.exe
                Source: NEVER OPEN!.exe, 00000000.00000003.1725938350.0000027663E06000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenamewin32trace.pyd0 vs NEVER OPEN!.exe
                Source: NEVER OPEN!.exe, 00000001.00000002.1923402448.00007FFE1320C000.00000004.00000001.01000000.0000000D.sdmpBinary or memory string: OriginalFilenameselect.pyd. vs NEVER OPEN!.exe
                Source: NEVER OPEN!.exe, 00000001.00000002.1907437203.00007FFE014DE000.00000004.00000001.01000000.0000001D.sdmpBinary or memory string: OriginalFilename_sqlite3.pyd. vs NEVER OPEN!.exe
                Source: NEVER OPEN!.exe, 00000001.00000002.1916827047.00007FFE10318000.00000004.00000001.01000000.00000009.sdmpBinary or memory string: OriginalFilename_bz2.pyd. vs NEVER OPEN!.exe
                Source: NEVER OPEN!.exe, 00000001.00000002.1921998275.00007FFE12E19000.00000002.00000001.01000000.00000010.sdmpBinary or memory string: OriginalFilenamevcruntime140_1.dllT vs NEVER OPEN!.exe
                Source: NEVER OPEN!.exe, 00000001.00000002.1898503424.00007FFDFB414000.00000004.00000001.01000000.00000018.sdmpBinary or memory string: OriginalFilenamelibcryptoH vs NEVER OPEN!.exe
                Source: NEVER OPEN!.exe, 00000001.00000002.1878698743.000001F093850000.00000002.00000001.01000000.00000006.sdmpBinary or memory string: OriginalFilenamepython3.dll. vs NEVER OPEN!.exe
                Source: NEVER OPEN!.exe, 00000001.00000002.1915396079.00007FFE0EB6C000.00000004.00000001.01000000.0000000A.sdmpBinary or memory string: OriginalFilename_lzma.pyd. vs NEVER OPEN!.exe
                Source: NEVER OPEN!.exe, 00000001.00000002.1924223671.00007FFE1A467000.00000002.00000001.01000000.00000005.sdmpBinary or memory string: OriginalFilenamevcruntime140.dllT vs NEVER OPEN!.exe
                Source: NEVER OPEN!.exe, 00000001.00000002.1910950990.00007FFE0E143000.00000004.00000001.01000000.00000019.sdmpBinary or memory string: OriginalFilename_hashlib.pyd. vs NEVER OPEN!.exe
                Source: NEVER OPEN!.exe, 00000001.00000002.1899711383.00007FFE001E6000.00000004.00000001.01000000.0000003B.sdmpBinary or memory string: OriginalFilenamewin32crypt.pyd0 vs NEVER OPEN!.exe
                Source: NEVER OPEN!.exe, 00000001.00000002.1907121579.00007FFE01475000.00000004.00000001.01000000.00000011.sdmpBinary or memory string: OriginalFilenamepythoncom310.dll0 vs NEVER OPEN!.exe
                Source: NEVER OPEN!.exe, 00000001.00000002.1904170665.00007FFE00823000.00000004.00000001.01000000.00000017.sdmpBinary or memory string: OriginalFilenamelibsslH vs NEVER OPEN!.exe
                Source: NEVER OPEN!.exe, 00000001.00000002.1922934113.00007FFE130CC000.00000004.00000001.01000000.0000000E.sdmpBinary or memory string: OriginalFilename_queue.pyd. vs NEVER OPEN!.exe
                Source: NEVER OPEN!.exe, 00000001.00000002.1904674154.00007FFE012DF000.00000004.00000001.01000000.00000032.sdmpBinary or memory string: OriginalFilename_overlapped.pyd. vs NEVER OPEN!.exe
                Source: NEVER OPEN!.exe, 00000001.00000002.1909564751.00007FFE0CFBA000.00000004.00000001.01000000.00000012.sdmpBinary or memory string: OriginalFilenamewin32api.pyd0 vs NEVER OPEN!.exe
                Source: NEVER OPEN!.exe, 00000001.00000002.1915708693.00007FFE101E8000.00000004.00000001.01000000.0000000C.sdmpBinary or memory string: OriginalFilename_socket.pyd. vs NEVER OPEN!.exe
                Source: NEVER OPEN!.exe, 00000001.00000002.1904462925.00007FFE01224000.00000004.00000001.01000000.00000031.sdmpBinary or memory string: OriginalFilename_asyncio.pyd. vs NEVER OPEN!.exe
                Source: NEVER OPEN!.exe, 00000001.00000002.1897449895.00007FFDFB0B7000.00000004.00000001.01000000.0000001C.sdmpBinary or memory string: OriginalFilenameunicodedata.pyd. vs NEVER OPEN!.exe
                Source: NEVER OPEN!.exe, 00000001.00000002.1911590919.00007FFE0E183000.00000004.00000001.01000000.0000000B.sdmpBinary or memory string: OriginalFilenamepyexpat.pyd. vs NEVER OPEN!.exe
                Source: NEVER OPEN!.exe, 00000001.00000002.1896632509.00007FFDFAF8E000.00000004.00000001.01000000.0000001E.sdmpBinary or memory string: OriginalFilenamesqlite3.dll0 vs NEVER OPEN!.exe
                Source: NEVER OPEN!.exe, 00000001.00000002.1906681535.00007FFE013B1000.00000004.00000001.01000000.00000013.sdmpBinary or memory string: OriginalFilename_decimal.pyd. vs NEVER OPEN!.exe
                Source: NEVER OPEN!.exe, 00000001.00000002.1916310700.00007FFE10263000.00000004.00000001.01000000.00000007.sdmpBinary or memory string: OriginalFilename_ctypes.pyd. vs NEVER OPEN!.exe
                Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\reg.exe reg delete HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v empyrean /f
                Source: libcrypto-1_1.dll.0.drStatic PE information: Section: UPX1 ZLIB complexity 0.9987735523897059
                Source: libssl-1_1.dll.0.drStatic PE information: Section: UPX1 ZLIB complexity 0.9903690732758621
                Source: python310.dll.0.drStatic PE information: Section: UPX1 ZLIB complexity 0.9989668051626591
                Source: pythoncom310.dll.0.drStatic PE information: Section: UPX1 ZLIB complexity 0.9899098376132931
                Source: sqlite3.dll.0.drStatic PE information: Section: UPX1 ZLIB complexity 0.9974886012158704
                Source: _ec_ws.pyd.0.drStatic PE information: Section: UPX1 ZLIB complexity 0.997811369573955
                Source: _imaging.cp310-win_amd64.pyd.0.drStatic PE information: Section: UPX1 ZLIB complexity 0.9979345034246575
                Source: _imagingft.cp310-win_amd64.pyd.0.drStatic PE information: Section: UPX1 ZLIB complexity 0.9982498724016332
                Source: _webp.cp310-win_amd64.pyd.0.drStatic PE information: Section: UPX1 ZLIB complexity 0.9935926258992805
                Source: unicodedata.pyd.0.drStatic PE information: Section: UPX1 ZLIB complexity 0.9949454842032966
                Source: shell.pyd.0.drStatic PE information: Section: UPX1 ZLIB complexity 0.9900203339041096
                Source: win32ui.pyd.0.drStatic PE information: Section: UPX1 ZLIB complexity 0.9930103058510639
                Source: libcrypto-1_1.dll.25.drStatic PE information: Section: UPX1 ZLIB complexity 0.9987735523897059
                Source: libssl-1_1.dll.25.drStatic PE information: Section: UPX1 ZLIB complexity 0.9903690732758621
                Source: python310.dll.25.drStatic PE information: Section: UPX1 ZLIB complexity 0.9989668051626591
                Source: pythoncom310.dll.25.drStatic PE information: Section: UPX1 ZLIB complexity 0.9899098376132931
                Source: sqlite3.dll.25.drStatic PE information: Section: UPX1 ZLIB complexity 0.9974886012158704
                Source: _ec_ws.pyd.25.drStatic PE information: Section: UPX1 ZLIB complexity 0.997811369573955
                Source: _imaging.cp310-win_amd64.pyd.25.drStatic PE information: Section: UPX1 ZLIB complexity 0.9979345034246575
                Source: _imagingft.cp310-win_amd64.pyd.25.drStatic PE information: Section: UPX1 ZLIB complexity 0.9982498724016332
                Source: classification engineClassification label: mal100.rans.troj.spyw.evad.winEXE@78/365@4/4
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeCode function: 0_2_00007FF619BC7410 GetLastError,FormatMessageW,WideCharToMultiByte,0_2_00007FF619BC7410
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeFile created: C:\Users\user\Desktop\login_dbJump to behavior
                Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6104:120:WilError_03
                Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5432:120:WilError_03
                Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6016:120:WilError_03
                Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5016:120:WilError_03
                Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:732:120:WilError_03
                Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6260:120:WilError_03
                Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1436:120:WilError_03
                Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1860:120:WilError_03
                Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3696:120:WilError_03
                Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1196:120:WilError_03
                Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6688:120:WilError_03
                Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4944:120:WilError_03
                Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4320:120:WilError_03
                Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1712:120:WilError_03
                Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5084:120:WilError_03
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI70002Jump to behavior
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v empyrean /t REG_SZ /d C:\Users\user\AppData\Roaming\empyrean\run.bat /f"
                Source: NEVER OPEN!.exeStatic PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeKey opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiersJump to behavior
                Source: NEVER OPEN!.exe, dat.txtBinary or memory string: CREATE TABLE %Q.'%q_docsize'(docid INTEGER PRIMARY KEY, size BLOB);
                Source: NEVER OPEN!.exe, dat.txtBinary or memory string: CREATE TABLE IF NOT EXISTS %Q.'%q_stat'(id INTEGER PRIMARY KEY, value BLOB);
                Source: NEVER OPEN!.exe, dat.txtBinary or memory string: CREATE TABLE %Q.'%q_segdir'(level INTEGER,idx INTEGER,start_block INTEGER,leaves_end_block INTEGER,end_block INTEGER,root BLOB,PRIMARY KEY(level, idx));
                Source: NEVER OPEN!.exe, dat.txtBinary or memory string: CREATE TABLE %Q.'%q_segments'(blockid INTEGER PRIMARY KEY, block BLOB);
                Source: NEVER OPEN!.exe, dat.txtBinary or memory string: INSERT INTO %Q.sqlite_master VALUES('index',%Q,%Q,#%d,%Q);
                Source: NEVER OPEN!.exe, 00000001.00000003.1766435908.000001F0976BD000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000003.1766273937.000001F097690000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));
                Source: NEVER OPEN!.exe, dat.txtBinary or memory string: CREATE TABLE "%w"."%w_parent"(nodeno INTEGER PRIMARY KEY,parentnode);
                Source: NEVER OPEN!.exeReversingLabs: Detection: 57%
                Source: NEVER OPEN!.exeString found in binary or memory: set-addPolicy
                Source: NEVER OPEN!.exeString found in binary or memory: id-cmc-addExtensions
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeFile read: C:\Users\user\Desktop\NEVER OPEN!.exeJump to behavior
                Source: unknownProcess created: C:\Users\user\Desktop\NEVER OPEN!.exe "C:\Users\user\Desktop\NEVER OPEN!.exe"
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeProcess created: C:\Users\user\Desktop\NEVER OPEN!.exe "C:\Users\user\Desktop\NEVER OPEN!.exe"
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "ver"
                Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "reg delete HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v empyrean /f"
                Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\reg.exe reg delete HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v empyrean /f
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v empyrean /t REG_SZ /d C:\Users\user\AppData\Roaming\empyrean\run.bat /f"
                Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\reg.exe reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v empyrean /t REG_SZ /d C:\Users\user\AppData\Roaming\empyrean\run.bat /f
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "C:\Windows\System32\wbem\WMIC.exe csproduct get uuid"
                Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\wbem\WMIC.exe C:\Windows\System32\wbem\WMIC.exe csproduct get uuid
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "C:\Windows\System32\wbem\WMIC.exe csproduct get uuid"
                Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\wbem\WMIC.exe C:\Windows\System32\wbem\WMIC.exe csproduct get uuid
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "C:\Windows\System32\wbem\WMIC.exe csproduct get uuid"
                Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\wbem\WMIC.exe C:\Windows\System32\wbem\WMIC.exe csproduct get uuid
                Source: unknownProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\Roaming\empyrean\run.bat" "
                Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                Source: C:\Windows\System32\cmd.exeProcess created: C:\Users\user\AppData\Roaming\empyrean\dat.txt C:\Users\user\AppData\Roaming\empyrean\dat.txt
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtProcess created: C:\Users\user\AppData\Roaming\empyrean\dat.txt C:\Users\user\AppData\Roaming\empyrean\dat.txt
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "ver"
                Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                Source: unknownProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\Roaming\empyrean\run.bat" "
                Source: C:\Windows\System32\wbem\WMIC.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                Source: C:\Windows\System32\wbem\WMIC.exeProcess created: C:\Users\user\AppData\Roaming\empyrean\dat.txt C:\Users\user\AppData\Roaming\empyrean\dat.txt
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtProcess created: C:\Users\user\AppData\Roaming\empyrean\dat.txt C:\Users\user\AppData\Roaming\empyrean\dat.txt
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "C:\Windows\System32\wbem\WMIC.exe csproduct get uuid"
                Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\wbem\WMIC.exe C:\Windows\System32\wbem\WMIC.exe csproduct get uuid
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "ver"
                Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "C:\Windows\System32\wbem\WMIC.exe csproduct get uuid"
                Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\wbem\WMIC.exe C:\Windows\System32\wbem\WMIC.exe csproduct get uuid
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "C:\Windows\System32\wbem\WMIC.exe csproduct get uuid"
                Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\wbem\WMIC.exe C:\Windows\System32\wbem\WMIC.exe csproduct get uuid
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "C:\Windows\System32\wbem\WMIC.exe csproduct get uuid"
                Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\wbem\WMIC.exe C:\Windows\System32\wbem\WMIC.exe csproduct get uuid
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "C:\Windows\System32\wbem\WMIC.exe csproduct get uuid"
                Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\wbem\WMIC.exe C:\Windows\System32\wbem\WMIC.exe csproduct get uuid
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "C:\Windows\System32\wbem\WMIC.exe csproduct get uuid"
                Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\wbem\WMIC.exe C:\Windows\System32\wbem\WMIC.exe csproduct get uuid
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeProcess created: C:\Users\user\Desktop\NEVER OPEN!.exe "C:\Users\user\Desktop\NEVER OPEN!.exe"Jump to behavior
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "ver"Jump to behavior
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "reg delete HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v empyrean /f"Jump to behavior
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v empyrean /t REG_SZ /d C:\Users\user\AppData\Roaming\empyrean\run.bat /f"Jump to behavior
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "C:\Windows\System32\wbem\WMIC.exe csproduct get uuid"Jump to behavior
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "C:\Windows\System32\wbem\WMIC.exe csproduct get uuid"Jump to behavior
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "C:\Windows\System32\wbem\WMIC.exe csproduct get uuid"Jump to behavior
                Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\reg.exe reg delete HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v empyrean /fJump to behavior
                Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\reg.exe reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v empyrean /t REG_SZ /d C:\Users\user\AppData\Roaming\empyrean\run.bat /fJump to behavior
                Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\wbem\WMIC.exe C:\Windows\System32\wbem\WMIC.exe csproduct get uuidJump to behavior
                Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\wbem\WMIC.exe C:\Windows\System32\wbem\WMIC.exe csproduct get uuid
                Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\wbem\WMIC.exe C:\Windows\System32\wbem\WMIC.exe csproduct get uuid
                Source: C:\Windows\System32\cmd.exeProcess created: C:\Users\user\AppData\Roaming\empyrean\dat.txt C:\Users\user\AppData\Roaming\empyrean\dat.txtJump to behavior
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtProcess created: C:\Users\user\AppData\Roaming\empyrean\dat.txt C:\Users\user\AppData\Roaming\empyrean\dat.txtJump to behavior
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "ver"
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "C:\Windows\System32\wbem\WMIC.exe csproduct get uuid"
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "C:\Windows\System32\wbem\WMIC.exe csproduct get uuid"
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "C:\Windows\System32\wbem\WMIC.exe csproduct get uuid"
                Source: C:\Windows\System32\cmd.exeProcess created: C:\Users\user\AppData\Roaming\empyrean\dat.txt C:\Users\user\AppData\Roaming\empyrean\dat.txt
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtProcess created: C:\Users\user\AppData\Roaming\empyrean\dat.txt C:\Users\user\AppData\Roaming\empyrean\dat.txt
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "ver"
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "C:\Windows\System32\wbem\WMIC.exe csproduct get uuid"
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "C:\Windows\System32\wbem\WMIC.exe csproduct get uuid"
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "C:\Windows\System32\wbem\WMIC.exe csproduct get uuid"
                Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\wbem\WMIC.exe C:\Windows\System32\wbem\WMIC.exe csproduct get uuid
                Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\wbem\WMIC.exe C:\Windows\System32\wbem\WMIC.exe csproduct get uuid
                Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\wbem\WMIC.exe C:\Windows\System32\wbem\WMIC.exe csproduct get uuid
                Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\wbem\WMIC.exe C:\Windows\System32\wbem\WMIC.exe csproduct get uuid
                Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\wbem\WMIC.exe C:\Windows\System32\wbem\WMIC.exe csproduct get uuid
                Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\wbem\WMIC.exe C:\Windows\System32\wbem\WMIC.exe csproduct get uuid
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeSection loaded: kernel.appcore.dllJump to behavior
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeSection loaded: vcruntime140.dllJump to behavior
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeSection loaded: version.dllJump to behavior
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeSection loaded: cryptsp.dllJump to behavior
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeSection loaded: rsaenh.dllJump to behavior
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeSection loaded: cryptbase.dllJump to behavior
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeSection loaded: libffi-7.dllJump to behavior
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeSection loaded: iphlpapi.dllJump to behavior
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeSection loaded: vcruntime140_1.dllJump to behavior
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeSection loaded: kernel.appcore.dllJump to behavior
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeSection loaded: uxtheme.dllJump to behavior
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeSection loaded: urlmon.dllJump to behavior
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeSection loaded: iertutil.dllJump to behavior
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeSection loaded: srvcli.dllJump to behavior
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeSection loaded: netutils.dllJump to behavior
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeSection loaded: secur32.dllJump to behavior
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeSection loaded: sspicli.dllJump to behavior
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeSection loaded: pdh.dllJump to behavior
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeSection loaded: powrprof.dllJump to behavior
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeSection loaded: umpdc.dllJump to behavior
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeSection loaded: wtsapi32.dllJump to behavior
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeSection loaded: libcrypto-1_1.dllJump to behavior
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeSection loaded: libssl-1_1.dllJump to behavior
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeSection loaded: mswsock.dllJump to behavior
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeSection loaded: sqlite3.dllJump to behavior
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeSection loaded: msasn1.dllJump to behavior
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeSection loaded: wbemcomn.dllJump to behavior
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeSection loaded: amsi.dllJump to behavior
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeSection loaded: userenv.dllJump to behavior
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeSection loaded: profapi.dllJump to behavior
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeSection loaded: sxs.dllJump to behavior
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeSection loaded: dnsapi.dllJump to behavior
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeSection loaded: rasadhlp.dllJump to behavior
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeSection loaded: fwpuclnt.dllJump to behavior
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeSection loaded: dpapi.dllJump to behavior
                Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: iphlpapi.dllJump to behavior
                Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: framedynos.dllJump to behavior
                Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: sspicli.dllJump to behavior
                Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: kernel.appcore.dllJump to behavior
                Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: wbemcomn.dllJump to behavior
                Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: msxml6.dllJump to behavior
                Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: urlmon.dllJump to behavior
                Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: iertutil.dllJump to behavior
                Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: srvcli.dllJump to behavior
                Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: netutils.dllJump to behavior
                Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: uxtheme.dllJump to behavior
                Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: vcruntime140.dllJump to behavior
                Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: vcruntime140_1.dllJump to behavior
                Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: amsi.dllJump to behavior
                Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: userenv.dllJump to behavior
                Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: profapi.dllJump to behavior
                Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: vbscript.dllJump to behavior
                Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: sxs.dllJump to behavior
                Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: iphlpapi.dllJump to behavior
                Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: framedynos.dllJump to behavior
                Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: sspicli.dllJump to behavior
                Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: kernel.appcore.dllJump to behavior
                Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: wbemcomn.dllJump to behavior
                Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: msxml6.dllJump to behavior
                Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: urlmon.dllJump to behavior
                Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: iertutil.dllJump to behavior
                Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: srvcli.dllJump to behavior
                Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: netutils.dllJump to behavior
                Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: uxtheme.dllJump to behavior
                Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: vcruntime140.dllJump to behavior
                Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: vcruntime140_1.dllJump to behavior
                Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: amsi.dllJump to behavior
                Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: userenv.dllJump to behavior
                Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: profapi.dllJump to behavior
                Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: vbscript.dllJump to behavior
                Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: sxs.dllJump to behavior
                Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: iphlpapi.dllJump to behavior
                Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: framedynos.dllJump to behavior
                Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: sspicli.dllJump to behavior
                Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: kernel.appcore.dllJump to behavior
                Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: wbemcomn.dllJump to behavior
                Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: msxml6.dllJump to behavior
                Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: urlmon.dllJump to behavior
                Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: iertutil.dllJump to behavior
                Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: srvcli.dllJump to behavior
                Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: netutils.dllJump to behavior
                Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: uxtheme.dllJump to behavior
                Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: vcruntime140.dllJump to behavior
                Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: vcruntime140_1.dllJump to behavior
                Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: vcruntime140.dllJump to behavior
                Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: amsi.dllJump to behavior
                Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: userenv.dllJump to behavior
                Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: profapi.dllJump to behavior
                Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: vbscript.dllJump to behavior
                Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: sxs.dllJump to behavior
                Source: C:\Windows\System32\cmd.exeSection loaded: cmdext.dllJump to behavior
                Source: C:\Windows\System32\cmd.exeSection loaded: apphelp.dllJump to behavior
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtSection loaded: kernel.appcore.dllJump to behavior
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtSection loaded: vcruntime140.dll
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtSection loaded: version.dll
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtSection loaded: cryptsp.dll
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtSection loaded: rsaenh.dll
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtSection loaded: cryptbase.dll
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtSection loaded: libffi-7.dll
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtSection loaded: iphlpapi.dll
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtSection loaded: vcruntime140_1.dll
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtSection loaded: kernel.appcore.dll
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtSection loaded: uxtheme.dll
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtSection loaded: urlmon.dll
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtSection loaded: iertutil.dll
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtSection loaded: srvcli.dll
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtSection loaded: netutils.dll
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtSection loaded: secur32.dll
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtSection loaded: sspicli.dll
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtSection loaded: pdh.dll
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtSection loaded: powrprof.dll
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtSection loaded: umpdc.dll
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtSection loaded: wtsapi32.dll
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtSection loaded: libcrypto-1_1.dll
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtSection loaded: libssl-1_1.dll
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtSection loaded: libcrypto-1_1.dll
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtSection loaded: mswsock.dll
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtSection loaded: sqlite3.dll
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtSection loaded: msasn1.dll
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtSection loaded: wbemcomn.dll
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtSection loaded: amsi.dll
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtSection loaded: userenv.dll
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtSection loaded: profapi.dll
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtSection loaded: sxs.dll
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtSection loaded: dnsapi.dll
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtSection loaded: rasadhlp.dll
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtSection loaded: fwpuclnt.dll
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtSection loaded: dpapi.dll
                Source: C:\Windows\System32\cmd.exeSection loaded: cmdext.dll
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtSection loaded: kernel.appcore.dll
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtSection loaded: vcruntime140.dll
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtSection loaded: version.dll
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtSection loaded: cryptsp.dll
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtSection loaded: rsaenh.dll
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtSection loaded: cryptbase.dll
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtSection loaded: libffi-7.dll
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtSection loaded: iphlpapi.dll
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtSection loaded: vcruntime140_1.dll
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtSection loaded: kernel.appcore.dll
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtSection loaded: uxtheme.dll
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtSection loaded: urlmon.dll
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtSection loaded: iertutil.dll
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtSection loaded: srvcli.dll
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtSection loaded: netutils.dll
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtSection loaded: secur32.dll
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtSection loaded: sspicli.dll
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtSection loaded: pdh.dll
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtSection loaded: powrprof.dll
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtSection loaded: umpdc.dll
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtSection loaded: wtsapi32.dll
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtSection loaded: libcrypto-1_1.dll
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtSection loaded: libssl-1_1.dll
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtSection loaded: mswsock.dll
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtSection loaded: sqlite3.dll
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtSection loaded: msasn1.dll
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtSection loaded: wbemcomn.dll
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtSection loaded: amsi.dll
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtSection loaded: userenv.dll
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtSection loaded: profapi.dll
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtSection loaded: sxs.dll
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtSection loaded: dnsapi.dll
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtSection loaded: rasadhlp.dll
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtSection loaded: fwpuclnt.dll
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtSection loaded: dpapi.dll
                Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: iphlpapi.dll
                Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: framedynos.dll
                Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: sspicli.dll
                Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: kernel.appcore.dll
                Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: wbemcomn.dll
                Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: msxml6.dll
                Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: urlmon.dll
                Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: iertutil.dll
                Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: srvcli.dll
                Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: netutils.dll
                Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: uxtheme.dll
                Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: vcruntime140.dll
                Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: vcruntime140_1.dll
                Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: amsi.dll
                Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: userenv.dll
                Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: profapi.dll
                Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: vbscript.dll
                Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: sxs.dll
                Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: iphlpapi.dll
                Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: framedynos.dll
                Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: sspicli.dll
                Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: kernel.appcore.dll
                Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: wbemcomn.dll
                Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: msxml6.dll
                Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: urlmon.dll
                Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: iertutil.dll
                Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: srvcli.dll
                Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: netutils.dll
                Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: uxtheme.dll
                Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: vcruntime140.dll
                Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: vcruntime140_1.dll
                Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: amsi.dll
                Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: userenv.dll
                Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: profapi.dll
                Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: vbscript.dll
                Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: sxs.dll
                Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: iphlpapi.dll
                Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: framedynos.dll
                Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: sspicli.dll
                Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: kernel.appcore.dll
                Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: wbemcomn.dll
                Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: msxml6.dll
                Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: urlmon.dll
                Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: iertutil.dll
                Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: srvcli.dll
                Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: netutils.dll
                Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: uxtheme.dll
                Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: vcruntime140.dll
                Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: vcruntime140_1.dll
                Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: vcruntime140.dll
                Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: amsi.dll
                Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: userenv.dll
                Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: profapi.dll
                Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: vbscript.dll
                Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: sxs.dll
                Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: iphlpapi.dll
                Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: framedynos.dll
                Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: sspicli.dll
                Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: kernel.appcore.dll
                Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: wbemcomn.dll
                Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: msxml6.dll
                Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: urlmon.dll
                Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: iertutil.dll
                Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: srvcli.dll
                Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: netutils.dll
                Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: uxtheme.dll
                Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: vcruntime140.dll
                Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: vcruntime140_1.dll
                Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: amsi.dll
                Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: userenv.dll
                Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: profapi.dll
                Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: vbscript.dll
                Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: sxs.dll
                Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: iphlpapi.dll
                Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: framedynos.dll
                Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: sspicli.dll
                Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: kernel.appcore.dll
                Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: wbemcomn.dll
                Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: msxml6.dll
                Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: urlmon.dll
                Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: iertutil.dll
                Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: srvcli.dll
                Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: netutils.dll
                Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: uxtheme.dll
                Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: vcruntime140.dll
                Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: vcruntime140_1.dll
                Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: vcruntime140.dll
                Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: amsi.dll
                Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: userenv.dll
                Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: profapi.dll
                Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: vbscript.dll
                Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: sxs.dll
                Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: iphlpapi.dll
                Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: framedynos.dll
                Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: sspicli.dll
                Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: kernel.appcore.dll
                Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: wbemcomn.dll
                Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: msxml6.dll
                Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: urlmon.dll
                Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: iertutil.dll
                Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: srvcli.dll
                Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: netutils.dll
                Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: uxtheme.dll
                Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: vcruntime140.dll
                Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: vcruntime140_1.dll
                Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: amsi.dll
                Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: userenv.dll
                Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: profapi.dll
                Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: vbscript.dll
                Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: sxs.dll
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{172BDDF8-CEEA-11D1-8B05-00600806D9B6}\InProcServer32Jump to behavior
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeFile opened: C:\Users\user\Desktop\pyvenv.cfgJump to behavior
                Source: Window RecorderWindow detected: More than 3 window changes detected
                Source: NEVER OPEN!.exeStatic PE information: Image base 0x140000000 > 0x60000000
                Source: NEVER OPEN!.exeStatic file information: File size 18752296 > 1048576
                Source: NEVER OPEN!.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
                Source: NEVER OPEN!.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
                Source: NEVER OPEN!.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
                Source: NEVER OPEN!.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
                Source: NEVER OPEN!.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
                Source: NEVER OPEN!.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT
                Source: NEVER OPEN!.exeStatic PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, GUARD_CF, TERMINAL_SERVER_AWARE
                Source: NEVER OPEN!.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
                Source: Binary string: C:\A\40\b\bin\amd64\_decimal.pdb$$ source: NEVER OPEN!.exe, 00000001.00000002.1906311543.00007FFE01371000.00000040.00000001.01000000.00000013.sdmp
                Source: Binary string: C:\A\40\b\bin\amd64\sqlite3.pdb source: NEVER OPEN!.exe, dat.txt
                Source: Binary string: compiler: cl /Zi /Fdossl_static.pdb /Gs0 /GF /Gy /MD /W3 /wd4090 /nologo /O2 -DL_ENDIAN -DOPENSSL_PIC -DOPENSSL_CPUID_OBJ -DOPENSSL_IA32_SSE2 -DOPENSSL_BN_ASM_MONT -DOPENSSL_BN_ASM_MONT5 -DOPENSSL_BN_ASM_GF2m -DSHA1_ASM -DSHA256_ASM -DSHA512_ASM -DKECCAK1600_A source: NEVER OPEN!.exe, dat.txt
                Source: Binary string: D:\_w\1\b\libssl-1_1.pdb source: NEVER OPEN!.exe, 00000001.00000002.1903355658.00007FFE007E6000.00000040.00000001.01000000.00000017.sdmp
                Source: Binary string: C:\A\40\b\bin\amd64\_decimal.pdb source: NEVER OPEN!.exe, 00000001.00000002.1906311543.00007FFE01371000.00000040.00000001.01000000.00000013.sdmp
                Source: Binary string: C:\A\40\b\bin\amd64\_uuid.pdb source: NEVER OPEN!.exe, 00000001.00000002.1920987146.00007FFE126C1000.00000040.00000001.01000000.00000014.sdmp
                Source: Binary string: C:\src\pywin32\build\temp.win-amd64-cpython-310\Release\win32crypt.pdb source: NEVER OPEN!.exe, 00000001.00000002.1899389721.00007FFE001C1000.00000040.00000001.01000000.0000003B.sdmp
                Source: Binary string: compiler: cl /Zi /Fdossl_static.pdb /Gs0 /GF /Gy /MD /W3 /wd4090 /nologo /O2 -DL_ENDIAN -DOPENSSL_PIC -DOPENSSL_CPUID_OBJ -DOPENSSL_IA32_SSE2 -DOPENSSL_BN_ASM_MONT -DOPENSSL_BN_ASM_MONT5 -DOPENSSL_BN_ASM_GF2m -DSHA1_ASM -DSHA256_ASM -DSHA512_ASM -DKECCAK1600_ASM -DRC4_ASM -DMD5_ASM -DAESNI_ASM -DVPAES_ASM -DGHASH_ASM -DECP_NISTZ256_ASM -DX25519_ASM -DPOLY1305_ASM source: NEVER OPEN!.exe, 00000001.00000002.1897592652.00007FFDFB30E000.00000040.00000001.01000000.00000018.sdmp
                Source: Binary string: C:\A\40\b\bin\amd64\python3.pdb source: NEVER OPEN!.exe, 00000000.00000003.1722852728.0000027663DF9000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000002.1878698743.000001F093850000.00000002.00000001.01000000.00000006.sdmp
                Source: Binary string: D:\a\_work\1\s\binaries\amd64ret\bin\amd64\\vcruntime140.amd64.pdb source: NEVER OPEN!.exe, 00000000.00000003.1717619222.0000027663DF8000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000002.1924121684.00007FFE1A461000.00000002.00000001.01000000.00000005.sdmp
                Source: Binary string: C:\A\40\b\bin\amd64\_ctypes.pdb source: NEVER OPEN!.exe, 00000001.00000002.1916135326.00007FFE10241000.00000040.00000001.01000000.00000007.sdmp
                Source: Binary string: D:\a\_work\1\s\binaries\amd64ret\bin\amd64\\vcruntime140.amd64.pdbGCTL source: NEVER OPEN!.exe, 00000000.00000003.1717619222.0000027663DF8000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000002.1924121684.00007FFE1A461000.00000002.00000001.01000000.00000005.sdmp
                Source: Binary string: C:\A\40\b\bin\amd64\_queue.pdb source: NEVER OPEN!.exe, 00000001.00000002.1922538367.00007FFE130C1000.00000040.00000001.01000000.0000000E.sdmp
                Source: Binary string: C:\A\40\b\bin\amd64\_sqlite3.pdb source: NEVER OPEN!.exe, 00000001.00000002.1907220479.00007FFE014C1000.00000040.00000001.01000000.0000001D.sdmp
                Source: Binary string: C:\A\40\b\bin\amd64\python310.pdb source: NEVER OPEN!.exe, 00000001.00000002.1898577877.00007FFDFB784000.00000040.00000001.01000000.00000004.sdmp
                Source: Binary string: C:\A\40\b\bin\amd64\_overlapped.pdb source: NEVER OPEN!.exe, 00000001.00000002.1904550109.00007FFE012D1000.00000040.00000001.01000000.00000032.sdmp
                Source: Binary string: C:\src\pywin32\build\temp.win-amd64-cpython-310\Release\pywintypes.pdb source: NEVER OPEN!.exe, 00000001.00000002.1909665891.00007FFE0CFC1000.00000040.00000001.01000000.0000000F.sdmp
                Source: Binary string: D:\a\_work\1\s\binaries\amd64ret\bin\amd64\\vcruntime140_1.amd64.pdb source: NEVER OPEN!.exe, 00000000.00000003.1717788454.0000027663DF8000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000002.1921820675.00007FFE12E15000.00000002.00000001.01000000.00000010.sdmp
                Source: Binary string: C:\A\40\b\bin\amd64\_lzma.pdbNN source: NEVER OPEN!.exe, 00000001.00000002.1915163773.00007FFE0EB5C000.00000040.00000001.01000000.0000000A.sdmp
                Source: Binary string: C:\A\40\b\bin\amd64\_asyncio.pdb source: NEVER OPEN!.exe, 00000001.00000002.1904263516.00007FFE01211000.00000040.00000001.01000000.00000031.sdmp
                Source: Binary string: C:\A\40\b\bin\amd64\_lzma.pdb source: NEVER OPEN!.exe, 00000001.00000002.1915163773.00007FFE0EB5C000.00000040.00000001.01000000.0000000A.sdmp
                Source: Binary string: C:\src\pywin32\build\temp.win-amd64-cpython-310\Release\win32api.pdb!! source: NEVER OPEN!.exe, 00000001.00000002.1909239152.00007FFE0CF91000.00000040.00000001.01000000.00000012.sdmp
                Source: Binary string: C:\A\40\b\bin\amd64\select.pdb source: NEVER OPEN!.exe, 00000001.00000002.1923089438.00007FFE13201000.00000040.00000001.01000000.0000000D.sdmp
                Source: Binary string: C:\A\40\b\bin\amd64\unicodedata.pdb source: NEVER OPEN!.exe, 00000001.00000002.1896873012.00007FFDFB0AC000.00000040.00000001.01000000.0000001C.sdmp
                Source: Binary string: D:\_w\1\b\libssl-1_1.pdb@@ source: NEVER OPEN!.exe, 00000001.00000002.1903355658.00007FFE007E6000.00000040.00000001.01000000.00000017.sdmp
                Source: Binary string: C:\src\pywin32\build\temp.win-amd64-cpython-310\Release\win32api.pdb source: NEVER OPEN!.exe, 00000001.00000002.1909239152.00007FFE0CF91000.00000040.00000001.01000000.00000012.sdmp
                Source: Binary string: C:\A\40\b\bin\amd64\_ssl.pdb source: NEVER OPEN!.exe, 00000001.00000002.1908679287.00007FFE0C0A1000.00000040.00000001.01000000.00000016.sdmp
                Source: Binary string: C:\A\40\b\bin\amd64\_socket.pdb source: NEVER OPEN!.exe, 00000001.00000002.1915478870.00007FFE101D1000.00000040.00000001.01000000.0000000C.sdmp
                Source: Binary string: C:\src\pywin32\build\temp.win-amd64-cpython-310\Release\pywintypes.pdb** source: NEVER OPEN!.exe, 00000001.00000002.1909665891.00007FFE0CFC1000.00000040.00000001.01000000.0000000F.sdmp
                Source: Binary string: C:\A\40\b\bin\amd64\_bz2.pdb source: NEVER OPEN!.exe, 00000001.00000002.1916398193.00007FFE10301000.00000040.00000001.01000000.00000009.sdmp
                Source: Binary string: @ compiler: cl /Zi /Fdossl_static.pdb /Gs0 /GF /Gy /MD /W3 /wd4090 /nologo /O2 -DL_ENDIAN -DOPENSSL_PIC -DOPENSSL_CPUID_OBJ -DOPENSSL_IA32_SSE2 -DOPENSSL_BN_ASM_MONT -DOPENSSL_BN_ASM_MONT5 -DOPENSSL_BN_ASM_GF2m -DSHA1_ASM -DSHA256_ASM -DSHA512_ASM -DKECCAK1600_ASM -DRC4_ASM -DMD5_ASM -DAESNI_ASM -DVPAES_ASM -DGHASH_ASM -DECP_NISTZ256_ASM -DX25519_ASM -DPOLY1305_ASMOpenSSL 1.1.1q 5 Jul 2022built on: Thu Aug 18 20:15:42 2022 UTCplatform: VC-WIN64A-masmOPENSSLDIR: "C:\Program Files\Common Files\SSL"ENGINESDIR: "C:\Program Files\OpenSSL\lib\engines-1_1"not available source: NEVER OPEN!.exe, 00000001.00000002.1897592652.00007FFDFB30E000.00000040.00000001.01000000.00000018.sdmp
                Source: Binary string: D:\a\_work\1\s\binaries\amd64ret\bin\amd64\\vcruntime140_1.amd64.pdbGCTL source: NEVER OPEN!.exe, 00000000.00000003.1717788454.0000027663DF8000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000002.1921820675.00007FFE12E15000.00000002.00000001.01000000.00000010.sdmp
                Source: Binary string: D:\_w\1\b\libcrypto-1_1.pdb source: NEVER OPEN!.exe, dat.txt
                Source: Binary string: C:\A\40\b\bin\amd64\pyexpat.pdb source: NEVER OPEN!.exe, 00000001.00000002.1911150737.00007FFE0E151000.00000040.00000001.01000000.0000000B.sdmp
                Source: Binary string: C:\src\pywin32\build\temp.win-amd64-cpython-310\Release\win32crypt.pdb!! source: NEVER OPEN!.exe, 00000001.00000002.1899389721.00007FFE001C1000.00000040.00000001.01000000.0000003B.sdmp
                Source: NEVER OPEN!.exeStatic PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
                Source: NEVER OPEN!.exeStatic PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
                Source: NEVER OPEN!.exeStatic PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
                Source: NEVER OPEN!.exeStatic PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
                Source: NEVER OPEN!.exeStatic PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata
                Source: VCRUNTIME140.dll.0.drStatic PE information: 0x8E79CD85 [Sat Sep 30 01:19:01 2045 UTC]
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeCode function: 1_2_00007FFDFAE0F920 EntryPoint,LoadLibraryA,GetProcAddress,VirtualProtect,VirtualProtect,VirtualProtect,1_2_00007FFDFAE0F920
                Source: NEVER OPEN!.exeStatic PE information: section name: _RDATA
                Source: VCRUNTIME140.dll.0.drStatic PE information: section name: _RDATA
                Source: libffi-7.dll.0.drStatic PE information: section name: UPX2
                Source: mfc140u.dll.0.drStatic PE information: section name: .didat
                Source: dat.txt.1.drStatic PE information: section name: _RDATA
                Source: VCRUNTIME140.dll.25.drStatic PE information: section name: _RDATA
                Source: libffi-7.dll.25.drStatic PE information: section name: UPX2
                Source: mfc140u.dll.25.drStatic PE information: section name: .didat
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeCode function: 1_2_00007FFDFABC4F44 push 6FFDC5CAh; ret 1_2_00007FFDFABC4F4A
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeCode function: 1_2_00007FFDFABC7679 push 6FFDC5D5h; iretd 1_2_00007FFDFABC767F
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeCode function: 1_2_00007FFDFABC4A94 push 6FFDC5D5h; iretd 1_2_00007FFDFABC4A9A
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeCode function: 1_2_00007FFDFABC73CB push 60F5C5F1h; iretd 1_2_00007FFDFABC73D3
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeCode function: 1_2_00007FFDFABC4F90 push 6FFDC5C3h; iretd 1_2_00007FFDFABC4F96
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeCode function: 1_2_00007FFDFABC7929 push 6FFDC5CAh; ret 1_2_00007FFDFABC792F
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeCode function: 1_2_00007FFDFABC45E6 push 60F5C5F1h; iretd 1_2_00007FFDFABC45EE
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeCode function: 1_2_00007FFDFABC7975 push 6FFDC5C3h; iretd 1_2_00007FFDFABC797B
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeCode function: 1_2_00007FFDFAFA6F8D push r10; ret 1_2_00007FFDFAFA6FA0
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeCode function: 1_2_00007FFDFAFA77EA push rsi; ret 1_2_00007FFDFAFA7821
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeCode function: 1_2_00007FFDFAFA9C02 push rsp; retf 1_2_00007FFDFAFA9C03
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeCode function: 1_2_00007FFDFAFA6C21 push r10; ret 1_2_00007FFDFAFA6C23
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeCode function: 1_2_00007FFDFAFA8E66 push rbp; iretq 1_2_00007FFDFAFA8E67
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeCode function: 1_2_00007FFDFAFA6E8C push rsp; iretd 1_2_00007FFDFAFA6E8D
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeCode function: 1_2_00007FFDFAFA6E9B push rsi; ret 1_2_00007FFDFAFA6E9C
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeCode function: 1_2_00007FFDFAFA6EB6 push r10; retf 1_2_00007FFDFAFA6EB9
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeCode function: 1_2_00007FFDFAFA6ED0 push r12; ret 1_2_00007FFDFAFA6EEE
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeCode function: 1_2_00007FFDFAFAA2E5 push rsp; retf 1_2_00007FFDFAFAA2E6
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeCode function: 1_2_00007FFDFAFA92E4 push r10; retf 1_2_00007FFDFAFA9350
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeCode function: 1_2_00007FFDFAFA8EFE push r12; ret 1_2_00007FFDFAFA8F25
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeCode function: 1_2_00007FFDFAFA6F32 push r12; ret 1_2_00007FFDFAFA6F4A
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeCode function: 1_2_00007FFDFAFA8F53 push r12; iretd 1_2_00007FFDFAFA8F6A
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeCode function: 1_2_00007FFDFAFA6F54 push r8; ret 1_2_00007FFDFAFA6F5C
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeCode function: 1_2_00007FFDFAFAA164 push rsp; ret 1_2_00007FFDFAFAA165
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeCode function: 1_2_00007FFDFAFA9D85 push rsp; iretq 1_2_00007FFDFAFA9D86
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeCode function: 1_2_00007FFDFAFA85A7 push r12; ret 1_2_00007FFDFAFA85E3
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeCode function: 1_2_00007FFDFAFA91A3 push rdi; iretd 1_2_00007FFDFAFA91A5
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeCode function: 1_2_00007FFDFAFA6DFB push rsp; ret 1_2_00007FFDFAFA6E03
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeCode function: 1_2_00007FFDFAFA6E44 push rdi; iretd 1_2_00007FFDFAFA6E46
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeCode function: 1_2_00007FFDFAFAA4A9 push rdx; ret 1_2_00007FFDFAFAA500
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeCode function: 1_2_00007FFDFAFA6CCC push r8; ret 1_2_00007FFDFAFA6CD9
                Source: initial sampleStatic PE information: section name: UPX0
                Source: initial sampleStatic PE information: section name: UPX1
                Source: initial sampleStatic PE information: section name: UPX0
                Source: initial sampleStatic PE information: section name: UPX1
                Source: initial sampleStatic PE information: section name: UPX0
                Source: initial sampleStatic PE information: section name: UPX1
                Source: initial sampleStatic PE information: section name: UPX0
                Source: initial sampleStatic PE information: section name: UPX1
                Source: initial sampleStatic PE information: section name: UPX0
                Source: initial sampleStatic PE information: section name: UPX1
                Source: initial sampleStatic PE information: section name: UPX0
                Source: initial sampleStatic PE information: section name: UPX1
                Source: initial sampleStatic PE information: section name: UPX0
                Source: initial sampleStatic PE information: section name: UPX1
                Source: initial sampleStatic PE information: section name: UPX0
                Source: initial sampleStatic PE information: section name: UPX1
                Source: initial sampleStatic PE information: section name: UPX0
                Source: initial sampleStatic PE information: section name: UPX1
                Source: initial sampleStatic PE information: section name: UPX0
                Source: initial sampleStatic PE information: section name: UPX1
                Source: initial sampleStatic PE information: section name: UPX0
                Source: initial sampleStatic PE information: section name: UPX1
                Source: initial sampleStatic PE information: section name: UPX0
                Source: initial sampleStatic PE information: section name: UPX1
                Source: initial sampleStatic PE information: section name: UPX0
                Source: initial sampleStatic PE information: section name: UPX1
                Source: initial sampleStatic PE information: section name: UPX0
                Source: initial sampleStatic PE information: section name: UPX1
                Source: initial sampleStatic PE information: section name: UPX0
                Source: initial sampleStatic PE information: section name: UPX1
                Source: initial sampleStatic PE information: section name: UPX0
                Source: initial sampleStatic PE information: section name: UPX1
                Source: initial sampleStatic PE information: section name: UPX0
                Source: initial sampleStatic PE information: section name: UPX1
                Source: initial sampleStatic PE information: section name: UPX0
                Source: initial sampleStatic PE information: section name: UPX1
                Source: initial sampleStatic PE information: section name: UPX0
                Source: initial sampleStatic PE information: section name: UPX1
                Source: initial sampleStatic PE information: section name: UPX0
                Source: initial sampleStatic PE information: section name: UPX1
                Source: initial sampleStatic PE information: section name: UPX0
                Source: initial sampleStatic PE information: section name: UPX1
                Source: initial sampleStatic PE information: section name: UPX0
                Source: initial sampleStatic PE information: section name: UPX1
                Source: initial sampleStatic PE information: section name: UPX0
                Source: initial sampleStatic PE information: section name: UPX1
                Source: initial sampleStatic PE information: section name: UPX0
                Source: initial sampleStatic PE information: section name: UPX1
                Source: initial sampleStatic PE information: section name: UPX0
                Source: initial sampleStatic PE information: section name: UPX1
                Source: initial sampleStatic PE information: section name: UPX0
                Source: initial sampleStatic PE information: section name: UPX1
                Source: initial sampleStatic PE information: section name: UPX0
                Source: initial sampleStatic PE information: section name: UPX1
                Source: initial sampleStatic PE information: section name: UPX0
                Source: initial sampleStatic PE information: section name: UPX1
                Source: initial sampleStatic PE information: section name: UPX0
                Source: initial sampleStatic PE information: section name: UPX1
                Source: initial sampleStatic PE information: section name: UPX0
                Source: initial sampleStatic PE information: section name: UPX1
                Source: initial sampleStatic PE information: section name: UPX0
                Source: initial sampleStatic PE information: section name: UPX1
                Source: initial sampleStatic PE information: section name: UPX0
                Source: initial sampleStatic PE information: section name: UPX1
                Source: initial sampleStatic PE information: section name: UPX0
                Source: initial sampleStatic PE information: section name: UPX1
                Source: initial sampleStatic PE information: section name: UPX0
                Source: initial sampleStatic PE information: section name: UPX1
                Source: initial sampleStatic PE information: section name: UPX0
                Source: initial sampleStatic PE information: section name: UPX1
                Source: initial sampleStatic PE information: section name: UPX0
                Source: initial sampleStatic PE information: section name: UPX1
                Source: initial sampleStatic PE information: section name: UPX0
                Source: initial sampleStatic PE information: section name: UPX1
                Source: initial sampleStatic PE information: section name: UPX0
                Source: initial sampleStatic PE information: section name: UPX1
                Source: initial sampleStatic PE information: section name: UPX0
                Source: initial sampleStatic PE information: section name: UPX1
                Source: initial sampleStatic PE information: section name: UPX0
                Source: initial sampleStatic PE information: section name: UPX1
                Source: initial sampleStatic PE information: section name: UPX0
                Source: initial sampleStatic PE information: section name: UPX1
                Source: initial sampleStatic PE information: section name: UPX0
                Source: initial sampleStatic PE information: section name: UPX1
                Source: initial sampleStatic PE information: section name: UPX0
                Source: initial sampleStatic PE information: section name: UPX1
                Source: initial sampleStatic PE information: section name: UPX0
                Source: initial sampleStatic PE information: section name: UPX1
                Source: initial sampleStatic PE information: section name: UPX0
                Source: initial sampleStatic PE information: section name: UPX1
                Source: initial sampleStatic PE information: section name: UPX0
                Source: initial sampleStatic PE information: section name: UPX1
                Source: initial sampleStatic PE information: section name: UPX0
                Source: initial sampleStatic PE information: section name: UPX1
                Source: initial sampleStatic PE information: section name: UPX0
                Source: initial sampleStatic PE information: section name: UPX1
                Source: initial sampleStatic PE information: section name: UPX0
                Source: initial sampleStatic PE information: section name: UPX1
                Source: initial sampleStatic PE information: section name: UPX0
                Source: initial sampleStatic PE information: section name: UPX1
                Source: initial sampleStatic PE information: section name: UPX0
                Source: initial sampleStatic PE information: section name: UPX1
                Source: initial sampleStatic PE information: section name: UPX0
                Source: initial sampleStatic PE information: section name: UPX1
                Source: initial sampleStatic PE information: section name: UPX0
                Source: initial sampleStatic PE information: section name: UPX1
                Source: initial sampleStatic PE information: section name: UPX0
                Source: initial sampleStatic PE information: section name: UPX1
                Source: initial sampleStatic PE information: section name: UPX0
                Source: initial sampleStatic PE information: section name: UPX1
                Source: initial sampleStatic PE information: section name: UPX0
                Source: initial sampleStatic PE information: section name: UPX1
                Source: initial sampleStatic PE information: section name: UPX0
                Source: initial sampleStatic PE information: section name: UPX1
                Source: initial sampleStatic PE information: section name: UPX0
                Source: initial sampleStatic PE information: section name: UPX1
                Source: initial sampleStatic PE information: section name: UPX0
                Source: initial sampleStatic PE information: section name: UPX1
                Source: initial sampleStatic PE information: section name: UPX0
                Source: initial sampleStatic PE information: section name: UPX1
                Source: initial sampleStatic PE information: section name: UPX0
                Source: initial sampleStatic PE information: section name: UPX1
                Source: initial sampleStatic PE information: section name: UPX0
                Source: initial sampleStatic PE information: section name: UPX1
                Source: initial sampleStatic PE information: section name: UPX0
                Source: initial sampleStatic PE information: section name: UPX1
                Source: initial sampleStatic PE information: section name: UPX0
                Source: initial sampleStatic PE information: section name: UPX1
                Source: initial sampleStatic PE information: section name: UPX0
                Source: initial sampleStatic PE information: section name: UPX1
                Source: initial sampleStatic PE information: section name: UPX0
                Source: initial sampleStatic PE information: section name: UPX1
                Source: initial sampleStatic PE information: section name: UPX0
                Source: initial sampleStatic PE information: section name: UPX1
                Source: initial sampleStatic PE information: section name: UPX0
                Source: initial sampleStatic PE information: section name: UPX1
                Source: initial sampleStatic PE information: section name: UPX0
                Source: initial sampleStatic PE information: section name: UPX1
                Source: initial sampleStatic PE information: section name: UPX0
                Source: initial sampleStatic PE information: section name: UPX1
                Source: initial sampleStatic PE information: section name: UPX0
                Source: initial sampleStatic PE information: section name: UPX1
                Source: initial sampleStatic PE information: section name: UPX0
                Source: initial sampleStatic PE information: section name: UPX1
                Source: initial sampleStatic PE information: section name: UPX0
                Source: initial sampleStatic PE information: section name: UPX1
                Source: initial sampleStatic PE information: section name: UPX0
                Source: initial sampleStatic PE information: section name: UPX1
                Source: initial sampleStatic PE information: section name: UPX0
                Source: initial sampleStatic PE information: section name: UPX1
                Source: initial sampleStatic PE information: section name: UPX0
                Source: initial sampleStatic PE information: section name: UPX1
                Source: initial sampleStatic PE information: section name: UPX0
                Source: initial sampleStatic PE information: section name: UPX1
                Source: initial sampleStatic PE information: section name: UPX0
                Source: initial sampleStatic PE information: section name: UPX1
                Source: initial sampleStatic PE information: section name: UPX0
                Source: initial sampleStatic PE information: section name: UPX1
                Source: initial sampleStatic PE information: section name: UPX0
                Source: initial sampleStatic PE information: section name: UPX1
                Source: initial sampleStatic PE information: section name: UPX0
                Source: initial sampleStatic PE information: section name: UPX1
                Source: initial sampleStatic PE information: section name: UPX0
                Source: initial sampleStatic PE information: section name: UPX1
                Source: initial sampleStatic PE information: section name: UPX0
                Source: initial sampleStatic PE information: section name: UPX1
                Source: initial sampleStatic PE information: section name: UPX0
                Source: initial sampleStatic PE information: section name: UPX1
                Source: initial sampleStatic PE information: section name: UPX0
                Source: initial sampleStatic PE information: section name: UPX1
                Source: initial sampleStatic PE information: section name: UPX0
                Source: initial sampleStatic PE information: section name: UPX1
                Source: initial sampleStatic PE information: section name: UPX0
                Source: initial sampleStatic PE information: section name: UPX1
                Source: initial sampleStatic PE information: section name: UPX0
                Source: initial sampleStatic PE information: section name: UPX1
                Source: initial sampleStatic PE information: section name: UPX0
                Source: initial sampleStatic PE information: section name: UPX1
                Source: initial sampleStatic PE information: section name: UPX0
                Source: initial sampleStatic PE information: section name: UPX1
                Source: initial sampleStatic PE information: section name: UPX0
                Source: initial sampleStatic PE information: section name: UPX1
                Source: initial sampleStatic PE information: section name: UPX0
                Source: initial sampleStatic PE information: section name: UPX1
                Source: initial sampleStatic PE information: section name: UPX0
                Source: initial sampleStatic PE information: section name: UPX1
                Source: initial sampleStatic PE information: section name: UPX0
                Source: initial sampleStatic PE information: section name: UPX1
                Source: initial sampleStatic PE information: section name: UPX0
                Source: initial sampleStatic PE information: section name: UPX1
                Source: initial sampleStatic PE information: section name: UPX0
                Source: initial sampleStatic PE information: section name: UPX1
                Source: initial sampleStatic PE information: section name: UPX0
                Source: initial sampleStatic PE information: section name: UPX1
                Source: initial sampleStatic PE information: section name: UPX0
                Source: initial sampleStatic PE information: section name: UPX1
                Source: initial sampleStatic PE information: section name: UPX0
                Source: initial sampleStatic PE information: section name: UPX1
                Source: initial sampleStatic PE information: section name: UPX0
                Source: initial sampleStatic PE information: section name: UPX1
                Source: initial sampleStatic PE information: section name: UPX0
                Source: initial sampleStatic PE information: section name: UPX1
                Source: initial sampleStatic PE information: section name: UPX0
                Source: initial sampleStatic PE information: section name: UPX1
                Source: initial sampleStatic PE information: section name: UPX0
                Source: initial sampleStatic PE information: section name: UPX1
                Source: initial sampleStatic PE information: section name: UPX0
                Source: initial sampleStatic PE information: section name: UPX1
                Source: initial sampleStatic PE information: section name: UPX0
                Source: initial sampleStatic PE information: section name: UPX1
                Source: initial sampleStatic PE information: section name: UPX0
                Source: initial sampleStatic PE information: section name: UPX1
                Source: initial sampleStatic PE information: section name: UPX0
                Source: initial sampleStatic PE information: section name: UPX1
                Source: initial sampleStatic PE information: section name: UPX0
                Source: initial sampleStatic PE information: section name: UPX1
                Source: initial sampleStatic PE information: section name: UPX0
                Source: initial sampleStatic PE information: section name: UPX1
                Source: initial sampleStatic PE information: section name: UPX0
                Source: initial sampleStatic PE information: section name: UPX1
                Source: initial sampleStatic PE information: section name: UPX0
                Source: initial sampleStatic PE information: section name: UPX1
                Source: initial sampleStatic PE information: section name: UPX0
                Source: initial sampleStatic PE information: section name: UPX1
                Source: initial sampleStatic PE information: section name: UPX0
                Source: initial sampleStatic PE information: section name: UPX1
                Source: initial sampleStatic PE information: section name: UPX0
                Source: initial sampleStatic PE information: section name: UPX1
                Source: initial sampleStatic PE information: section name: UPX0
                Source: initial sampleStatic PE information: section name: UPX1
                Source: initial sampleStatic PE information: section name: UPX0
                Source: initial sampleStatic PE information: section name: UPX1
                Source: initial sampleStatic PE information: section name: UPX0
                Source: initial sampleStatic PE information: section name: UPX1
                Source: initial sampleStatic PE information: section name: UPX0
                Source: initial sampleStatic PE information: section name: UPX1
                Source: initial sampleStatic PE information: section name: UPX0
                Source: initial sampleStatic PE information: section name: UPX1
                Source: initial sampleStatic PE information: section name: UPX0
                Source: initial sampleStatic PE information: section name: UPX1
                Source: initial sampleStatic PE information: section name: UPX0
                Source: initial sampleStatic PE information: section name: UPX1
                Source: initial sampleStatic PE information: section name: UPX0
                Source: initial sampleStatic PE information: section name: UPX1
                Source: initial sampleStatic PE information: section name: UPX0
                Source: initial sampleStatic PE information: section name: UPX1
                Source: initial sampleStatic PE information: section name: UPX0
                Source: initial sampleStatic PE information: section name: UPX1
                Source: initial sampleStatic PE information: section name: UPX0
                Source: initial sampleStatic PE information: section name: UPX1
                Source: initial sampleStatic PE information: section name: UPX0
                Source: initial sampleStatic PE information: section name: UPX1
                Source: initial sampleStatic PE information: section name: UPX0
                Source: initial sampleStatic PE information: section name: UPX1
                Source: initial sampleStatic PE information: section name: UPX0
                Source: initial sampleStatic PE information: section name: UPX1
                Source: initial sampleStatic PE information: section name: UPX0
                Source: initial sampleStatic PE information: section name: UPX1
                Source: initial sampleStatic PE information: section name: UPX0
                Source: initial sampleStatic PE information: section name: UPX1
                Source: initial sampleStatic PE information: section name: UPX0
                Source: initial sampleStatic PE information: section name: UPX1
                Source: initial sampleStatic PE information: section name: UPX0
                Source: initial sampleStatic PE information: section name: UPX1
                Source: initial sampleStatic PE information: section name: UPX0
                Source: initial sampleStatic PE information: section name: UPX1
                Source: initial sampleStatic PE information: section name: UPX0
                Source: initial sampleStatic PE information: section name: UPX1
                Source: initial sampleStatic PE information: section name: UPX0
                Source: initial sampleStatic PE information: section name: UPX1
                Source: initial sampleStatic PE information: section name: UPX0
                Source: initial sampleStatic PE information: section name: UPX1
                Source: initial sampleStatic PE information: section name: UPX0
                Source: initial sampleStatic PE information: section name: UPX1

                Persistence and Installation Behavior

                barindex
                Uses cmd line tools excessively to alter registry or file data
                Source: C:\Windows\System32\cmd.exeProcess created: reg.exe
                Source: C:\Windows\System32\cmd.exeProcess created: reg.exe
                Source: C:\Windows\System32\cmd.exeProcess created: reg.exeJump to behavior
                Source: C:\Windows\System32\cmd.exeProcess created: reg.exeJump to behavior
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtFile created: C:\Users\user\AppData\Local\Temp\_MEI2802\python310.dllJump to dropped file
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtFile created: C:\Users\user\AppData\Local\Temp\_MEI45442\VCRUNTIME140.dllJump to dropped file
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI70002\Crypto\PublicKey\_ed448.pydJump to dropped file
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtFile created: C:\Users\user\AppData\Local\Temp\_MEI45442\Crypto\Cipher\_raw_eksblowfish.pydJump to dropped file
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtFile created: C:\Users\user\AppData\Local\Temp\_MEI45442\PIL\_webp.cp310-win_amd64.pydJump to dropped file
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI70002\_overlapped.pydJump to dropped file
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI70002\mfc140u.dllJump to dropped file
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtFile created: C:\Users\user\AppData\Local\Temp\_MEI2802\select.pydJump to dropped file
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtFile created: C:\Users\user\AppData\Local\Temp\_MEI45442\_uuid.pydJump to dropped file
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtFile created: C:\Users\user\AppData\Local\Temp\_MEI2802\pythoncom310.dllJump to dropped file
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtFile created: C:\Users\user\AppData\Local\Temp\_MEI2802\libffi-7.dllJump to dropped file
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtFile created: C:\Users\user\AppData\Local\Temp\_MEI45442\sqlite3.dllJump to dropped file
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtFile created: C:\Users\user\AppData\Local\Temp\_MEI2802\Crypto\Cipher\_raw_ofb.pydJump to dropped file
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtFile created: C:\Users\user\AppData\Local\Temp\_MEI45442\Crypto\Cipher\_raw_ocb.pydJump to dropped file
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtFile created: C:\Users\user\AppData\Local\Temp\_MEI45442\unicodedata.pydJump to dropped file
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtFile created: C:\Users\user\AppData\Local\Temp\_MEI2802\win32trace.pydJump to dropped file
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtFile created: C:\Users\user\AppData\Local\Temp\_MEI45442\Crypto\PublicKey\_ec_ws.pydJump to dropped file
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI70002\Crypto\Protocol\_scrypt.pydJump to dropped file
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtFile created: C:\Users\user\AppData\Local\Temp\_MEI2802\Crypto\Cipher\_raw_ecb.pydJump to dropped file
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtFile created: C:\Users\user\AppData\Local\Temp\_MEI45442\_lzma.pydJump to dropped file
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtFile created: C:\Users\user\AppData\Local\Temp\_MEI2802\Crypto\Cipher\_raw_des.pydJump to dropped file
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtFile created: C:\Users\user\AppData\Local\Temp\_MEI2802\_ssl.pydJump to dropped file
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI70002\Crypto\Hash\_poly1305.pydJump to dropped file
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtFile created: C:\Users\user\AppData\Local\Temp\_MEI45442\mfc140u.dllJump to dropped file
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtFile created: C:\Users\user\AppData\Local\Temp\_MEI2802\Crypto\Hash\_RIPEMD160.pydJump to dropped file
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtFile created: C:\Users\user\AppData\Local\Temp\_MEI2802\unicodedata.pydJump to dropped file
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI70002\_bz2.pydJump to dropped file
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtFile created: C:\Users\user\AppData\Local\Temp\_MEI45442\Crypto\Cipher\_raw_cast.pydJump to dropped file
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI70002\aiohttp\_http_writer.cp310-win_amd64.pydJump to dropped file
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtFile created: C:\Users\user\AppData\Local\Temp\_MEI45442\Crypto\Cipher\_raw_arc2.pydJump to dropped file
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI70002\sqlite3.dllJump to dropped file
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtFile created: C:\Users\user\AppData\Local\Temp\_MEI45442\_win32sysloader.pydJump to dropped file
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtFile created: C:\Users\user\AppData\Local\Temp\_MEI45442\charset_normalizer\md__mypyc.cp310-win_amd64.pydJump to dropped file
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtFile created: C:\Users\user\AppData\Local\Temp\_MEI2802\mfc140u.dllJump to dropped file
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtFile created: C:\Users\user\AppData\Local\Temp\_MEI2802\Crypto\Cipher\_ARC4.pydJump to dropped file
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtFile created: C:\Users\user\AppData\Local\Temp\_MEI45442\Crypto\Cipher\_raw_des3.pydJump to dropped file
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtFile created: C:\Users\user\AppData\Local\Temp\_MEI2802\libcrypto-1_1.dllJump to dropped file
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtFile created: C:\Users\user\AppData\Local\Temp\_MEI2802\Crypto\PublicKey\_ed25519.pydJump to dropped file
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI70002\Crypto\Cipher\_Salsa20.pydJump to dropped file
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI70002\_lzma.pydJump to dropped file
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeFile created: C:\Users\user\AppData\Roaming\empyrean\dat.txtJump to dropped file
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI70002\Crypto\Hash\_ghash_portable.pydJump to dropped file
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI70002\_queue.pydJump to dropped file
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtFile created: C:\Users\user\AppData\Local\Temp\_MEI45442\psutil\_psutil_windows.pydJump to dropped file
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtFile created: C:\Users\user\AppData\Local\Temp\_MEI2802\PIL\_imagingft.cp310-win_amd64.pydJump to dropped file
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtFile created: C:\Users\user\AppData\Local\Temp\_MEI45442\Crypto\Hash\_BLAKE2b.pydJump to dropped file
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI70002\Crypto\Cipher\_raw_ocb.pydJump to dropped file
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI70002\yarl\_quoting_c.cp310-win_amd64.pydJump to dropped file
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtFile created: C:\Users\user\AppData\Local\Temp\_MEI2802\Crypto\Cipher\_raw_cfb.pydJump to dropped file
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI70002\Crypto\Hash\_MD4.pydJump to dropped file
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI70002\PIL\_webp.cp310-win_amd64.pydJump to dropped file
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI70002\aiohttp\_helpers.cp310-win_amd64.pydJump to dropped file
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtFile created: C:\Users\user\AppData\Local\Temp\_MEI2802\win32crypt.pydJump to dropped file
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI70002\_socket.pydJump to dropped file
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtFile created: C:\Users\user\AppData\Local\Temp\_MEI45442\Crypto\Cipher\_Salsa20.pydJump to dropped file
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI70002\PIL\_imagingtk.cp310-win_amd64.pydJump to dropped file
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtFile created: C:\Users\user\AppData\Local\Temp\_MEI2802\sqlite3.dllJump to dropped file
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI70002\Crypto\Cipher\_ARC4.pydJump to dropped file
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtFile created: C:\Users\user\AppData\Local\Temp\_MEI45442\win32api.pydJump to dropped file
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtFile created: C:\Users\user\AppData\Local\Temp\_MEI2802\_queue.pydJump to dropped file
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtFile created: C:\Users\user\AppData\Local\Temp\_MEI45442\_sqlite3.pydJump to dropped file
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtFile created: C:\Users\user\AppData\Local\Temp\_MEI45442\Crypto\PublicKey\_ed25519.pydJump to dropped file
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI70002\pyexpat.pydJump to dropped file
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI70002\libffi-7.dllJump to dropped file
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtFile created: C:\Users\user\AppData\Local\Temp\_MEI45442\Crypto\Hash\_RIPEMD160.pydJump to dropped file
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtFile created: C:\Users\user\AppData\Local\Temp\_MEI2802\PIL\_imagingtk.cp310-win_amd64.pydJump to dropped file
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI70002\win32com\shell\shell.pydJump to dropped file
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtFile created: C:\Users\user\AppData\Local\Temp\_MEI45442\libssl-1_1.dllJump to dropped file
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI70002\python3.dllJump to dropped file
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI70002\VCRUNTIME140.dllJump to dropped file
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtFile created: C:\Users\user\AppData\Local\Temp\_MEI2802\charset_normalizer\md__mypyc.cp310-win_amd64.pydJump to dropped file
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtFile created: C:\Users\user\AppData\Local\Temp\_MEI2802\Crypto\Hash\_ghash_clmul.pydJump to dropped file
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI70002\Crypto\Util\_strxor.pydJump to dropped file
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtFile created: C:\Users\user\AppData\Local\Temp\_MEI2802\Crypto\Hash\_SHA384.pydJump to dropped file
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtFile created: C:\Users\user\AppData\Local\Temp\_MEI45442\win32trace.pydJump to dropped file
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI70002\PIL\_imagingcms.cp310-win_amd64.pydJump to dropped file
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtFile created: C:\Users\user\AppData\Local\Temp\_MEI45442\Crypto\Cipher\_chacha20.pydJump to dropped file
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtFile created: C:\Users\user\AppData\Local\Temp\_MEI2802\_lzma.pydJump to dropped file
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtFile created: C:\Users\user\AppData\Local\Temp\_MEI2802\yarl\_quoting_c.cp310-win_amd64.pydJump to dropped file
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtFile created: C:\Users\user\AppData\Local\Temp\_MEI2802\Crypto\Cipher\_raw_ocb.pydJump to dropped file
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtFile created: C:\Users\user\AppData\Local\Temp\_MEI2802\PIL\_webp.cp310-win_amd64.pydJump to dropped file
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI70002\Crypto\Cipher\_chacha20.pydJump to dropped file
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtFile created: C:\Users\user\AppData\Local\Temp\_MEI45442\frozenlist\_frozenlist.cp310-win_amd64.pydJump to dropped file
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI70002\_asyncio.pydJump to dropped file
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtFile created: C:\Users\user\AppData\Local\Temp\_MEI45442\_bz2.pydJump to dropped file
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI70002\Crypto\Cipher\_raw_cfb.pydJump to dropped file
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtFile created: C:\Users\user\AppData\Local\Temp\_MEI45442\Crypto\Cipher\_raw_cfb.pydJump to dropped file
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtFile created: C:\Users\user\AppData\Local\Temp\_MEI45442\Crypto\Cipher\_raw_aes.pydJump to dropped file
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtFile created: C:\Users\user\AppData\Local\Temp\_MEI45442\Crypto\Util\_strxor.pydJump to dropped file
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI70002\_uuid.pydJump to dropped file
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtFile created: C:\Users\user\AppData\Local\Temp\_MEI2802\Crypto\Cipher\_raw_cbc.pydJump to dropped file
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtFile created: C:\Users\user\AppData\Local\Temp\_MEI2802\_overlapped.pydJump to dropped file
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtFile created: C:\Users\user\AppData\Local\Temp\_MEI2802\Crypto\Protocol\_scrypt.pydJump to dropped file
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI70002\Crypto\Hash\_BLAKE2s.pydJump to dropped file
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtFile created: C:\Users\user\AppData\Local\Temp\_MEI2802\frozenlist\_frozenlist.cp310-win_amd64.pydJump to dropped file
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI70002\select.pydJump to dropped file
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI70002\multidict\_multidict.cp310-win_amd64.pydJump to dropped file
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtFile created: C:\Users\user\AppData\Local\Temp\_MEI2802\Crypto\Cipher\_raw_arc2.pydJump to dropped file
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI70002\Crypto\Cipher\_pkcs1_decode.pydJump to dropped file
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtFile created: C:\Users\user\AppData\Local\Temp\_MEI2802\Crypto\Hash\_BLAKE2s.pydJump to dropped file
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtFile created: C:\Users\user\AppData\Local\Temp\_MEI2802\Crypto\Cipher\_raw_blowfish.pydJump to dropped file
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtFile created: C:\Users\user\AppData\Local\Temp\_MEI2802\_hashlib.pydJump to dropped file
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtFile created: C:\Users\user\AppData\Local\Temp\_MEI2802\Crypto\Hash\_SHA256.pydJump to dropped file
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtFile created: C:\Users\user\AppData\Local\Temp\_MEI45442\Crypto\Hash\_MD2.pydJump to dropped file
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI70002\_win32sysloader.pydJump to dropped file
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI70002\aiohttp\_http_parser.cp310-win_amd64.pydJump to dropped file
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI70002\Crypto\Hash\_keccak.pydJump to dropped file
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI70002\Crypto\Hash\_ghash_clmul.pydJump to dropped file
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtFile created: C:\Users\user\AppData\Local\Temp\_MEI2802\pyexpat.pydJump to dropped file
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtFile created: C:\Users\user\AppData\Local\Temp\_MEI45442\Crypto\Cipher\_raw_des.pydJump to dropped file
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI70002\win32trace.pydJump to dropped file
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI70002\Crypto\Cipher\_raw_blowfish.pydJump to dropped file
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtFile created: C:\Users\user\AppData\Local\Temp\_MEI2802\Crypto\Cipher\_pkcs1_decode.pydJump to dropped file
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtFile created: C:\Users\user\AppData\Local\Temp\_MEI45442\win32crypt.pydJump to dropped file
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtFile created: C:\Users\user\AppData\Local\Temp\_MEI2802\Crypto\Cipher\_Salsa20.pydJump to dropped file
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtFile created: C:\Users\user\AppData\Local\Temp\_MEI45442\Crypto\Cipher\_raw_cbc.pydJump to dropped file
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI70002\_sqlite3.pydJump to dropped file
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI70002\Crypto\Cipher\_raw_cbc.pydJump to dropped file
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI70002\unicodedata.pydJump to dropped file
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtFile created: C:\Users\user\AppData\Local\Temp\_MEI2802\aiohttp\_helpers.cp310-win_amd64.pydJump to dropped file
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtFile created: C:\Users\user\AppData\Local\Temp\_MEI2802\win32com\shell\shell.pydJump to dropped file
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtFile created: C:\Users\user\AppData\Local\Temp\_MEI45442\Crypto\Util\_cpuid_c.pydJump to dropped file
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI70002\Crypto\Hash\_SHA1.pydJump to dropped file
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI70002\win32api.pydJump to dropped file
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI70002\Crypto\Cipher\_raw_des.pydJump to dropped file
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtFile created: C:\Users\user\AppData\Local\Temp\_MEI2802\_bz2.pydJump to dropped file
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtFile created: C:\Users\user\AppData\Local\Temp\_MEI2802\Crypto\Hash\_SHA224.pydJump to dropped file
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI70002\Crypto\Hash\_RIPEMD160.pydJump to dropped file
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtFile created: C:\Users\user\AppData\Local\Temp\_MEI45442\pyexpat.pydJump to dropped file
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtFile created: C:\Users\user\AppData\Local\Temp\_MEI2802\Crypto\Hash\_poly1305.pydJump to dropped file
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI70002\Crypto\Hash\_SHA512.pydJump to dropped file
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtFile created: C:\Users\user\AppData\Local\Temp\_MEI45442\Crypto\PublicKey\_ed448.pydJump to dropped file
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI70002\Crypto\PublicKey\_ed25519.pydJump to dropped file
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI70002\_multiprocessing.pydJump to dropped file
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtFile created: C:\Users\user\AppData\Local\Temp\_MEI45442\Crypto\Math\_modexp.pydJump to dropped file
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtFile created: C:\Users\user\AppData\Local\Temp\_MEI2802\Crypto\Hash\_SHA1.pydJump to dropped file
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI70002\_decimal.pydJump to dropped file
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtFile created: C:\Users\user\AppData\Local\Temp\_MEI2802\Crypto\Math\_modexp.pydJump to dropped file
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtFile created: C:\Users\user\AppData\Local\Temp\_MEI2802\libssl-1_1.dllJump to dropped file
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI70002\Crypto\Hash\_BLAKE2b.pydJump to dropped file
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI70002\Crypto\Math\_modexp.pydJump to dropped file
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtFile created: C:\Users\user\AppData\Local\Temp\_MEI2802\Crypto\Hash\_MD2.pydJump to dropped file
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI70002\Crypto\Cipher\_raw_cast.pydJump to dropped file
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtFile created: C:\Users\user\AppData\Local\Temp\_MEI2802\PIL\_imagingcms.cp310-win_amd64.pydJump to dropped file
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI70002\Crypto\PublicKey\_ec_ws.pydJump to dropped file
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI70002\Crypto\PublicKey\_x25519.pydJump to dropped file
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtFile created: C:\Users\user\AppData\Local\Temp\_MEI45442\Crypto\Cipher\_raw_blowfish.pydJump to dropped file
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI70002\Crypto\Hash\_MD5.pydJump to dropped file
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtFile created: C:\Users\user\AppData\Local\Temp\_MEI45442\aiohttp\_http_writer.cp310-win_amd64.pydJump to dropped file
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI70002\PIL\_imagingft.cp310-win_amd64.pydJump to dropped file
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI70002\frozenlist\_frozenlist.cp310-win_amd64.pydJump to dropped file
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtFile created: C:\Users\user\AppData\Local\Temp\_MEI45442\Crypto\Hash\_ghash_clmul.pydJump to dropped file
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtFile created: C:\Users\user\AppData\Local\Temp\_MEI45442\PIL\_imagingtk.cp310-win_amd64.pydJump to dropped file
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtFile created: C:\Users\user\AppData\Local\Temp\_MEI45442\_multiprocessing.pydJump to dropped file
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtFile created: C:\Users\user\AppData\Local\Temp\_MEI45442\Crypto\Protocol\_scrypt.pydJump to dropped file
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtFile created: C:\Users\user\AppData\Local\Temp\_MEI2802\Crypto\Cipher\_chacha20.pydJump to dropped file
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtFile created: C:\Users\user\AppData\Local\Temp\_MEI2802\aiohttp\_http_writer.cp310-win_amd64.pydJump to dropped file
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtFile created: C:\Users\user\AppData\Local\Temp\_MEI45442\pythoncom310.dllJump to dropped file
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtFile created: C:\Users\user\AppData\Local\Temp\_MEI2802\Crypto\Cipher\_raw_aes.pydJump to dropped file
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtFile created: C:\Users\user\AppData\Local\Temp\_MEI2802\aiohttp\_http_parser.cp310-win_amd64.pydJump to dropped file
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtFile created: C:\Users\user\AppData\Local\Temp\_MEI2802\psutil\_psutil_windows.pydJump to dropped file
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI70002\Crypto\Cipher\_raw_des3.pydJump to dropped file
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtFile created: C:\Users\user\AppData\Local\Temp\_MEI2802\win32ui.pydJump to dropped file
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtFile created: C:\Users\user\AppData\Local\Temp\_MEI45442\python310.dllJump to dropped file
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtFile created: C:\Users\user\AppData\Local\Temp\_MEI2802\pywintypes310.dllJump to dropped file
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtFile created: C:\Users\user\AppData\Local\Temp\_MEI45442\aiohttp\_http_parser.cp310-win_amd64.pydJump to dropped file
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtFile created: C:\Users\user\AppData\Local\Temp\_MEI2802\_ctypes.pydJump to dropped file
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtFile created: C:\Users\user\AppData\Local\Temp\_MEI45442\Crypto\Hash\_SHA256.pydJump to dropped file
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI70002\Crypto\Hash\_MD2.pydJump to dropped file
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtFile created: C:\Users\user\AppData\Local\Temp\_MEI2802\python3.dllJump to dropped file
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI70002\python310.dllJump to dropped file
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI70002\libssl-1_1.dllJump to dropped file
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI70002\Crypto\Cipher\_raw_arc2.pydJump to dropped file
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtFile created: C:\Users\user\AppData\Local\Temp\_MEI2802\VCRUNTIME140_1.dllJump to dropped file
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtFile created: C:\Users\user\AppData\Local\Temp\_MEI2802\Crypto\Cipher\_raw_aesni.pydJump to dropped file
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtFile created: C:\Users\user\AppData\Local\Temp\_MEI2802\propcache\_helpers_c.cp310-win_amd64.pydJump to dropped file
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtFile created: C:\Users\user\AppData\Local\Temp\_MEI2802\_multiprocessing.pydJump to dropped file
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI70002\pywintypes310.dllJump to dropped file
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtFile created: C:\Users\user\AppData\Local\Temp\_MEI45442\Crypto\Hash\_SHA512.pydJump to dropped file
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtFile created: C:\Users\user\AppData\Local\Temp\_MEI2802\win32api.pydJump to dropped file
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtFile created: C:\Users\user\AppData\Local\Temp\_MEI45442\Crypto\Hash\_ghash_portable.pydJump to dropped file
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI70002\VCRUNTIME140_1.dllJump to dropped file
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtFile created: C:\Users\user\AppData\Local\Temp\_MEI45442\_hashlib.pydJump to dropped file
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtFile created: C:\Users\user\AppData\Local\Temp\_MEI45442\Crypto\Cipher\_raw_ofb.pydJump to dropped file
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtFile created: C:\Users\user\AppData\Local\Temp\_MEI45442\_ctypes.pydJump to dropped file
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtFile created: C:\Users\user\AppData\Local\Temp\_MEI45442\PIL\_imagingcms.cp310-win_amd64.pydJump to dropped file
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI70002\Crypto\Cipher\_raw_aes.pydJump to dropped file
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI70002\win32crypt.pydJump to dropped file
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtFile created: C:\Users\user\AppData\Local\Temp\_MEI2802\Crypto\Hash\_MD5.pydJump to dropped file
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI70002\pythoncom310.dllJump to dropped file
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtFile created: C:\Users\user\AppData\Local\Temp\_MEI45442\PIL\_imaging.cp310-win_amd64.pydJump to dropped file
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI70002\Crypto\Cipher\_raw_ofb.pydJump to dropped file
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtFile created: C:\Users\user\AppData\Local\Temp\_MEI45442\win32ui.pydJump to dropped file
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI70002\psutil\_psutil_windows.pydJump to dropped file
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtFile created: C:\Users\user\AppData\Local\Temp\_MEI45442\Crypto\Hash\_MD5.pydJump to dropped file
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI70002\_ssl.pydJump to dropped file
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtFile created: C:\Users\user\AppData\Local\Temp\_MEI2802\Crypto\Hash\_ghash_portable.pydJump to dropped file
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtFile created: C:\Users\user\AppData\Local\Temp\_MEI45442\select.pydJump to dropped file
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtFile created: C:\Users\user\AppData\Local\Temp\_MEI45442\Crypto\Hash\_keccak.pydJump to dropped file
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtFile created: C:\Users\user\AppData\Local\Temp\_MEI2802\_uuid.pydJump to dropped file
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtFile created: C:\Users\user\AppData\Local\Temp\_MEI45442\libffi-7.dllJump to dropped file
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI70002\Crypto\Cipher\_raw_aesni.pydJump to dropped file
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtFile created: C:\Users\user\AppData\Local\Temp\_MEI2802\_sqlite3.pydJump to dropped file
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtFile created: C:\Users\user\AppData\Local\Temp\_MEI45442\Crypto\Hash\_poly1305.pydJump to dropped file
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtFile created: C:\Users\user\AppData\Local\Temp\_MEI2802\Crypto\PublicKey\_ec_ws.pydJump to dropped file
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtFile created: C:\Users\user\AppData\Local\Temp\_MEI2802\Crypto\Cipher\_raw_cast.pydJump to dropped file
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtFile created: C:\Users\user\AppData\Local\Temp\_MEI45442\charset_normalizer\md.cp310-win_amd64.pydJump to dropped file
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtFile created: C:\Users\user\AppData\Local\Temp\_MEI2802\PIL\_imaging.cp310-win_amd64.pydJump to dropped file
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtFile created: C:\Users\user\AppData\Local\Temp\_MEI45442\Crypto\Cipher\_raw_ctr.pydJump to dropped file
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtFile created: C:\Users\user\AppData\Local\Temp\_MEI2802\Crypto\Cipher\_raw_eksblowfish.pydJump to dropped file
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtFile created: C:\Users\user\AppData\Local\Temp\_MEI2802\multidict\_multidict.cp310-win_amd64.pydJump to dropped file
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtFile created: C:\Users\user\AppData\Local\Temp\_MEI45442\Crypto\Hash\_SHA224.pydJump to dropped file
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtFile created: C:\Users\user\AppData\Local\Temp\_MEI45442\multidict\_multidict.cp310-win_amd64.pydJump to dropped file
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtFile created: C:\Users\user\AppData\Local\Temp\_MEI45442\_queue.pydJump to dropped file
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtFile created: C:\Users\user\AppData\Local\Temp\_MEI2802\Crypto\PublicKey\_ed448.pydJump to dropped file
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtFile created: C:\Users\user\AppData\Local\Temp\_MEI2802\Crypto\Util\_strxor.pydJump to dropped file
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI70002\_hashlib.pydJump to dropped file
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtFile created: C:\Users\user\AppData\Local\Temp\_MEI45442\Crypto\Cipher\_raw_ecb.pydJump to dropped file
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtFile created: C:\Users\user\AppData\Local\Temp\_MEI2802\Crypto\Hash\_BLAKE2b.pydJump to dropped file
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtFile created: C:\Users\user\AppData\Local\Temp\_MEI45442\VCRUNTIME140_1.dllJump to dropped file
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtFile created: C:\Users\user\AppData\Local\Temp\_MEI45442\win32com\shell\shell.pydJump to dropped file
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI70002\PIL\_imaging.cp310-win_amd64.pydJump to dropped file
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtFile created: C:\Users\user\AppData\Local\Temp\_MEI45442\pywintypes310.dllJump to dropped file
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI70002\Crypto\Cipher\_raw_eksblowfish.pydJump to dropped file
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtFile created: C:\Users\user\AppData\Local\Temp\_MEI2802\_decimal.pydJump to dropped file
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtFile created: C:\Users\user\AppData\Local\Temp\_MEI2802\aiohttp\_websocket.cp310-win_amd64.pydJump to dropped file
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtFile created: C:\Users\user\AppData\Local\Temp\_MEI45442\Crypto\Cipher\_raw_aesni.pydJump to dropped file
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtFile created: C:\Users\user\AppData\Local\Temp\_MEI2802\_socket.pydJump to dropped file
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtFile created: C:\Users\user\AppData\Local\Temp\_MEI45442\Crypto\Cipher\_pkcs1_decode.pydJump to dropped file
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtFile created: C:\Users\user\AppData\Local\Temp\_MEI45442\aiohttp\_websocket.cp310-win_amd64.pydJump to dropped file
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtFile created: C:\Users\user\AppData\Local\Temp\_MEI45442\python3.dllJump to dropped file
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtFile created: C:\Users\user\AppData\Local\Temp\_MEI2802\Crypto\Cipher\_raw_des3.pydJump to dropped file
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI70002\Crypto\Cipher\_raw_ctr.pydJump to dropped file
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtFile created: C:\Users\user\AppData\Local\Temp\_MEI45442\yarl\_quoting_c.cp310-win_amd64.pydJump to dropped file
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI70002\propcache\_helpers_c.cp310-win_amd64.pydJump to dropped file
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtFile created: C:\Users\user\AppData\Local\Temp\_MEI45442\Crypto\Hash\_SHA384.pydJump to dropped file
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtFile created: C:\Users\user\AppData\Local\Temp\_MEI45442\_overlapped.pydJump to dropped file
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI70002\libcrypto-1_1.dllJump to dropped file
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtFile created: C:\Users\user\AppData\Local\Temp\_MEI45442\Crypto\Cipher\_ARC4.pydJump to dropped file
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI70002\_ctypes.pydJump to dropped file
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI70002\win32ui.pydJump to dropped file
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI70002\charset_normalizer\md.cp310-win_amd64.pydJump to dropped file
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtFile created: C:\Users\user\AppData\Local\Temp\_MEI45442\_ssl.pydJump to dropped file
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtFile created: C:\Users\user\AppData\Local\Temp\_MEI2802\Crypto\Hash\_keccak.pydJump to dropped file
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtFile created: C:\Users\user\AppData\Local\Temp\_MEI2802\_asyncio.pydJump to dropped file
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtFile created: C:\Users\user\AppData\Local\Temp\_MEI45442\_asyncio.pydJump to dropped file
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtFile created: C:\Users\user\AppData\Local\Temp\_MEI45442\Crypto\Hash\_BLAKE2s.pydJump to dropped file
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI70002\Crypto\Util\_cpuid_c.pydJump to dropped file
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtFile created: C:\Users\user\AppData\Local\Temp\_MEI2802\Crypto\PublicKey\_x25519.pydJump to dropped file
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI70002\Crypto\Hash\_SHA256.pydJump to dropped file
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtFile created: C:\Users\user\AppData\Local\Temp\_MEI45442\aiohttp\_helpers.cp310-win_amd64.pydJump to dropped file
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtFile created: C:\Users\user\AppData\Local\Temp\_MEI2802\_win32sysloader.pydJump to dropped file
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtFile created: C:\Users\user\AppData\Local\Temp\_MEI45442\Crypto\Hash\_SHA1.pydJump to dropped file
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtFile created: C:\Users\user\AppData\Local\Temp\_MEI45442\propcache\_helpers_c.cp310-win_amd64.pydJump to dropped file
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtFile created: C:\Users\user\AppData\Local\Temp\_MEI2802\VCRUNTIME140.dllJump to dropped file
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI70002\Crypto\Hash\_SHA384.pydJump to dropped file
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtFile created: C:\Users\user\AppData\Local\Temp\_MEI45442\PIL\_imagingft.cp310-win_amd64.pydJump to dropped file
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtFile created: C:\Users\user\AppData\Local\Temp\_MEI2802\Crypto\Util\_cpuid_c.pydJump to dropped file
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtFile created: C:\Users\user\AppData\Local\Temp\_MEI45442\Crypto\Hash\_MD4.pydJump to dropped file
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtFile created: C:\Users\user\AppData\Local\Temp\_MEI45442\_socket.pydJump to dropped file
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtFile created: C:\Users\user\AppData\Local\Temp\_MEI45442\_decimal.pydJump to dropped file
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtFile created: C:\Users\user\AppData\Local\Temp\_MEI45442\libcrypto-1_1.dllJump to dropped file
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI70002\Crypto\Cipher\_raw_ecb.pydJump to dropped file
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtFile created: C:\Users\user\AppData\Local\Temp\_MEI2802\Crypto\Cipher\_raw_ctr.pydJump to dropped file
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtFile created: C:\Users\user\AppData\Local\Temp\_MEI2802\charset_normalizer\md.cp310-win_amd64.pydJump to dropped file
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI70002\charset_normalizer\md__mypyc.cp310-win_amd64.pydJump to dropped file
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtFile created: C:\Users\user\AppData\Local\Temp\_MEI2802\Crypto\Hash\_SHA512.pydJump to dropped file
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtFile created: C:\Users\user\AppData\Local\Temp\_MEI2802\Crypto\Hash\_MD4.pydJump to dropped file
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI70002\aiohttp\_websocket.cp310-win_amd64.pydJump to dropped file
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtFile created: C:\Users\user\AppData\Local\Temp\_MEI45442\Crypto\PublicKey\_x25519.pydJump to dropped file
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI70002\Crypto\Hash\_SHA224.pydJump to dropped file
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeFile created: C:\Users\user\AppData\Roaming\empyrean\dat.txtJump to dropped file
                Source: C:\Windows\System32\reg.exeRegistry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run empyreanJump to behavior
                Source: C:\Windows\System32\reg.exeRegistry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run empyreanJump to behavior
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeCode function: 0_2_00007FF619BC3DD0 GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,0_2_00007FF619BC3DD0
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\System32\wbem\WMIC.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\System32\wbem\WMIC.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\System32\wbem\WMIC.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\System32\cmd.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtProcess information set: NOOPENFILEERRORBOX
                Source: C:\Windows\System32\cmd.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtProcess information set: NOOPENFILEERRORBOX
                Source: C:\Windows\System32\wbem\WMIC.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Windows\System32\wbem\WMIC.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Windows\System32\wbem\WMIC.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Windows\System32\wbem\WMIC.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Windows\System32\wbem\WMIC.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Windows\System32\wbem\WMIC.exeProcess information set: NOOPENFILEERRORBOX

                Malware Analysis System Evasion

                barindex
                Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_VideoController
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_VideoController
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_VideoController
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_VideoController
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_VideoController
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_VideoController
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_VideoController
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_VideoController
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_VideoController
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtCode function: 26_2_00007FFDFB23572C rdtsc 26_2_00007FFDFB23572C
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI2802\python310.dllJump to dropped file
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI45442\PIL\_webp.cp310-win_amd64.pydJump to dropped file
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI70002\Crypto\PublicKey\_ed448.pydJump to dropped file
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI45442\Crypto\Cipher\_raw_eksblowfish.pydJump to dropped file
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI70002\_overlapped.pydJump to dropped file
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI70002\mfc140u.dllJump to dropped file
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI2802\select.pydJump to dropped file
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI45442\_uuid.pydJump to dropped file
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI2802\pythoncom310.dllJump to dropped file
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI2802\Crypto\Cipher\_raw_ofb.pydJump to dropped file
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI45442\Crypto\Cipher\_raw_ocb.pydJump to dropped file
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI45442\unicodedata.pydJump to dropped file
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI2802\win32trace.pydJump to dropped file
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI45442\Crypto\PublicKey\_ec_ws.pydJump to dropped file
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI2802\Crypto\Cipher\_raw_ecb.pydJump to dropped file
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI70002\Crypto\Protocol\_scrypt.pydJump to dropped file
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI45442\_lzma.pydJump to dropped file
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI2802\Crypto\Cipher\_raw_des.pydJump to dropped file
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI2802\_ssl.pydJump to dropped file
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI70002\Crypto\Hash\_poly1305.pydJump to dropped file
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI45442\mfc140u.dllJump to dropped file
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI2802\unicodedata.pydJump to dropped file
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI2802\Crypto\Hash\_RIPEMD160.pydJump to dropped file
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI70002\_bz2.pydJump to dropped file
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI45442\Crypto\Cipher\_raw_cast.pydJump to dropped file
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI70002\aiohttp\_http_writer.cp310-win_amd64.pydJump to dropped file
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI45442\Crypto\Cipher\_raw_arc2.pydJump to dropped file
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI45442\_win32sysloader.pydJump to dropped file
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI45442\charset_normalizer\md__mypyc.cp310-win_amd64.pydJump to dropped file
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI2802\mfc140u.dllJump to dropped file
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI2802\Crypto\Cipher\_ARC4.pydJump to dropped file
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI45442\Crypto\Cipher\_raw_des3.pydJump to dropped file
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI2802\Crypto\PublicKey\_ed25519.pydJump to dropped file
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI70002\Crypto\Cipher\_Salsa20.pydJump to dropped file
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI70002\_lzma.pydJump to dropped file
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI70002\_queue.pydJump to dropped file
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI70002\Crypto\Hash\_ghash_portable.pydJump to dropped file
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI45442\psutil\_psutil_windows.pydJump to dropped file
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI2802\PIL\_imagingft.cp310-win_amd64.pydJump to dropped file
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI45442\Crypto\Hash\_BLAKE2b.pydJump to dropped file
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI70002\Crypto\Cipher\_raw_ocb.pydJump to dropped file
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI70002\yarl\_quoting_c.cp310-win_amd64.pydJump to dropped file
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI2802\Crypto\Cipher\_raw_cfb.pydJump to dropped file
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI70002\PIL\_webp.cp310-win_amd64.pydJump to dropped file
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI70002\Crypto\Hash\_MD4.pydJump to dropped file
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI70002\aiohttp\_helpers.cp310-win_amd64.pydJump to dropped file
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI2802\win32crypt.pydJump to dropped file
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI45442\Crypto\Cipher\_Salsa20.pydJump to dropped file
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI70002\_socket.pydJump to dropped file
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI70002\PIL\_imagingtk.cp310-win_amd64.pydJump to dropped file
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI70002\Crypto\Cipher\_ARC4.pydJump to dropped file
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI45442\win32api.pydJump to dropped file
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI2802\_queue.pydJump to dropped file
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI45442\_sqlite3.pydJump to dropped file
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI45442\Crypto\PublicKey\_ed25519.pydJump to dropped file
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI70002\pyexpat.pydJump to dropped file
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI45442\Crypto\Hash\_RIPEMD160.pydJump to dropped file
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI2802\PIL\_imagingtk.cp310-win_amd64.pydJump to dropped file
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI70002\win32com\shell\shell.pydJump to dropped file
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI70002\python3.dllJump to dropped file
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI2802\charset_normalizer\md__mypyc.cp310-win_amd64.pydJump to dropped file
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI2802\Crypto\Hash\_ghash_clmul.pydJump to dropped file
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI70002\Crypto\Util\_strxor.pydJump to dropped file
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI2802\Crypto\Hash\_SHA384.pydJump to dropped file
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI45442\win32trace.pydJump to dropped file
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI70002\PIL\_imagingcms.cp310-win_amd64.pydJump to dropped file
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI45442\Crypto\Cipher\_chacha20.pydJump to dropped file
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI2802\_lzma.pydJump to dropped file
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI2802\yarl\_quoting_c.cp310-win_amd64.pydJump to dropped file
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI2802\PIL\_webp.cp310-win_amd64.pydJump to dropped file
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI2802\Crypto\Cipher\_raw_ocb.pydJump to dropped file
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI70002\Crypto\Cipher\_chacha20.pydJump to dropped file
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI70002\_asyncio.pydJump to dropped file
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI45442\frozenlist\_frozenlist.cp310-win_amd64.pydJump to dropped file
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI45442\_bz2.pydJump to dropped file
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI70002\Crypto\Cipher\_raw_cfb.pydJump to dropped file
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI45442\Crypto\Cipher\_raw_cfb.pydJump to dropped file
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI45442\Crypto\Cipher\_raw_aes.pydJump to dropped file
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI45442\Crypto\Util\_strxor.pydJump to dropped file
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI70002\_uuid.pydJump to dropped file
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI2802\Crypto\Cipher\_raw_cbc.pydJump to dropped file
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI2802\_overlapped.pydJump to dropped file
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI2802\Crypto\Protocol\_scrypt.pydJump to dropped file
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI70002\Crypto\Hash\_BLAKE2s.pydJump to dropped file
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI2802\frozenlist\_frozenlist.cp310-win_amd64.pydJump to dropped file
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI70002\select.pydJump to dropped file
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI70002\multidict\_multidict.cp310-win_amd64.pydJump to dropped file
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI2802\Crypto\Cipher\_raw_arc2.pydJump to dropped file
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI2802\Crypto\Hash\_BLAKE2s.pydJump to dropped file
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI70002\Crypto\Cipher\_pkcs1_decode.pydJump to dropped file
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI2802\Crypto\Cipher\_raw_blowfish.pydJump to dropped file
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI2802\_hashlib.pydJump to dropped file
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI2802\Crypto\Hash\_SHA256.pydJump to dropped file
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI45442\Crypto\Hash\_MD2.pydJump to dropped file
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI70002\_win32sysloader.pydJump to dropped file
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI70002\aiohttp\_http_parser.cp310-win_amd64.pydJump to dropped file
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI70002\Crypto\Hash\_keccak.pydJump to dropped file
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI70002\Crypto\Hash\_ghash_clmul.pydJump to dropped file
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI2802\pyexpat.pydJump to dropped file
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI45442\Crypto\Cipher\_raw_des.pydJump to dropped file
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI70002\win32trace.pydJump to dropped file
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI70002\Crypto\Cipher\_raw_blowfish.pydJump to dropped file
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI2802\Crypto\Cipher\_pkcs1_decode.pydJump to dropped file
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI45442\win32crypt.pydJump to dropped file
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI2802\Crypto\Cipher\_Salsa20.pydJump to dropped file
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI45442\Crypto\Cipher\_raw_cbc.pydJump to dropped file
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI70002\_sqlite3.pydJump to dropped file
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI70002\Crypto\Cipher\_raw_cbc.pydJump to dropped file
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI70002\unicodedata.pydJump to dropped file
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI2802\aiohttp\_helpers.cp310-win_amd64.pydJump to dropped file
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI2802\win32com\shell\shell.pydJump to dropped file
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI45442\Crypto\Util\_cpuid_c.pydJump to dropped file
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI70002\Crypto\Hash\_SHA1.pydJump to dropped file
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI70002\win32api.pydJump to dropped file
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI70002\Crypto\Cipher\_raw_des.pydJump to dropped file
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI2802\_bz2.pydJump to dropped file
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI2802\Crypto\Hash\_SHA224.pydJump to dropped file
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI70002\Crypto\Hash\_RIPEMD160.pydJump to dropped file
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI2802\Crypto\Hash\_poly1305.pydJump to dropped file
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI45442\pyexpat.pydJump to dropped file
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI45442\Crypto\PublicKey\_ed448.pydJump to dropped file
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI70002\Crypto\Hash\_SHA512.pydJump to dropped file
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI70002\Crypto\PublicKey\_ed25519.pydJump to dropped file
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI70002\_multiprocessing.pydJump to dropped file
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI2802\Crypto\Hash\_SHA1.pydJump to dropped file
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI45442\Crypto\Math\_modexp.pydJump to dropped file
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI70002\_decimal.pydJump to dropped file
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI2802\Crypto\Math\_modexp.pydJump to dropped file
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI70002\Crypto\Hash\_BLAKE2b.pydJump to dropped file
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI70002\Crypto\Math\_modexp.pydJump to dropped file
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI2802\Crypto\Hash\_MD2.pydJump to dropped file
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI70002\Crypto\Cipher\_raw_cast.pydJump to dropped file
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI2802\PIL\_imagingcms.cp310-win_amd64.pydJump to dropped file
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI70002\Crypto\PublicKey\_ec_ws.pydJump to dropped file
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI70002\Crypto\PublicKey\_x25519.pydJump to dropped file
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI45442\Crypto\Cipher\_raw_blowfish.pydJump to dropped file
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI70002\Crypto\Hash\_MD5.pydJump to dropped file
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI45442\aiohttp\_http_writer.cp310-win_amd64.pydJump to dropped file
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI70002\PIL\_imagingft.cp310-win_amd64.pydJump to dropped file
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI70002\frozenlist\_frozenlist.cp310-win_amd64.pydJump to dropped file
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI45442\Crypto\Hash\_ghash_clmul.pydJump to dropped file
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI45442\PIL\_imagingtk.cp310-win_amd64.pydJump to dropped file
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI45442\_multiprocessing.pydJump to dropped file
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI45442\Crypto\Protocol\_scrypt.pydJump to dropped file
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI2802\Crypto\Cipher\_chacha20.pydJump to dropped file
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI2802\aiohttp\_http_writer.cp310-win_amd64.pydJump to dropped file
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI45442\pythoncom310.dllJump to dropped file
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI2802\Crypto\Cipher\_raw_aes.pydJump to dropped file
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI2802\aiohttp\_http_parser.cp310-win_amd64.pydJump to dropped file
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI2802\psutil\_psutil_windows.pydJump to dropped file
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI2802\win32ui.pydJump to dropped file
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI70002\Crypto\Cipher\_raw_des3.pydJump to dropped file
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI45442\python310.dllJump to dropped file
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI2802\pywintypes310.dllJump to dropped file
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI45442\aiohttp\_http_parser.cp310-win_amd64.pydJump to dropped file
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI2802\_ctypes.pydJump to dropped file
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI45442\Crypto\Hash\_SHA256.pydJump to dropped file
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI70002\Crypto\Hash\_MD2.pydJump to dropped file
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI2802\python3.dllJump to dropped file
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI70002\python310.dllJump to dropped file
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI70002\Crypto\Cipher\_raw_arc2.pydJump to dropped file
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI2802\Crypto\Cipher\_raw_aesni.pydJump to dropped file
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI2802\propcache\_helpers_c.cp310-win_amd64.pydJump to dropped file
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI2802\_multiprocessing.pydJump to dropped file
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI70002\pywintypes310.dllJump to dropped file
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI45442\Crypto\Hash\_SHA512.pydJump to dropped file
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI2802\win32api.pydJump to dropped file
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI45442\Crypto\Hash\_ghash_portable.pydJump to dropped file
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI45442\_hashlib.pydJump to dropped file
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI45442\Crypto\Cipher\_raw_ofb.pydJump to dropped file
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI45442\_ctypes.pydJump to dropped file
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI45442\PIL\_imagingcms.cp310-win_amd64.pydJump to dropped file
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI70002\Crypto\Cipher\_raw_aes.pydJump to dropped file
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI70002\win32crypt.pydJump to dropped file
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI2802\Crypto\Hash\_MD5.pydJump to dropped file
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI70002\pythoncom310.dllJump to dropped file
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI45442\PIL\_imaging.cp310-win_amd64.pydJump to dropped file
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI70002\Crypto\Cipher\_raw_ofb.pydJump to dropped file
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI45442\win32ui.pydJump to dropped file
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI45442\Crypto\Hash\_MD5.pydJump to dropped file
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI70002\psutil\_psutil_windows.pydJump to dropped file
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI70002\_ssl.pydJump to dropped file
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI2802\Crypto\Hash\_ghash_portable.pydJump to dropped file
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI45442\select.pydJump to dropped file
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI45442\Crypto\Hash\_keccak.pydJump to dropped file
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI2802\_uuid.pydJump to dropped file
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI70002\Crypto\Cipher\_raw_aesni.pydJump to dropped file
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI2802\_sqlite3.pydJump to dropped file
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI45442\Crypto\Hash\_poly1305.pydJump to dropped file
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI2802\Crypto\PublicKey\_ec_ws.pydJump to dropped file
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI2802\Crypto\Cipher\_raw_cast.pydJump to dropped file
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI45442\charset_normalizer\md.cp310-win_amd64.pydJump to dropped file
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI2802\PIL\_imaging.cp310-win_amd64.pydJump to dropped file
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI45442\Crypto\Cipher\_raw_ctr.pydJump to dropped file
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI2802\Crypto\Cipher\_raw_eksblowfish.pydJump to dropped file
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI2802\multidict\_multidict.cp310-win_amd64.pydJump to dropped file
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI45442\multidict\_multidict.cp310-win_amd64.pydJump to dropped file
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI45442\Crypto\Hash\_SHA224.pydJump to dropped file
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI2802\Crypto\PublicKey\_ed448.pydJump to dropped file
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI45442\_queue.pydJump to dropped file
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI2802\Crypto\Util\_strxor.pydJump to dropped file
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI70002\_hashlib.pydJump to dropped file
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI45442\Crypto\Cipher\_raw_ecb.pydJump to dropped file
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI2802\Crypto\Hash\_BLAKE2b.pydJump to dropped file
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI45442\win32com\shell\shell.pydJump to dropped file
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI70002\PIL\_imaging.cp310-win_amd64.pydJump to dropped file
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI45442\pywintypes310.dllJump to dropped file
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI70002\Crypto\Cipher\_raw_eksblowfish.pydJump to dropped file
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI2802\_decimal.pydJump to dropped file
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI2802\aiohttp\_websocket.cp310-win_amd64.pydJump to dropped file
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI45442\Crypto\Cipher\_raw_aesni.pydJump to dropped file
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI2802\_socket.pydJump to dropped file
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI45442\Crypto\Cipher\_pkcs1_decode.pydJump to dropped file
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI45442\aiohttp\_websocket.cp310-win_amd64.pydJump to dropped file
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI45442\python3.dllJump to dropped file
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI2802\Crypto\Cipher\_raw_des3.pydJump to dropped file
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI45442\yarl\_quoting_c.cp310-win_amd64.pydJump to dropped file
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI70002\Crypto\Cipher\_raw_ctr.pydJump to dropped file
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI45442\Crypto\Hash\_SHA384.pydJump to dropped file
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI70002\propcache\_helpers_c.cp310-win_amd64.pydJump to dropped file
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI45442\_overlapped.pydJump to dropped file
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI45442\Crypto\Cipher\_ARC4.pydJump to dropped file
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI70002\_ctypes.pydJump to dropped file
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI70002\win32ui.pydJump to dropped file
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI70002\charset_normalizer\md.cp310-win_amd64.pydJump to dropped file
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI45442\_ssl.pydJump to dropped file
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI2802\Crypto\Hash\_keccak.pydJump to dropped file
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI2802\_asyncio.pydJump to dropped file
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI45442\_asyncio.pydJump to dropped file
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI45442\Crypto\Hash\_BLAKE2s.pydJump to dropped file
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI2802\Crypto\PublicKey\_x25519.pydJump to dropped file
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI70002\Crypto\Util\_cpuid_c.pydJump to dropped file
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI45442\aiohttp\_helpers.cp310-win_amd64.pydJump to dropped file
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI70002\Crypto\Hash\_SHA256.pydJump to dropped file
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI2802\_win32sysloader.pydJump to dropped file
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI45442\Crypto\Hash\_SHA1.pydJump to dropped file
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI45442\propcache\_helpers_c.cp310-win_amd64.pydJump to dropped file
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI70002\Crypto\Hash\_SHA384.pydJump to dropped file
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI45442\PIL\_imagingft.cp310-win_amd64.pydJump to dropped file
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI2802\Crypto\Util\_cpuid_c.pydJump to dropped file
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI45442\Crypto\Hash\_MD4.pydJump to dropped file
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI45442\_socket.pydJump to dropped file
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI45442\_decimal.pydJump to dropped file
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI70002\Crypto\Cipher\_raw_ecb.pydJump to dropped file
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI2802\Crypto\Cipher\_raw_ctr.pydJump to dropped file
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI2802\charset_normalizer\md.cp310-win_amd64.pydJump to dropped file
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI2802\Crypto\Hash\_SHA512.pydJump to dropped file
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI70002\charset_normalizer\md__mypyc.cp310-win_amd64.pydJump to dropped file
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI2802\Crypto\Hash\_MD4.pydJump to dropped file
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI70002\aiohttp\_websocket.cp310-win_amd64.pydJump to dropped file
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI45442\Crypto\PublicKey\_x25519.pydJump to dropped file
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI70002\Crypto\Hash\_SHA224.pydJump to dropped file
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeCheck user administrative privileges: GetTokenInformation,DecisionNodesgraph_0-16203
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeAPI coverage: 6.7 %
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtAPI coverage: 5.7 %
                Source: C:\Windows\System32\reg.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BIOS
                Source: C:\Windows\System32\reg.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BIOS
                Source: C:\Windows\System32\reg.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_ComputerSystem
                Source: C:\Windows\System32\reg.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_ComputerSystem
                Source: C:\Windows\System32\wbem\WMIC.exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT UUID FROM Win32_ComputerSystemProduct
                Source: C:\Windows\System32\wbem\WMIC.exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT UUID FROM Win32_ComputerSystemProduct
                Source: C:\Windows\System32\wbem\WMIC.exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT UUID FROM Win32_ComputerSystemProduct
                Source: C:\Windows\System32\cmd.exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT UUID FROM Win32_ComputerSystemProduct
                Source: C:\Windows\System32\wbem\WMIC.exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT UUID FROM Win32_ComputerSystemProduct
                Source: C:\Windows\System32\cmd.exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT UUID FROM Win32_ComputerSystemProduct
                Source: C:\Windows\System32\wbem\WMIC.exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT UUID FROM Win32_ComputerSystemProduct
                Source: C:\Windows\System32\wbem\WMIC.exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT UUID FROM Win32_ComputerSystemProduct
                Source: C:\Windows\System32\wbem\WMIC.exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT UUID FROM Win32_ComputerSystemProduct
                Source: C:\Windows\System32\wbem\WMIC.exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT UUID FROM Win32_ComputerSystemProduct
                Source: C:\Windows\System32\wbem\WMIC.exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT UUID FROM Win32_ComputerSystemProduct
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
                Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
                Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
                Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
                Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
                Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
                Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
                Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
                Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
                Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
                Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
                Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
                Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
                Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
                Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeFile Volume queried: C:\ FullSizeInformationJump to behavior
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeFile Volume queried: C:\ FullSizeInformationJump to behavior
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtFile Volume queried: C:\ FullSizeInformation
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtFile Volume queried: C:\ FullSizeInformation
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtFile Volume queried: C:\ FullSizeInformation
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtFile Volume queried: C:\ FullSizeInformation
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeCode function: 0_2_00007FF619BD64A4 _invalid_parameter_noinfo,FindFirstFileExW,GetLastError,_invalid_parameter_noinfo,FindNextFileW,GetLastError,0_2_00007FF619BD64A4
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeCode function: 0_2_00007FF619BC7780 FindFirstFileExW,FindClose,0_2_00007FF619BC7780
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeCode function: 0_2_00007FF619BE0CE4 _invalid_parameter_noinfo,FindFirstFileExW,FindNextFileW,FindClose,FindClose,0_2_00007FF619BE0CE4
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeCode function: 0_2_00007FF619BD64A4 _invalid_parameter_noinfo,FindFirstFileExW,GetLastError,_invalid_parameter_noinfo,FindNextFileW,GetLastError,0_2_00007FF619BD64A4
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeCode function: 1_2_00007FF619BE0CE4 _invalid_parameter_noinfo,FindFirstFileExW,FindNextFileW,FindClose,FindClose,1_2_00007FF619BE0CE4
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeCode function: 1_2_00007FF619BD64A4 _invalid_parameter_noinfo,FindFirstFileExW,GetLastError,_invalid_parameter_noinfo,FindNextFileW,GetLastError,1_2_00007FF619BD64A4
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeCode function: 1_2_00007FF619BD64A4 _invalid_parameter_noinfo,FindFirstFileExW,GetLastError,_invalid_parameter_noinfo,FindNextFileW,GetLastError,1_2_00007FF619BD64A4
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeCode function: 1_2_00007FF619BC7780 FindFirstFileExW,FindClose,1_2_00007FF619BC7780
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeCode function: 1_2_00007FFDFB0C3229 MultiByteToWideChar,GetLastError,MultiByteToWideChar,MultiByteToWideChar,00007FFE1FF9F020,FindFirstFileW,FindNextFileW,WideCharToMultiByte,1_2_00007FFDFB0C3229
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtCode function: 25_2_00007FF670A864A4 _invalid_parameter_noinfo,FindFirstFileExW,GetLastError,_invalid_parameter_noinfo,FindNextFileW,GetLastError,25_2_00007FF670A864A4
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtCode function: 25_2_00007FF670A77780 FindFirstFileExW,FindClose,25_2_00007FF670A77780
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtCode function: 25_2_00007FF670A90CE4 _invalid_parameter_noinfo,FindFirstFileExW,FindNextFileW,FindClose,FindClose,25_2_00007FF670A90CE4
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtCode function: 25_2_00007FF670A864A4 _invalid_parameter_noinfo,FindFirstFileExW,GetLastError,_invalid_parameter_noinfo,FindNextFileW,GetLastError,25_2_00007FF670A864A4
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtCode function: 26_2_00007FF670A90CE4 _invalid_parameter_noinfo,FindFirstFileExW,FindNextFileW,FindClose,FindClose,26_2_00007FF670A90CE4
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtCode function: 26_2_00007FF670A864A4 _invalid_parameter_noinfo,FindFirstFileExW,GetLastError,_invalid_parameter_noinfo,FindNextFileW,GetLastError,26_2_00007FF670A864A4
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtCode function: 26_2_00007FF670A864A4 _invalid_parameter_noinfo,FindFirstFileExW,GetLastError,_invalid_parameter_noinfo,FindNextFileW,GetLastError,26_2_00007FF670A864A4
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtCode function: 26_2_00007FF670A77780 FindFirstFileExW,FindClose,26_2_00007FF670A77780
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtCode function: 26_2_00007FFDFB233229 MultiByteToWideChar,GetLastError,MultiByteToWideChar,MultiByteToWideChar,00007FFE1FF9F020,FindFirstFileW,FindNextFileW,WideCharToMultiByte,26_2_00007FFDFB233229
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeCode function: 1_2_00007FFDFAE2F820 GetSystemInfo,1_2_00007FFDFAE2F820
                Source: NEVER OPEN!.exe, 00000000.00000003.1731893252.0000027663DF9000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: j2aTPs+9xYa9+bG3tD60B8jzljHz7aRP+KNOjSkVWLjVb3/ubCK1sK9IRQq9qEmU
                Source: NEVER OPEN!.exe, 00000001.00000003.1876497591.000001F095CA0000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000003.1876718078.000001F095CAB000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000003.1868292392.000001F095C9E000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000002.1882319970.000001F095CAC000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V RAWwork%SystemRoot%\system32\mswsock.dllThe connection has been reset.
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeProcess information queried: ProcessInformationJump to behavior

                Anti Debugging

                barindex
                Potentially malicious time measurement code found
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtCode function: 26_2_00007FFDFB23572C26_2_00007FFDFB23572C
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtCode function: 26_2_00007FFDFB23572C rdtsc 26_2_00007FFDFB23572C
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeCode function: 0_2_00007FF619BD9E30 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,0_2_00007FF619BD9E30
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeCode function: 1_2_00007FFDFAE0F920 EntryPoint,LoadLibraryA,GetProcAddress,VirtualProtect,VirtualProtect,VirtualProtect,1_2_00007FFDFAE0F920
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeCode function: 0_2_00007FF619BE28B0 GetProcessHeap,0_2_00007FF619BE28B0
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeProcess token adjusted: DebugJump to behavior
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeProcess token adjusted: DebugJump to behavior
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeCode function: 0_2_00007FF619BD9E30 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,0_2_00007FF619BD9E30
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeCode function: 0_2_00007FF619BCB5CC IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,0_2_00007FF619BCB5CC
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeCode function: 0_2_00007FF619BCAFB4 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,0_2_00007FF619BCAFB4
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeCode function: 0_2_00007FF619BCB7B0 SetUnhandledExceptionFilter,0_2_00007FF619BCB7B0
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeCode function: 1_2_00007FF619BD9E30 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,1_2_00007FF619BD9E30
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeCode function: 1_2_00007FF619BCB5CC IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,1_2_00007FF619BCB5CC
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeCode function: 1_2_00007FF619BCAFB4 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,1_2_00007FF619BCAFB4
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeCode function: 1_2_00007FF619BCB7B0 SetUnhandledExceptionFilter,1_2_00007FF619BCB7B0
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeCode function: 1_2_00007FFDFAFA3048 IsProcessorFeaturePresent,00007FFE1A4519C0,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,00007FFE1A4519C0,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,1_2_00007FFDFAFA3048
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtCode function: 25_2_00007FF670A7B5CC IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,25_2_00007FF670A7B5CC
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtCode function: 25_2_00007FF670A89E30 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,25_2_00007FF670A89E30
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtCode function: 25_2_00007FF670A7AFB4 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,25_2_00007FF670A7AFB4
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtCode function: 25_2_00007FF670A7B7B0 SetUnhandledExceptionFilter,25_2_00007FF670A7B7B0
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtCode function: 26_2_00007FF670A7B5CC IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,26_2_00007FF670A7B5CC
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtCode function: 26_2_00007FF670A89E30 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,26_2_00007FF670A89E30
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtCode function: 26_2_00007FF670A7AFB4 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,26_2_00007FF670A7AFB4
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtCode function: 26_2_00007FF670A7B7B0 SetUnhandledExceptionFilter,26_2_00007FF670A7B7B0
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtCode function: 26_2_00007FFDFB113048 IsProcessorFeaturePresent,00007FFE1A4519C0,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,00007FFE1A4519C0,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,26_2_00007FFDFB113048
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtCode function: 26_2_00007FFDFB235A1F IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,26_2_00007FFDFB235A1F
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeProcess created: C:\Users\user\Desktop\NEVER OPEN!.exe "C:\Users\user\Desktop\NEVER OPEN!.exe"Jump to behavior
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "ver"Jump to behavior
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "reg delete HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v empyrean /f"Jump to behavior
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v empyrean /t REG_SZ /d C:\Users\user\AppData\Roaming\empyrean\run.bat /f"Jump to behavior
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "C:\Windows\System32\wbem\WMIC.exe csproduct get uuid"Jump to behavior
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "C:\Windows\System32\wbem\WMIC.exe csproduct get uuid"Jump to behavior
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "C:\Windows\System32\wbem\WMIC.exe csproduct get uuid"Jump to behavior
                Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\reg.exe reg delete HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v empyrean /fJump to behavior
                Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\reg.exe reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v empyrean /t REG_SZ /d C:\Users\user\AppData\Roaming\empyrean\run.bat /fJump to behavior
                Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\wbem\WMIC.exe C:\Windows\System32\wbem\WMIC.exe csproduct get uuidJump to behavior
                Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\wbem\WMIC.exe C:\Windows\System32\wbem\WMIC.exe csproduct get uuid
                Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\wbem\WMIC.exe C:\Windows\System32\wbem\WMIC.exe csproduct get uuid
                Source: C:\Windows\System32\cmd.exeProcess created: C:\Users\user\AppData\Roaming\empyrean\dat.txt C:\Users\user\AppData\Roaming\empyrean\dat.txtJump to behavior
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtProcess created: C:\Users\user\AppData\Roaming\empyrean\dat.txt C:\Users\user\AppData\Roaming\empyrean\dat.txtJump to behavior
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "ver"
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "C:\Windows\System32\wbem\WMIC.exe csproduct get uuid"
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "C:\Windows\System32\wbem\WMIC.exe csproduct get uuid"
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "C:\Windows\System32\wbem\WMIC.exe csproduct get uuid"
                Source: C:\Windows\System32\cmd.exeProcess created: C:\Users\user\AppData\Roaming\empyrean\dat.txt C:\Users\user\AppData\Roaming\empyrean\dat.txt
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtProcess created: C:\Users\user\AppData\Roaming\empyrean\dat.txt C:\Users\user\AppData\Roaming\empyrean\dat.txt
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "ver"
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "C:\Windows\System32\wbem\WMIC.exe csproduct get uuid"
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "C:\Windows\System32\wbem\WMIC.exe csproduct get uuid"
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "C:\Windows\System32\wbem\WMIC.exe csproduct get uuid"
                Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\wbem\WMIC.exe C:\Windows\System32\wbem\WMIC.exe csproduct get uuid
                Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\wbem\WMIC.exe C:\Windows\System32\wbem\WMIC.exe csproduct get uuid
                Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\wbem\WMIC.exe C:\Windows\System32\wbem\WMIC.exe csproduct get uuid
                Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\wbem\WMIC.exe C:\Windows\System32\wbem\WMIC.exe csproduct get uuid
                Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\wbem\WMIC.exe C:\Windows\System32\wbem\WMIC.exe csproduct get uuid
                Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\wbem\WMIC.exe C:\Windows\System32\wbem\WMIC.exe csproduct get uuid
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeCode function: 0_2_00007FF619BE88D0 cpuid 0_2_00007FF619BE88D0
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI70002\Crypto VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI70002\Crypto\Cipher VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI70002\Crypto VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI70002\Crypto VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI70002\Crypto\Cipher VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI70002\Crypto VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI70002\Crypto\Cipher VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI70002\Crypto VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI70002\Crypto VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI70002\Crypto VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI70002\Crypto\PublicKey VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI70002\PIL VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI70002\PIL VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI70002\aiohttp VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI70002\altgraph-0.17.4.dist-info VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI70002\altgraph-0.17.4.dist-info VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI70002\altgraph-0.17.4.dist-info VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI70002\altgraph-0.17.4.dist-info VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI70002\altgraph-0.17.4.dist-info VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI70002\attrs-23.1.0.dist-info VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI70002\attrs-23.1.0.dist-info VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI70002\attrs-23.1.0.dist-info VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI70002\pyinstaller-5.1.dist-info VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI70002\pyinstaller-5.1.dist-info VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI70002\pyinstaller-5.1.dist-info VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI70002\pyinstaller-5.1.dist-info VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI70002\pyinstaller-5.1.dist-info VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI70002\pyinstaller-5.1.dist-info VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI70002\base_library.zip VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI70002\base_library.zip VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI70002\base_library.zip VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI70002\base_library.zip VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI70002\base_library.zip VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI70002\base_library.zip VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI70002\base_library.zip VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI70002\base_library.zip VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI70002\base_library.zip VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI70002\base_library.zip VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI70002\base_library.zip VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI70002\base_library.zip VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI70002\base_library.zip VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI70002\base_library.zip VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI70002\base_library.zip VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI70002\base_library.zip VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI70002\base_library.zip VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI70002\base_library.zip VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeQueries volume information: C:\Users\user\Desktop\NEVER OPEN!.exe VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeQueries volume information: C:\Users\user\Desktop\NEVER OPEN!.exe VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI70002 VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI70002 VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI70002 VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI70002 VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeQueries volume information: C:\Users\user\Desktop\NEVER OPEN!.exe VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeQueries volume information: C:\Users\user\Desktop\NEVER OPEN!.exe VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI70002\base_library.zip VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI70002\base_library.zip VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeQueries volume information: C:\Users\user\Desktop\NEVER OPEN!.exe VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeQueries volume information: C:\Users\user\Desktop\NEVER OPEN!.exe VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeQueries volume information: C:\Users\user\Desktop\NEVER OPEN!.exe VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI70002\base_library.zip VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI70002\base_library.zip VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI70002 VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI70002\_ctypes.pyd VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeQueries volume information: C:\Users\user\Desktop\NEVER OPEN!.exe VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeQueries volume information: C:\Users\user\Desktop\NEVER OPEN!.exe VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeQueries volume information: C:\Users\user\Desktop\NEVER OPEN!.exe VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI70002\base_library.zip VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI70002\base_library.zip VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeQueries volume information: C:\Users\user\Desktop\NEVER OPEN!.exe VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI70002\base_library.zip VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI70002\base_library.zip VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI70002\base_library.zip VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI70002\base_library.zip VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI70002\base_library.zip VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI70002\base_library.zip VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI70002\base_library.zip VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI70002\base_library.zip VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI70002\base_library.zip VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI70002\base_library.zip VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI70002\base_library.zip VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI70002\base_library.zip VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI70002\base_library.zip VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI70002\base_library.zip VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeQueries volume information: C:\Users\user\Desktop\NEVER OPEN!.exe VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI70002 VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeQueries volume information: C:\Users\user\Desktop\NEVER OPEN!.exe VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeQueries volume information: C:\Users\user\Desktop\NEVER OPEN!.exe VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeQueries volume information: C:\Users\user\Desktop\NEVER OPEN!.exe VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeQueries volume information: C:\Users\user\Desktop\NEVER OPEN!.exe VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI70002\base_library.zip VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI70002\base_library.zip VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI70002\base_library.zip VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeQueries volume information: C:\Users\user\Desktop\NEVER OPEN!.exe VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeQueries volume information: C:\Users\user\Desktop\NEVER OPEN!.exe VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI70002\base_library.zip VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI70002\base_library.zip VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI70002\base_library.zip VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI70002\base_library.zip VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI70002\base_library.zip VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI70002\base_library.zip VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI70002\base_library.zip VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI70002\base_library.zip VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI70002\base_library.zip VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI70002\base_library.zip VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI70002\base_library.zip VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI70002\base_library.zip VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI70002\base_library.zip VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeQueries volume information: C:\Users\user\Desktop\NEVER OPEN!.exe VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeQueries volume information: C:\Users\user\Desktop\NEVER OPEN!.exe VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeQueries volume information: C:\Users\user\Desktop\NEVER OPEN!.exe VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeQueries volume information: C:\Users\user\Desktop\NEVER OPEN!.exe VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeQueries volume information: C:\Users\user\Desktop\NEVER OPEN!.exe VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeQueries volume information: C:\Users\user\Desktop\NEVER OPEN!.exe VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeQueries volume information: C:\Users\user\Desktop\NEVER OPEN!.exe VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeQueries volume information: C:\Users\user\Desktop\NEVER OPEN!.exe VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeQueries volume information: C:\Users\user\Desktop\NEVER OPEN!.exe VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeQueries volume information: C:\Users\user\Desktop\NEVER OPEN!.exe VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeQueries volume information: C:\Users\user\Desktop\NEVER OPEN!.exe VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeQueries volume information: C:\Users\user\Desktop\NEVER OPEN!.exe VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI70002 VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI70002\_bz2.pyd VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeQueries volume information: C:\Users\user\Desktop\NEVER OPEN!.exe VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI70002 VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI70002\_lzma.pyd VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeQueries volume information: C:\Users\user\Desktop\NEVER OPEN!.exe VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI70002\base_library.zip VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI70002\base_library.zip VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeQueries volume information: C:\Users\user\Desktop\NEVER OPEN!.exe VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeQueries volume information: C:\Users\user\Desktop\NEVER OPEN!.exe VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeQueries volume information: C:\Users\user\Desktop\NEVER OPEN!.exe VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeQueries volume information: C:\Users\user\Desktop\NEVER OPEN!.exe VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeQueries volume information: C:\Users\user\Desktop\NEVER OPEN!.exe VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI70002 VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI70002\pyexpat.pyd VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeQueries volume information: C:\Users\user\Desktop\NEVER OPEN!.exe VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeQueries volume information: C:\Users\user\Desktop\NEVER OPEN!.exe VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeQueries volume information: C:\Users\user\Desktop\NEVER OPEN!.exe VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeQueries volume information: C:\Users\user\Desktop\NEVER OPEN!.exe VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeQueries volume information: C:\Users\user\Desktop\NEVER OPEN!.exe VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeQueries volume information: C:\Users\user\Desktop\NEVER OPEN!.exe VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeQueries volume information: C:\Users\user\Desktop\NEVER OPEN!.exe VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeQueries volume information: C:\Users\user\Desktop\NEVER OPEN!.exe VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeQueries volume information: C:\Users\user\Desktop\NEVER OPEN!.exe VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeQueries volume information: C:\Users\user\Desktop\NEVER OPEN!.exe VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeQueries volume information: C:\Users\user\Desktop\NEVER OPEN!.exe VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeQueries volume information: C:\Users\user\Desktop\NEVER OPEN!.exe VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeQueries volume information: C:\Users\user\Desktop\NEVER OPEN!.exe VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeQueries volume information: C:\Users\user\Desktop\NEVER OPEN!.exe VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeQueries volume information: C:\Users\user\Desktop\NEVER OPEN!.exe VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI70002 VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI70002\_socket.pyd VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeQueries volume information: C:\Users\user\Desktop\NEVER OPEN!.exe VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI70002 VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI70002\select.pyd VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeQueries volume information: C:\Users\user\Desktop\NEVER OPEN!.exe VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeQueries volume information: C:\Users\user\Desktop\NEVER OPEN!.exe VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI70002\base_library.zip VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI70002\base_library.zip VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeQueries volume information: C:\Users\user\Desktop\NEVER OPEN!.exe VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeQueries volume information: C:\Users\user\Desktop\NEVER OPEN!.exe VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeQueries volume information: C:\Users\user\Desktop\NEVER OPEN!.exe VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI70002 VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeQueries volume information: C:\Users\user\Desktop\NEVER OPEN!.exe VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeQueries volume information: C:\Users\user\Desktop\NEVER OPEN!.exe VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeQueries volume information: C:\Users\user\Desktop\NEVER OPEN!.exe VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeQueries volume information: C:\Users\user\Desktop\NEVER OPEN!.exe VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeQueries volume information: C:\Users\user\Desktop\NEVER OPEN!.exe VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeQueries volume information: C:\Users\user\Desktop\NEVER OPEN!.exe VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeQueries volume information: C:\Users\user\Desktop\NEVER OPEN!.exe VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeQueries volume information: C:\Users\user\Desktop\NEVER OPEN!.exe VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeQueries volume information: C:\Users\user\Desktop\NEVER OPEN!.exe VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI70002\base_library.zip VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI70002\base_library.zip VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeQueries volume information: C:\Users\user\Desktop\NEVER OPEN!.exe VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI70002 VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI70002\_queue.pyd VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeQueries volume information: C:\Users\user\Desktop\NEVER OPEN!.exe VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeQueries volume information: C:\Users\user\Desktop\NEVER OPEN!.exe VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeQueries volume information: C:\Users\user\Desktop\NEVER OPEN!.exe VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeQueries volume information: C:\Users\user\Desktop\NEVER OPEN!.exe VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeQueries volume information: C:\Users\user\Desktop\NEVER OPEN!.exe VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI70002\base_library.zip VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI70002\pywintypes310.dll VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI70002\base_library.zip VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI70002\pythoncom310.dll VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI70002 VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI70002\win32api.pyd VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI70002\win32com VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI70002\win32com VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI70002\win32com VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeQueries volume information: C:\Users\user\Desktop\NEVER OPEN!.exe VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeQueries volume information: C:\Users\user\Desktop\NEVER OPEN!.exe VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeQueries volume information: C:\Users\user\Desktop\NEVER OPEN!.exe VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeQueries volume information: C:\Users\user\Desktop\NEVER OPEN!.exe VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeQueries volume information: C:\Users\user\Desktop\NEVER OPEN!.exe VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeQueries volume information: C:\Users\user\Desktop\NEVER OPEN!.exe VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeQueries volume information: C:\Users\user\Desktop\NEVER OPEN!.exe VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeQueries volume information: C:\Users\user\Desktop\NEVER OPEN!.exe VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeQueries volume information: C:\Users\user\Desktop\NEVER OPEN!.exe VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI70002\base_library.zip VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI70002\base_library.zip VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeQueries volume information: C:\Users\user\Desktop\NEVER OPEN!.exe VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeQueries volume information: C:\Users\user\Desktop\NEVER OPEN!.exe VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeQueries volume information: C:\Users\user\Desktop\NEVER OPEN!.exe VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeQueries volume information: C:\Users\user\Desktop\NEVER OPEN!.exe VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeQueries volume information: C:\Users\user\Desktop\NEVER OPEN!.exe VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeQueries volume information: C:\Users\user\Desktop\NEVER OPEN!.exe VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeQueries volume information: C:\Users\user\Desktop\NEVER OPEN!.exe VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeQueries volume information: C:\Users\user\Desktop\NEVER OPEN!.exe VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeQueries volume information: C:\Users\user\Desktop\NEVER OPEN!.exe VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeQueries volume information: C:\Users\user\Desktop\NEVER OPEN!.exe VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI70002 VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeQueries volume information: C:\Users\user\Desktop\NEVER OPEN!.exe VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeQueries volume information: C:\Users\user\Desktop\NEVER OPEN!.exe VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeQueries volume information: C:\Users\user\Desktop\NEVER OPEN!.exe VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeQueries volume information: C:\Users\user\Desktop\NEVER OPEN!.exe VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeQueries volume information: C:\Users\user\Desktop\NEVER OPEN!.exe VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeQueries volume information: C:\Users\user\Desktop\NEVER OPEN!.exe VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeQueries volume information: C:\Users\user\Desktop\NEVER OPEN!.exe VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeQueries volume information: C:\Users\user\Desktop\NEVER OPEN!.exe VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeQueries volume information: C:\Users\user\Desktop\NEVER OPEN!.exe VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI70002\altgraph-0.17.4.dist-info VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI70002\attrs-23.1.0.dist-info VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI70002\attrs-23.1.0.dist-info VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI70002\pyinstaller-5.1.dist-info VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI70002\pyinstaller-5.1.dist-info VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI70002\altgraph-0.17.4.dist-info VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI70002\altgraph-0.17.4.dist-info VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI70002\attrs-23.1.0.dist-info VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI70002\attrs-23.1.0.dist-info VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI70002\attrs-23.1.0.dist-info VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI70002\pyinstaller-5.1.dist-info VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI70002\altgraph-0.17.4.dist-info VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeQueries volume information: C:\Users\user\AppData\Local\Temp\tmpufkq9fz1 VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeQueries volume information: C:\Users\user\Desktop\NEVER OPEN!.exe VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeQueries volume information: C:\Users\user\Desktop\NEVER OPEN!.exe VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeQueries volume information: C:\Users\user\Desktop\NEVER OPEN!.exe VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeQueries volume information: C:\Users\user\Desktop\NEVER OPEN!.exe VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeQueries volume information: C:\Users\user\Desktop\NEVER OPEN!.exe VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeQueries volume information: C:\Users\user\Desktop\NEVER OPEN!.exe VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI70002 VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeQueries volume information: C:\Users\user\Desktop\NEVER OPEN!.exe VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeQueries volume information: C:\Users\user\Desktop\NEVER OPEN!.exe VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeQueries volume information: C:\Users\user\Desktop\NEVER OPEN!.exe VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeQueries volume information: C:\Users\user\Desktop\NEVER OPEN!.exe VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeQueries volume information: C:\Users\user\Desktop\NEVER OPEN!.exe VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeQueries volume information: C:\Users\user\Desktop\NEVER OPEN!.exe VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeQueries volume information: C:\Users\user\Desktop\NEVER OPEN!.exe VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeQueries volume information: C:\Users\user\Desktop\NEVER OPEN!.exe VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeQueries volume information: C:\Users\user\Desktop\NEVER OPEN!.exe VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeQueries volume information: C:\Users\user\Desktop\NEVER OPEN!.exe VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeQueries volume information: C:\Users\user\Desktop\NEVER OPEN!.exe VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeQueries volume information: C:\Users\user\Desktop\NEVER OPEN!.exe VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeQueries volume information: C:\Users\user\Desktop\NEVER OPEN!.exe VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeQueries volume information: C:\Users\user\Desktop\NEVER OPEN!.exe VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeQueries volume information: C:\Users\user\Desktop\NEVER OPEN!.exe VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeQueries volume information: C:\Users\user\Desktop\NEVER OPEN!.exe VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeQueries volume information: C:\Users\user\Desktop\NEVER OPEN!.exe VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeQueries volume information: C:\Users\user\Desktop\NEVER OPEN!.exe VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeQueries volume information: C:\Users\user\Desktop\NEVER OPEN!.exe VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeQueries volume information: C:\Users\user\Desktop\NEVER OPEN!.exe VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeQueries volume information: C:\Users\user\Desktop\NEVER OPEN!.exe VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeQueries volume information: C:\Users\user\Desktop\NEVER OPEN!.exe VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeQueries volume information: C:\Users\user\Desktop\NEVER OPEN!.exe VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeQueries volume information: C:\Users\user\Desktop\NEVER OPEN!.exe VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeQueries volume information: C:\Users\user\Desktop\NEVER OPEN!.exe VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeQueries volume information: C:\Users\user\Desktop\NEVER OPEN!.exe VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeQueries volume information: C:\Users\user\Desktop\NEVER OPEN!.exe VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeQueries volume information: C:\Users\user\Desktop\NEVER OPEN!.exe VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeQueries volume information: C:\Users\user\Desktop\NEVER OPEN!.exe VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeQueries volume information: C:\Users\user\Desktop\NEVER OPEN!.exe VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeQueries volume information: C:\Users\user\Desktop\NEVER OPEN!.exe VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeQueries volume information: C:\Users\user\Desktop\NEVER OPEN!.exe VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeQueries volume information: C:\Users\user\Desktop\NEVER OPEN!.exe VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeQueries volume information: C:\Users\user\Desktop\NEVER OPEN!.exe VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeQueries volume information: C:\Users\user\Desktop\NEVER OPEN!.exe VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeQueries volume information: C:\Users\user\Desktop\NEVER OPEN!.exe VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeQueries volume information: C:\Users\user\Desktop\NEVER OPEN!.exe VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeQueries volume information: C:\Users\user\Desktop\NEVER OPEN!.exe VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeQueries volume information: C:\Users\user\Desktop\NEVER OPEN!.exe VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeQueries volume information: C:\Users\user\Desktop\NEVER OPEN!.exe VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeQueries volume information: C:\Users\user\Desktop\NEVER OPEN!.exe VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeQueries volume information: C:\Users\user\Desktop\NEVER OPEN!.exe VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeQueries volume information: C:\Users\user\Desktop\NEVER OPEN!.exe VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI70002 VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeQueries volume information: C:\Users\user\Desktop\NEVER OPEN!.exe VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeQueries volume information: C:\Users\user\Desktop\NEVER OPEN!.exe VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeQueries volume information: C:\Users\user\Desktop\NEVER OPEN!.exe VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeQueries volume information: C:\Users\user\Desktop\NEVER OPEN!.exe VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeQueries volume information: C:\Users\user\Desktop\NEVER OPEN!.exe VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeQueries volume information: C:\Users\user\Desktop\NEVER OPEN!.exe VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeQueries volume information: C:\Users\user\Desktop\NEVER OPEN!.exe VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeQueries volume information: C:\Users\user\Desktop\NEVER OPEN!.exe VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeQueries volume information: C:\Users\user\Desktop\NEVER OPEN!.exe VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeQueries volume information: C:\Users\user\Desktop\NEVER OPEN!.exe VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeQueries volume information: C:\Users\user\Desktop\NEVER OPEN!.exe VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeQueries volume information: C:\Users\user\Desktop\NEVER OPEN!.exe VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeQueries volume information: C:\Users\user\Desktop\NEVER OPEN!.exe VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeQueries volume information: C:\Users\user\Desktop\NEVER OPEN!.exe VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeQueries volume information: C:\Users\user\Desktop\NEVER OPEN!.exe VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeQueries volume information: C:\Users\user\Desktop\NEVER OPEN!.exe VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeQueries volume information: C:\Users\user\Desktop\NEVER OPEN!.exe VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeQueries volume information: C:\Users\user\Desktop\NEVER OPEN!.exe VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeQueries volume information: C:\Users\user\Desktop\NEVER OPEN!.exe VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeQueries volume information: C:\Users\user\Desktop\NEVER OPEN!.exe VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeQueries volume information: C:\Users\user\Desktop\NEVER OPEN!.exe VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeQueries volume information: C:\Users\user\Desktop\NEVER OPEN!.exe VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeQueries volume information: C:\Users\user\Desktop\NEVER OPEN!.exe VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeQueries volume information: C:\Users\user\Desktop\NEVER OPEN!.exe VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeQueries volume information: C:\Users\user\Desktop\NEVER OPEN!.exe VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeQueries volume information: C:\Users\user\Desktop\NEVER OPEN!.exe VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeQueries volume information: C:\Users\user\Desktop\NEVER OPEN!.exe VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeQueries volume information: C:\Users\user\Desktop\NEVER OPEN!.exe VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeQueries volume information: C:\Users\user\Desktop\NEVER OPEN!.exe VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI70002 VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI70002\_decimal.pyd VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeQueries volume information: C:\Users\user\Desktop\NEVER OPEN!.exe VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeQueries volume information: C:\Users\user\Desktop\NEVER OPEN!.exe VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeQueries volume information: C:\Users\user\Desktop\NEVER OPEN!.exe VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeQueries volume information: C:\Users\user\Desktop\NEVER OPEN!.exe VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeQueries volume information: C:\Users\user\Desktop\NEVER OPEN!.exe VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeQueries volume information: C:\Users\user\Desktop\NEVER OPEN!.exe VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeQueries volume information: C:\Users\user\Desktop\NEVER OPEN!.exe VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeQueries volume information: C:\Users\user\Desktop\NEVER OPEN!.exe VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeQueries volume information: C:\Users\user\Desktop\NEVER OPEN!.exe VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeQueries volume information: C:\Users\user\Desktop\NEVER OPEN!.exe VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeQueries volume information: C:\Users\user\Desktop\NEVER OPEN!.exe VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeQueries volume information: C:\Users\user\Desktop\NEVER OPEN!.exe VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeQueries volume information: C:\Users\user\Desktop\NEVER OPEN!.exe VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeQueries volume information: C:\Users\user\Desktop\NEVER OPEN!.exe VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeQueries volume information: C:\Users\user\Desktop\NEVER OPEN!.exe VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeQueries volume information: C:\Users\user\Desktop\NEVER OPEN!.exe VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeQueries volume information: C:\Users\user\Desktop\NEVER OPEN!.exe VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeQueries volume information: C:\Users\user\Desktop\NEVER OPEN!.exe VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeQueries volume information: C:\Users\user\Desktop\NEVER OPEN!.exe VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeQueries volume information: C:\Users\user\Desktop\NEVER OPEN!.exe VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeQueries volume information: C:\Users\user\Desktop\NEVER OPEN!.exe VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeQueries volume information: C:\Users\user\Desktop\NEVER OPEN!.exe VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeQueries volume information: C:\Users\user\Desktop\NEVER OPEN!.exe VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeQueries volume information: C:\Users\user\Desktop\NEVER OPEN!.exe VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeQueries volume information: C:\Users\user\Desktop\NEVER OPEN!.exe VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI70002 VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI70002\_uuid.pyd VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeQueries volume information: C:\Users\user\Desktop\NEVER OPEN!.exe VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI70002 VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeQueries volume information: C:\Users\user\Desktop\NEVER OPEN!.exe VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeQueries volume information: C:\Users\user\Desktop\NEVER OPEN!.exe VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeQueries volume information: C:\Users\user\Desktop\NEVER OPEN!.exe VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI70002\psutil VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI70002\psutil VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI70002\psutil VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI70002\psutil\_psutil_windows.pyd VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeQueries volume information: C:\Users\user\Desktop\NEVER OPEN!.exe VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeQueries volume information: C:\Users\user\Desktop\NEVER OPEN!.exe VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeQueries volume information: C:\Users\user\Desktop\NEVER OPEN!.exe VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeQueries volume information: C:\Users\user\Desktop\NEVER OPEN!.exe VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeQueries volume information: C:\Users\user\Desktop\NEVER OPEN!.exe VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeQueries volume information: C:\Users\user\Desktop\NEVER OPEN!.exe VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI70002 VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI70002\_ssl.pyd VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeQueries volume information: C:\Users\user\Desktop\NEVER OPEN!.exe VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeQueries volume information: C:\Users\user\Desktop\NEVER OPEN!.exe VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeQueries volume information: C:\Users\user\Desktop\NEVER OPEN!.exe VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeQueries volume information: C:\Users\user\Desktop\NEVER OPEN!.exe VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeQueries volume information: C:\Users\user\Desktop\NEVER OPEN!.exe VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeQueries volume information: C:\Users\user\Desktop\NEVER OPEN!.exe VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI70002 VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeQueries volume information: C:\Users\user\Desktop\NEVER OPEN!.exe VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeQueries volume information: C:\Users\user\Desktop\NEVER OPEN!.exe VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeQueries volume information: C:\Users\user\Desktop\NEVER OPEN!.exe VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeQueries volume information: C:\Users\user\Desktop\NEVER OPEN!.exe VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI70002 VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI70002\_hashlib.pyd VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeQueries volume information: C:\Users\user\Desktop\NEVER OPEN!.exe VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeQueries volume information: C:\Users\user\Desktop\NEVER OPEN!.exe VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeQueries volume information: C:\Users\user\Desktop\NEVER OPEN!.exe VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeQueries volume information: C:\Users\user\Desktop\NEVER OPEN!.exe VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeQueries volume information: C:\Users\user\Desktop\NEVER OPEN!.exe VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeQueries volume information: C:\Users\user\Desktop\NEVER OPEN!.exe VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeQueries volume information: C:\Users\user\Desktop\NEVER OPEN!.exe VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeQueries volume information: C:\Users\user\Desktop\NEVER OPEN!.exe VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeQueries volume information: C:\Users\user\Desktop\NEVER OPEN!.exe VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeQueries volume information: C:\Users\user\Desktop\NEVER OPEN!.exe VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeQueries volume information: C:\Users\user\Desktop\NEVER OPEN!.exe VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeQueries volume information: C:\Users\user\Desktop\NEVER OPEN!.exe VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeQueries volume information: C:\Users\user\Desktop\NEVER OPEN!.exe VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI70002 VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeQueries volume information: C:\Users\user\Desktop\NEVER OPEN!.exe VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI70002 VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeQueries volume information: C:\Users\user\Desktop\NEVER OPEN!.exe VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI70002 VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI70002\charset_normalizer VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI70002\charset_normalizer VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI70002\charset_normalizer VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI70002\charset_normalizer\md.cp310-win_amd64.pyd VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI70002\charset_normalizer VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI70002\charset_normalizer\md__mypyc.cp310-win_amd64.pyd VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeQueries volume information: C:\Users\user\Desktop\NEVER OPEN!.exe VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI70002 VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI70002\unicodedata.pyd VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeQueries volume information: C:\Users\user\Desktop\NEVER OPEN!.exe VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeQueries volume information: C:\Users\user\Desktop\NEVER OPEN!.exe VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeQueries volume information: C:\Users\user\Desktop\NEVER OPEN!.exe VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI70002 VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeQueries volume information: C:\Users\user\Desktop\NEVER OPEN!.exe VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeQueries volume information: C:\Users\user\Desktop\NEVER OPEN!.exe VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeQueries volume information: C:\Users\user\Desktop\NEVER OPEN!.exe VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeQueries volume information: C:\Users\user\Desktop\NEVER OPEN!.exe VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeQueries volume information: C:\Users\user\Desktop\NEVER OPEN!.exe VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeQueries volume information: C:\Users\user\Desktop\NEVER OPEN!.exe VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI70002 VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeQueries volume information: C:\Users\user\Desktop\NEVER OPEN!.exe VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI70002 VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeQueries volume information: C:\Users\user\Desktop\NEVER OPEN!.exe VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeQueries volume information: C:\Users\user\Desktop\NEVER OPEN!.exe VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeQueries volume information: C:\Users\user\Desktop\NEVER OPEN!.exe VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeQueries volume information: C:\Users\user\Desktop\NEVER OPEN!.exe VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeQueries volume information: C:\Users\user\Desktop\NEVER OPEN!.exe VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeQueries volume information: C:\Users\user\Desktop\NEVER OPEN!.exe VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeQueries volume information: C:\Users\user\Desktop\NEVER OPEN!.exe VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeQueries volume information: C:\Users\user\Desktop\NEVER OPEN!.exe VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeQueries volume information: C:\Users\user\Desktop\NEVER OPEN!.exe VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeQueries volume information: C:\Users\user\Desktop\NEVER OPEN!.exe VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeQueries volume information: C:\Users\user\Desktop\NEVER OPEN!.exe VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeQueries volume information: C:\Users\user\Desktop\NEVER OPEN!.exe VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeQueries volume information: C:\Users\user\Desktop\NEVER OPEN!.exe VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeQueries volume information: C:\Users\user\Desktop\NEVER OPEN!.exe VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeQueries volume information: C:\Users\user\Desktop\NEVER OPEN!.exe VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeQueries volume information: C:\Users\user\Desktop\NEVER OPEN!.exe VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeQueries volume information: C:\Users\user\Desktop\NEVER OPEN!.exe VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeQueries volume information: C:\Users\user\Desktop\NEVER OPEN!.exe VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI70002\base_library.zip VolumeInformationJump to behavior
                Source: C:\Windows\System32\cmd.exeQueries volume information: C:\ VolumeInformationJump to behavior
                Source: C:\Windows\System32\cmd.exeQueries volume information: C:\ VolumeInformation
                Source: C:\Windows\System32\cmd.exeQueries volume information: C:\ VolumeInformation
                Source: C:\Windows\System32\cmd.exeQueries volume information: C:\ VolumeInformationJump to behavior
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI45442\Crypto VolumeInformationJump to behavior
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI45442\Crypto VolumeInformationJump to behavior
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI45442\Crypto\Cipher VolumeInformationJump to behavior
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI45442\Crypto VolumeInformationJump to behavior
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI45442\Crypto VolumeInformationJump to behavior
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI45442\Crypto\Cipher VolumeInformationJump to behavior
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI45442\Crypto VolumeInformationJump to behavior
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI45442\Crypto\Cipher VolumeInformationJump to behavior
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI45442\Crypto VolumeInformationJump to behavior
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI45442\Crypto\Cipher VolumeInformationJump to behavior
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI45442\Crypto VolumeInformationJump to behavior
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI45442\Crypto VolumeInformationJump to behavior
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI45442\Crypto VolumeInformationJump to behavior
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI45442\Crypto VolumeInformationJump to behavior
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI45442\Crypto\PublicKey VolumeInformationJump to behavior
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI45442\aiohttp VolumeInformationJump to behavior
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI45442\aiohttp VolumeInformationJump to behavior
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI45442\charset_normalizer VolumeInformationJump to behavior
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI45442\altgraph-0.17.4.dist-info VolumeInformationJump to behavior
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI45442\altgraph-0.17.4.dist-info VolumeInformationJump to behavior
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI45442\altgraph-0.17.4.dist-info VolumeInformationJump to behavior
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI45442\altgraph-0.17.4.dist-info VolumeInformationJump to behavior
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI45442\altgraph-0.17.4.dist-info VolumeInformationJump to behavior
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI45442\attrs-23.1.0.dist-info VolumeInformationJump to behavior
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI45442\attrs-23.1.0.dist-info VolumeInformationJump to behavior
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI45442\attrs-23.1.0.dist-info VolumeInformationJump to behavior
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI45442\attrs-23.1.0.dist-info VolumeInformationJump to behavior
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI45442\pyinstaller-5.1.dist-info VolumeInformationJump to behavior
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI45442\pyinstaller-5.1.dist-info VolumeInformationJump to behavior
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI45442\pyinstaller-5.1.dist-info VolumeInformationJump to behavior
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI45442\pyinstaller-5.1.dist-info VolumeInformationJump to behavior
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI45442\pyinstaller-5.1.dist-info VolumeInformationJump to behavior
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI45442\base_library.zip VolumeInformation
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI45442\base_library.zip VolumeInformation
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI45442\base_library.zip VolumeInformation
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI45442\base_library.zip VolumeInformation
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI45442\base_library.zip VolumeInformation
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI45442\base_library.zip VolumeInformation
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI45442\base_library.zip VolumeInformation
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI45442\base_library.zip VolumeInformation
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI45442\base_library.zip VolumeInformation
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI45442\base_library.zip VolumeInformation
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI45442\base_library.zip VolumeInformation
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI45442\base_library.zip VolumeInformation
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI45442\base_library.zip VolumeInformation
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI45442\base_library.zip VolumeInformation
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI45442\base_library.zip VolumeInformation
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI45442\base_library.zip VolumeInformation
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI45442\base_library.zip VolumeInformation
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI45442\base_library.zip VolumeInformation
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtQueries volume information: C:\Users\user\AppData\Roaming\empyrean\dat.txt VolumeInformation
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtQueries volume information: C:\Users\user\AppData\Roaming\empyrean\dat.txt VolumeInformation
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI45442 VolumeInformation
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI45442 VolumeInformation
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI45442 VolumeInformation
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI45442 VolumeInformation
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtQueries volume information: C:\Users\user\AppData\Roaming\empyrean VolumeInformation
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtQueries volume information: C:\Users\user\AppData\Roaming\empyrean\dat.txt VolumeInformation
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtQueries volume information: C:\Users\user\AppData\Roaming\empyrean\dat.txt VolumeInformation
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI45442\base_library.zip VolumeInformation
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI45442\base_library.zip VolumeInformation
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtQueries volume information: C:\Users\user\AppData\Roaming\empyrean\dat.txt VolumeInformation
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtQueries volume information: C:\Users\user\AppData\Roaming\empyrean\dat.txt VolumeInformation
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtQueries volume information: C:\Users\user\AppData\Roaming\empyrean\dat.txt VolumeInformation
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeCode function: 0_2_00007FF619BCB4B0 GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,0_2_00007FF619BCB4B0
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeCode function: 0_2_00007FF619BE4D48 _get_daylight,_get_daylight,_get_daylight,_get_daylight,_get_daylight,GetTimeZoneInformation,0_2_00007FF619BE4D48
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuidJump to behavior

                Stealing of Sensitive Information

                barindex
                Yara detected Discord Token Stealer
                Source: Yara matchFile source: Process Memory Space: NEVER OPEN!.exe PID: 7164, type: MEMORYSTR
                Source: Yara matchFile source: NEVER OPEN!.exe, type: SAMPLE
                Source: Yara matchFile source: C:\Users\user\AppData\Roaming\empyrean\dat.txt, type: DROPPED
                Yara detected Empyrean
                Source: Yara matchFile source: 00000020.00000002.2233150692.000001A88A4E0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
                Source: Yara matchFile source: 0000001A.00000002.2151057596.0000013317E10000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
                Source: Yara matchFile source: Process Memory Space: NEVER OPEN!.exe PID: 7164, type: MEMORYSTR
                Tries to harvest and steal browser information (history, passwords, etc)
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\crashes\events
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\datareporting\archived\2023-10
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\saved-telemetry-pings
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\z6bny8rn.default
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtFile opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\content-prefs.sqlite
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\storage\permanent\chrome\idb
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\protections.sqlite
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\permissions.sqlite
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\storage\temporary
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtFile opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Storage\leveldb\000003.log
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\storage\permanent\chrome\idb\2918063365piupsah.sqlite
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\crashes
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\favicons.sqlite
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\storage\default
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\storage\permanent\chrome\idb\2918063365piupsah.files
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\webappsstore.sqlite
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.files
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\storage\permanent
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\storage\permanent\chrome
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\storage\permanent\chrome\idb\2823318777ntouromlalnodry--naod.sqlite
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\storage\permanent\chrome\idb\1657114595AmcateirvtiSty.sqlite
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtFile opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\datareporting
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\sessionstore-backups
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\storage\ls-archive.sqlite
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\storage\to-be-removed
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\places.sqlite
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\security_state
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\storage
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\bookmarkbackups
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\storage\permanent\chrome\idb\1451318868ntouromlalnodry--epcr.files
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\storage\permanent\chrome\idb\3561288849sdhlie.sqlite
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\datareporting\glean\tmp
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\storage\permanent\chrome\idb\2823318777ntouromlalnodry--naod.files
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\datareporting\glean\pending_pings
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\storage\permanent\chrome\idb\1657114595AmcateirvtiSty.files
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\storage\permanent\chrome\idb\1451318868ntouromlalnodry--epcr.sqlite
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\datareporting\archived
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\datareporting\glean\db
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\datareporting\glean\events
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\storage.sqlite
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\storage\permanent\chrome\idb\3561288849sdhlie.files
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\minidumps
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\datareporting\glean
                Yara detected Generic Python Stealer
                Source: Yara matchFile source: Process Memory Space: NEVER OPEN!.exe PID: 7164, type: MEMORYSTR

                Remote Access Functionality

                barindex
                Detected Empyrean Stealer
                Source: C:\Users\user\Desktop\NEVER OPEN!.exeFile created: C:\Users\user\AppData\Roaming\empyrean\dat.txtJump to behavior
                Yara detected Discord Token Stealer
                Source: Yara matchFile source: Process Memory Space: NEVER OPEN!.exe PID: 7164, type: MEMORYSTR
                Source: Yara matchFile source: NEVER OPEN!.exe, type: SAMPLE
                Source: Yara matchFile source: C:\Users\user\AppData\Roaming\empyrean\dat.txt, type: DROPPED
                Yara detected Empyrean
                Source: Yara matchFile source: 00000020.00000002.2233150692.000001A88A4E0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
                Source: Yara matchFile source: 0000001A.00000002.2151057596.0000013317E10000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
                Source: Yara matchFile source: Process Memory Space: NEVER OPEN!.exe PID: 7164, type: MEMORYSTR
                Yara detected Generic Python Stealer
                Source: Yara matchFile source: Process Memory Space: NEVER OPEN!.exe PID: 7164, type: MEMORYSTR
                Source: C:\Users\user\AppData\Roaming\empyrean\dat.txtCode function: 26_2_00007FFDFB232B5D bind,WSAGetLastError,26_2_00007FFDFB232B5D

                Mitre Att&ck Matrix

                ReconnaissanceResource DevelopmentInitial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionCommand and ControlExfiltrationImpact
                Gather Victim Identity Information1
                Scripting                		Valid Accounts131
                Windows Management Instrumentation                		1
                Scripting                		1
                DLL Side-Loading                		1
                Deobfuscate/Decode Files or Information                		1
                OS Credential Dumping                		2
                System Time Discovery                		Remote Services1
                Archive Collected Data                		12
                Encrypted Channel                		Exfiltration Over Other Network MediumAbuse Accessibility Features
                CredentialsDomainsDefault Accounts2
                Native API                		1
                DLL Side-Loading                		11
                Process Injection                		21
                Obfuscated Files or Information                		LSASS Memory1
                File and Directory Discovery                		Remote Desktop Protocol1
                Data from Local System                		1
                Remote Access Software                		Exfiltration Over BluetoothNetwork Denial of Service
                Email AddressesDNS ServerDomain Accounts12
                Command and Scripting Interpreter                		1
                Registry Run Keys / Startup Folder                		1
                Registry Run Keys / Startup Folder                		11
                Software Packing                		Security Account Manager46
                System Information Discovery                		SMB/Windows Admin SharesData from Network Shared Drive1
                Non-Application Layer Protocol                		Automated ExfiltrationData Encrypted for Impact
                Employee NamesVirtual Private ServerLocal AccountsCronLogin HookLogin Hook1
                Timestomp                		NTDS251
                Security Software Discovery                		Distributed Component Object ModelInput Capture2
                Application Layer Protocol                		Traffic DuplicationData Destruction
                Gather Victim Network InformationServerCloud AccountsLaunchdNetwork Logon ScriptNetwork Logon Script1
                DLL Side-Loading                		LSA Secrets12
                Virtualization/Sandbox Evasion                		SSHKeyloggingFallback ChannelsScheduled TransferData Encrypted for Impact
                Domain PropertiesBotnetReplication Through Removable MediaScheduled TaskRC ScriptsRC Scripts11
                Masquerading                		Cached Domain Credentials1
                Process Discovery                		VNCGUI Input CaptureMultiband CommunicationData Transfer Size LimitsService Stop
                DNSWeb ServicesExternal Remote ServicesSystemd TimersStartup ItemsStartup Items1
                Modify Registry                		DCSync1
                System Network Configuration Discovery                		Windows Remote ManagementWeb Portal CaptureCommonly Used PortExfiltration Over C2 ChannelInhibit System Recovery
                Network Trust DependenciesServerlessDrive-by CompromiseContainer Orchestration JobScheduled Task/JobScheduled Task/Job12
                Virtualization/Sandbox Evasion                		Proc FilesystemSystem Owner/User DiscoveryCloud ServicesCredential API HookingApplication Layer ProtocolExfiltration Over Alternative ProtocolDefacement
                Network TopologyMalvertisingExploit Public-Facing ApplicationCommand and Scripting InterpreterAtAt11
                Process Injection                		/etc/passwd and /etc/shadowNetwork SniffingDirect Cloud VM ConnectionsData StagedWeb ProtocolsExfiltration Over Symmetric Encrypted Non-C2 ProtocolInternal Defacement

                Behavior Graph

                Hide Legend

                Legend:

                • Process
                • Signature
                • Created File
                • DNS/IP Info
                • Is Dropped
                • Is Windows Process
                • Number of created Registry Values
                • Number of created Files
                • Visual Basic
                • Delphi
                • Java
                • .Net C# or VB.NET
                • C, C++ or other language
                • Is malicious
                • Internet
                behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1556387 Sample: NEVER OPEN!.exe Startdate: 15/11/2024 Architecture: WINDOWS Score: 100 111 www.cloudflare.com 2->111 113 raw.githubusercontent.com 2->113 115 3 other IPs or domains 2->115 117 Antivirus / Scanner detection for submitted sample 2->117 119 Multi AV Scanner detection for dropped file 2->119 121 Multi AV Scanner detection for submitted file 2->121 123 8 other signatures 2->123 10 NEVER OPEN!.exe 138 2->10         started        13 cmd.exe 1 2->13         started        15 cmd.exe 2->15         started        signatures3 process4 file5 97 C:\Users\...\_quoting_c.cp310-win_amd64.pyd, PE32+ 10->97 dropped 99 C:\Users\user\AppData\Local\...\win32ui.pyd, PE32+ 10->99 dropped 101 C:\Users\user\AppData\...\win32trace.pyd, PE32+ 10->101 dropped 103 87 other files (84 malicious) 10->103 dropped 17 NEVER OPEN!.exe 21 10->17         started        22 dat.txt 138 13->22         started        24 conhost.exe 13->24         started        26 dat.txt 15->26         started        28 conhost.exe 15->28         started        process6 dnsIp7 105 raw.githubusercontent.com 185.199.110.133, 443, 49733, 49744 FASTLYUS Netherlands 17->105 107 www.cloudflare.com 104.16.124.96, 443, 49735, 49748 CLOUDFLARENETUS United States 17->107 109 2 other IPs or domains 17->109 79 C:\Users\user\AppData\Roaming\...\dat.txt, PE32+ 17->79 dropped 125 Detected Empyrean Stealer 17->125 30 cmd.exe 1 17->30         started        33 cmd.exe 1 17->33         started        35 cmd.exe 1 17->35         started        41 3 other processes 17->41 81 C:\Users\...\_quoting_c.cp310-win_amd64.pyd, PE32+ 22->81 dropped 83 C:\Users\user\AppData\Local\...\win32ui.pyd, PE32+ 22->83 dropped 85 C:\Users\user\AppData\...\win32trace.pyd, PE32+ 22->85 dropped 93 87 other files (84 malicious) 22->93 dropped 127 Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines) 22->127 129 Writes many files with high entropy 22->129 131 Potentially malicious time measurement code found 22->131 37 dat.txt 22->37         started        87 C:\Users\...\_quoting_c.cp310-win_amd64.pyd, PE32+ 26->87 dropped 89 C:\Users\user\AppData\Local\...\win32ui.pyd, PE32+ 26->89 dropped 91 C:\Users\user\AppData\Local\...\sqlite3.dll, PE32+ 26->91 dropped 95 87 other files (4 malicious) 26->95 dropped 39 dat.txt 26->39         started        file8 signatures9 process10 signatures11 133 Uses cmd line tools excessively to alter registry or file data 30->133 53 2 other processes 30->53 55 2 other processes 33->55 43 conhost.exe 35->43         started        45 cmd.exe 37->45         started        47 cmd.exe 37->47         started        49 cmd.exe 37->49         started        51 cmd.exe 37->51         started        135 Tries to harvest and steal browser information (history, passwords, etc) 39->135 57 4 other processes 39->57 59 6 other processes 41->59 process12 process13 61 conhost.exe 45->61         started        63 WMIC.exe 45->63         started        65 conhost.exe 47->65         started        67 WMIC.exe 47->67         started        69 conhost.exe 49->69         started        71 WMIC.exe 49->71         started        73 conhost.exe 51->73         started        75 conhost.exe 57->75         started        77 6 other processes 57->77

                Screenshots

                Thumbnails

                This section contains all screenshots as thumbnails, including those not shown in the slideshow.


                windows-stand

                Antivirus, Machine Learning and Genetic Malware Detection

                Initial Sample

                SourceDetectionScannerLabelLink
                NEVER OPEN!.exe58%ReversingLabsWin64.Trojan.Disco
                NEVER OPEN!.exe100%AviraHEUR/AGEN.1358353
                NEVER OPEN!.exe100%Joe Sandbox ML

                Dropped Files

                SourceDetectionScannerLabelLink
                C:\Users\user\AppData\Local\Temp\_MEI2802\Crypto\Cipher\_ARC4.pyd0%ReversingLabs
                C:\Users\user\AppData\Local\Temp\_MEI2802\Crypto\Cipher\_Salsa20.pyd4%ReversingLabs
                C:\Users\user\AppData\Local\Temp\_MEI2802\Crypto\Cipher\_chacha20.pyd4%ReversingLabs
                C:\Users\user\AppData\Local\Temp\_MEI2802\Crypto\Cipher\_pkcs1_decode.pyd0%ReversingLabs
                C:\Users\user\AppData\Local\Temp\_MEI2802\Crypto\Cipher\_raw_aes.pyd0%ReversingLabs
                C:\Users\user\AppData\Local\Temp\_MEI2802\Crypto\Cipher\_raw_aesni.pyd0%ReversingLabs
                C:\Users\user\AppData\Local\Temp\_MEI2802\Crypto\Cipher\_raw_arc2.pyd0%ReversingLabs
                C:\Users\user\AppData\Local\Temp\_MEI2802\Crypto\Cipher\_raw_blowfish.pyd0%ReversingLabs
                C:\Users\user\AppData\Local\Temp\_MEI2802\Crypto\Cipher\_raw_cast.pyd0%ReversingLabs
                C:\Users\user\AppData\Local\Temp\_MEI2802\Crypto\Cipher\_raw_cbc.pyd0%ReversingLabs
                C:\Users\user\AppData\Local\Temp\_MEI2802\Crypto\Cipher\_raw_cfb.pyd0%ReversingLabs
                C:\Users\user\AppData\Local\Temp\_MEI2802\Crypto\Cipher\_raw_ctr.pyd0%ReversingLabs
                C:\Users\user\AppData\Local\Temp\_MEI2802\Crypto\Cipher\_raw_des.pyd0%ReversingLabs
                C:\Users\user\AppData\Local\Temp\_MEI2802\Crypto\Cipher\_raw_des3.pyd0%ReversingLabs
                C:\Users\user\AppData\Local\Temp\_MEI2802\Crypto\Cipher\_raw_ecb.pyd0%ReversingLabs
                C:\Users\user\AppData\Local\Temp\_MEI2802\Crypto\Cipher\_raw_eksblowfish.pyd0%ReversingLabs
                C:\Users\user\AppData\Local\Temp\_MEI2802\Crypto\Cipher\_raw_ocb.pyd0%ReversingLabs
                C:\Users\user\AppData\Local\Temp\_MEI2802\Crypto\Cipher\_raw_ofb.pyd0%ReversingLabs
                C:\Users\user\AppData\Local\Temp\_MEI2802\Crypto\Hash\_BLAKE2b.pyd4%ReversingLabs
                C:\Users\user\AppData\Local\Temp\_MEI2802\Crypto\Hash\_BLAKE2s.pyd0%ReversingLabs
                C:\Users\user\AppData\Local\Temp\_MEI2802\Crypto\Hash\_MD2.pyd0%ReversingLabs
                C:\Users\user\AppData\Local\Temp\_MEI2802\Crypto\Hash\_MD4.pyd0%ReversingLabs
                C:\Users\user\AppData\Local\Temp\_MEI2802\Crypto\Hash\_MD5.pyd0%ReversingLabs
                C:\Users\user\AppData\Local\Temp\_MEI2802\Crypto\Hash\_RIPEMD160.pyd0%ReversingLabs
                C:\Users\user\AppData\Local\Temp\_MEI2802\Crypto\Hash\_SHA1.pyd0%ReversingLabs
                C:\Users\user\AppData\Local\Temp\_MEI2802\Crypto\Hash\_SHA224.pyd0%ReversingLabs
                C:\Users\user\AppData\Local\Temp\_MEI2802\Crypto\Hash\_SHA256.pyd0%ReversingLabs
                C:\Users\user\AppData\Local\Temp\_MEI2802\Crypto\Hash\_SHA384.pyd0%ReversingLabs
                C:\Users\user\AppData\Local\Temp\_MEI2802\Crypto\Hash\_SHA512.pyd0%ReversingLabs
                C:\Users\user\AppData\Local\Temp\_MEI2802\Crypto\Hash\_ghash_clmul.pyd0%ReversingLabs
                C:\Users\user\AppData\Local\Temp\_MEI2802\Crypto\Hash\_ghash_portable.pyd0%ReversingLabs
                C:\Users\user\AppData\Local\Temp\_MEI2802\Crypto\Hash\_keccak.pyd0%ReversingLabs
                C:\Users\user\AppData\Local\Temp\_MEI2802\Crypto\Hash\_poly1305.pyd0%ReversingLabs
                C:\Users\user\AppData\Local\Temp\_MEI2802\Crypto\Math\_modexp.pyd0%ReversingLabs
                C:\Users\user\AppData\Local\Temp\_MEI2802\Crypto\Protocol\_scrypt.pyd0%ReversingLabs
                C:\Users\user\AppData\Local\Temp\_MEI2802\Crypto\PublicKey\_ec_ws.pyd0%ReversingLabs
                C:\Users\user\AppData\Local\Temp\_MEI2802\Crypto\PublicKey\_ed25519.pyd0%ReversingLabs
                C:\Users\user\AppData\Local\Temp\_MEI2802\Crypto\PublicKey\_ed448.pyd0%ReversingLabs
                C:\Users\user\AppData\Local\Temp\_MEI2802\Crypto\PublicKey\_x25519.pyd0%ReversingLabs
                C:\Users\user\AppData\Local\Temp\_MEI2802\Crypto\Util\_cpuid_c.pyd0%ReversingLabs
                C:\Users\user\AppData\Local\Temp\_MEI2802\Crypto\Util\_strxor.pyd0%ReversingLabs
                C:\Users\user\AppData\Local\Temp\_MEI2802\PIL\_imaging.cp310-win_amd64.pyd0%ReversingLabs
                C:\Users\user\AppData\Local\Temp\_MEI2802\PIL\_imagingcms.cp310-win_amd64.pyd0%ReversingLabs
                C:\Users\user\AppData\Local\Temp\_MEI2802\PIL\_imagingft.cp310-win_amd64.pyd0%ReversingLabs
                C:\Users\user\AppData\Local\Temp\_MEI2802\PIL\_imagingtk.cp310-win_amd64.pyd0%ReversingLabs
                C:\Users\user\AppData\Local\Temp\_MEI2802\PIL\_webp.cp310-win_amd64.pyd0%ReversingLabs
                C:\Users\user\AppData\Local\Temp\_MEI2802\VCRUNTIME140.dll0%ReversingLabs
                C:\Users\user\AppData\Local\Temp\_MEI2802\VCRUNTIME140_1.dll0%ReversingLabs
                C:\Users\user\AppData\Local\Temp\_MEI2802\_asyncio.pyd0%ReversingLabs
                C:\Users\user\AppData\Local\Temp\_MEI2802\_bz2.pyd0%ReversingLabs
                C:\Users\user\AppData\Local\Temp\_MEI2802\_ctypes.pyd0%ReversingLabs
                C:\Users\user\AppData\Local\Temp\_MEI2802\_decimal.pyd0%ReversingLabs
                C:\Users\user\AppData\Local\Temp\_MEI2802\_hashlib.pyd4%ReversingLabs
                C:\Users\user\AppData\Local\Temp\_MEI2802\_lzma.pyd0%ReversingLabs
                C:\Users\user\AppData\Local\Temp\_MEI2802\_multiprocessing.pyd0%ReversingLabs
                C:\Users\user\AppData\Local\Temp\_MEI2802\_overlapped.pyd0%ReversingLabs
                C:\Users\user\AppData\Local\Temp\_MEI2802\_queue.pyd0%ReversingLabs
                C:\Users\user\AppData\Local\Temp\_MEI2802\_socket.pyd0%ReversingLabs
                C:\Users\user\AppData\Local\Temp\_MEI2802\_sqlite3.pyd0%ReversingLabs
                C:\Users\user\AppData\Local\Temp\_MEI2802\_ssl.pyd0%ReversingLabs
                C:\Users\user\AppData\Local\Temp\_MEI2802\_uuid.pyd0%ReversingLabs
                C:\Users\user\AppData\Local\Temp\_MEI2802\_win32sysloader.pyd0%ReversingLabs
                C:\Users\user\AppData\Local\Temp\_MEI2802\aiohttp\_helpers.cp310-win_amd64.pyd0%ReversingLabs
                C:\Users\user\AppData\Local\Temp\_MEI2802\aiohttp\_http_parser.cp310-win_amd64.pyd0%ReversingLabs
                C:\Users\user\AppData\Local\Temp\_MEI2802\aiohttp\_http_writer.cp310-win_amd64.pyd0%ReversingLabs
                C:\Users\user\AppData\Local\Temp\_MEI2802\aiohttp\_websocket.cp310-win_amd64.pyd0%ReversingLabs
                C:\Users\user\AppData\Local\Temp\_MEI2802\charset_normalizer\md.cp310-win_amd64.pyd0%ReversingLabs
                C:\Users\user\AppData\Local\Temp\_MEI2802\charset_normalizer\md__mypyc.cp310-win_amd64.pyd0%ReversingLabs
                C:\Users\user\AppData\Local\Temp\_MEI2802\frozenlist\_frozenlist.cp310-win_amd64.pyd0%ReversingLabs
                C:\Users\user\AppData\Local\Temp\_MEI2802\libcrypto-1_1.dll0%ReversingLabs
                C:\Users\user\AppData\Local\Temp\_MEI2802\libffi-7.dll0%ReversingLabs
                C:\Users\user\AppData\Local\Temp\_MEI2802\libssl-1_1.dll0%ReversingLabs
                C:\Users\user\AppData\Local\Temp\_MEI2802\mfc140u.dll0%ReversingLabs
                C:\Users\user\AppData\Local\Temp\_MEI2802\multidict\_multidict.cp310-win_amd64.pyd0%ReversingLabs
                C:\Users\user\AppData\Local\Temp\_MEI2802\propcache\_helpers_c.cp310-win_amd64.pyd0%ReversingLabs
                C:\Users\user\AppData\Local\Temp\_MEI2802\psutil\_psutil_windows.pyd0%ReversingLabs
                C:\Users\user\AppData\Local\Temp\_MEI2802\pyexpat.pyd0%ReversingLabs
                C:\Users\user\AppData\Local\Temp\_MEI2802\python3.dll0%ReversingLabs
                C:\Users\user\AppData\Local\Temp\_MEI2802\python310.dll4%ReversingLabs
                C:\Users\user\AppData\Local\Temp\_MEI2802\pythoncom310.dll0%ReversingLabs
                C:\Users\user\AppData\Local\Temp\_MEI2802\pywintypes310.dll0%ReversingLabs
                C:\Users\user\AppData\Local\Temp\_MEI2802\select.pyd0%ReversingLabs
                C:\Users\user\AppData\Local\Temp\_MEI2802\sqlite3.dll4%ReversingLabs
                C:\Users\user\AppData\Local\Temp\_MEI2802\unicodedata.pyd0%ReversingLabs
                C:\Users\user\AppData\Local\Temp\_MEI2802\win32api.pyd0%ReversingLabs
                C:\Users\user\AppData\Local\Temp\_MEI2802\win32com\shell\shell.pyd0%ReversingLabs
                C:\Users\user\AppData\Local\Temp\_MEI2802\win32crypt.pyd4%ReversingLabs
                C:\Users\user\AppData\Local\Temp\_MEI2802\win32trace.pyd0%ReversingLabs
                C:\Users\user\AppData\Local\Temp\_MEI2802\win32ui.pyd25%ReversingLabsWin64.Trojan.Generic
                C:\Users\user\AppData\Local\Temp\_MEI2802\yarl\_quoting_c.cp310-win_amd64.pyd0%ReversingLabs
                C:\Users\user\AppData\Local\Temp\_MEI45442\Crypto\Cipher\_ARC4.pyd0%ReversingLabs
                C:\Users\user\AppData\Local\Temp\_MEI45442\Crypto\Cipher\_Salsa20.pyd4%ReversingLabs
                C:\Users\user\AppData\Local\Temp\_MEI45442\Crypto\Cipher\_chacha20.pyd4%ReversingLabs

                Unpacked PE Files

                ⊘No Antivirus matches

                Domains

                ⊘No Antivirus matches

                URLs

                SourceDetectionScannerLabelLink
                https://i.imgu0%Avira URL Cloudsafe
                https://www.pyinstaller.org/0%Avira URL Cloudsafe
                http://repository.swisssign.com/70%Avira URL Cloudsafe
                http://ocsp.accv.ese0%Avira URL Cloudsafe
                http://timgolden.me.uk/python/wmi.htmlread0%Avira URL Cloudsafe
                https://peps.python.org/pep-0681/)0%Avira URL Cloudsafe
                https://pyinstaller.readthedocs.io/en/v5.0.1/CHANGES.html0%Avira URL Cloudsafe
                https://tidelift.com/subscription/pkg/pypi-attrs?utm_source=pypi-attrs&utm_medium=referral&utm_campa0%Avira URL Cloudsafe
                http://repository.swisssign.com/U0%Avira URL Cloudsafe
                https://docs.aiohttp.org/en/stable/client_advanced.html#client-tracing0%Avira URL Cloudsafe
                https://127.0.0.1:84430%Avira URL Cloudsafe
                https://www.attrs.org/en/stable/init.html#hooking-yourself-into-initialization).0%Avira URL Cloudsafe
                https://pygments.org/docs/styles/#getting-a-list-of-available-styles).0%Avira URL Cloudsafe
                http://packages.python.org/altgraph0%Avira URL Cloudsafe
                https://docs.aiohttp.org/en/stable0%Avira URL Cloudsafe

                Domains and IPs

                Contacted Domains

                NameIPActiveMaliciousAntivirus DetectionReputation
                ipapi.co
                		104.26.9.44
                		truefalse
                  		high
                  bg.microsoft.map.fastly.net
                  		199.232.214.172
                  		truefalse
                    		high
                    discord.com
                    		162.159.137.232
                    		truefalse
                      		high
                      www.cloudflare.com
                      		104.16.124.96
                      		truefalse
                        		high
                        raw.githubusercontent.com
                        		185.199.110.133
                        		truefalse
                          		high

                          URLs from Memory and Binaries

                          NameSourceMaliciousAntivirus DetectionReputation
                          https://discord.com/channels/NEVER OPEN!.exe, 00000001.00000002.1893994482.000001F0980D0000.00000004.00001000.00020000.00000000.sdmpfalse
                            		high
                            https://i.imguNEVER OPEN!.exe, 00000001.00000002.1894453507.000001F098584000.00000004.00001000.00020000.00000000.sdmpfalse
                            • Avira URL Cloud: safe
                            		unknown
                            https://github.com/giampaolo/psutil/issues/875.NEVER OPEN!.exe, 00000001.00000002.1889881614.000001F096BA0000.00000004.00001000.00020000.00000000.sdmpfalse
                              		high
                              https://github.com/python-attrs/attrs/issues/251NEVER OPEN!.exe, 00000001.00000003.1867285529.000001F096510000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000003.1866887734.000001F096510000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000003.1747162433.000001F096510000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000003.1870753414.000001F09654A000.00000004.00000020.00020000.00000000.sdmpfalse
                                		high
                                https://github.com/python-attrs/attrs/issues/1085)NEVER OPEN!.exe, 00000000.00000003.1728423649.0000027663E07000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000000.00000003.1728329882.0000027663E07000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000000.00000003.1728329882.0000027663DF9000.00000004.00000020.00020000.00000000.sdmpfalse
                                  		high
                                  http://crl.dhimyotis.com/certignarootca.crl0NEVER OPEN!.exe, 00000001.00000003.1869260303.000001F096684000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000003.1863855088.000001F096684000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000003.1869038207.000001F09779D000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000003.1859519257.000001F09779D000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000002.1889252951.000001F09668A000.00000004.00000020.00020000.00000000.sdmpfalse
                                    		high
                                    https://i.scdn.co/image/NEVER OPEN!.exe, 00000001.00000002.1893884891.000001F097FD0000.00000004.00001000.00020000.00000000.sdmpfalse
                                      		high
                                      https://discord.com/developers/applications/NEVER OPEN!.exe, 00000001.00000002.1890308306.000001F0970F0000.00000004.00001000.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000003.1877031715.000001F09662C000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000002.1889135569.000001F09662C000.00000004.00000020.00020000.00000000.sdmpfalse
                                        		high
                                        https://github.com/aio-libs/aiohttp/discussions/6044NEVER OPEN!.exe, 00000001.00000002.1893515704.000001F097C40000.00000004.00001000.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000002.1890619309.000001F0972AF000.00000004.00000020.00020000.00000000.sdmpfalse
                                          		high
                                          http://python.orgNEVER OPEN!.exe, 00000001.00000002.1893515704.000001F097C40000.00000004.00001000.00020000.00000000.sdmpfalse
                                            		high
                                            https://python.org/dev/peps/pep-0263/NEVER OPEN!.exe, 00000001.00000002.1898577877.00007FFDFB784000.00000040.00000001.01000000.00000004.sdmpfalse
                                              		high
                                              https://github.com/tensorflow/datasets/blob/master/tensorflow_datasets/core/utils/resource_utils.py#NEVER OPEN!.exe, 00000001.00000003.1737866877.000001F093927000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000003.1870519237.000001F093913000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000002.1879447015.000001F093915000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000003.1738161329.000001F093927000.00000004.00000020.00020000.00000000.sdmpfalse
                                                		high
                                                https://github.com/sponsors/hynekNEVER OPEN!.exe, 00000000.00000003.1728329882.0000027663DF9000.00000004.00000020.00020000.00000000.sdmpfalse
                                                  		high
                                                  https://www.leboncoin.fr/NEVER OPEN!.exe, 00000001.00000002.1894904086.000001F099640000.00000004.00001000.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000002.1894453507.000001F0985A4000.00000004.00001000.00020000.00000000.sdmpfalse
                                                    		high
                                                    https://discord.com/api/vNEVER OPEN!.exe, 00000001.00000002.1893884891.000001F097FD0000.00000004.00001000.00020000.00000000.sdmpfalse
                                                      		high
                                                      http://repository.swisssign.com/7NEVER OPEN!.exe, 00000001.00000003.1865464973.000001F0976A2000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000003.1866464509.000001F0976B1000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000002.1892598384.000001F0976B4000.00000004.00000020.00020000.00000000.sdmpfalse
                                                      • Avira URL Cloud: safe
                                                      		unknown
                                                      http://timgolden.me.uk/python/wmi.htmlreadNEVER OPEN!.exe, 00000001.00000002.1894215353.000001F0982D0000.00000004.00001000.00020000.00000000.sdmpfalse
                                                      • Avira URL Cloud: safe
                                                      		unknown
                                                      https://www.pyinstaller.org/NEVER OPEN!.exe, 00000000.00000003.1733101901.0000027663DF9000.00000004.00000020.00020000.00000000.sdmpfalse
                                                      • Avira URL Cloud: safe
                                                      		unknown
                                                      https://ipapi.co/ip/NEVER OPEN!.exe, 00000001.00000002.1894340923.000001F0983D0000.00000004.00001000.00020000.00000000.sdmpfalse
                                                        		high
                                                        http://www.opensource.org/licenses/mit-license.phpNEVER OPEN!.exe, 00000001.00000003.1869811293.000001F0964B7000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000003.1867399628.000001F0963D9000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000003.1867569214.000001F096409000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000003.1866887734.000001F0963D8000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000003.1875247294.000001F0964C3000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000003.1871028242.000001F0964C1000.00000004.00000020.00020000.00000000.sdmpfalse
                                                          		high
                                                          https://raw.githubusercontent.com/python-attrs/attrs/main/.github/sponsors/FilePreviews.svgNEVER OPEN!.exe, 00000000.00000003.1728329882.0000027663DF9000.00000004.00000020.00020000.00000000.sdmpfalse
                                                            		high
                                                            https://refspecs.linuxfoundation.org/elf/gabi4NEVER OPEN!.exe, 00000001.00000002.1883696004.000001F095E40000.00000004.00001000.00020000.00000000.sdmpfalse
                                                              		high
                                                              https://www.msn.comNEVER OPEN!.exe, 00000001.00000002.1892734894.000001F097770000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000002.1894453507.000001F0985C0000.00000004.00001000.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000002.1894904086.000001F0996D4000.00000004.00001000.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000003.1792420967.000001F097770000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                		high
                                                                https://github.com/urllib3/urllib3/issues/2192#issuecomment-821832963NEVER OPEN!.exe, 00000001.00000003.1867285529.000001F096510000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000003.1866887734.000001F096510000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000003.1871513780.000001F096512000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000003.1871824181.000001F096535000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000002.1887451073.000001F096536000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                  		high
                                                                  https://github.com/python-attrs/attrs/issues/136NEVER OPEN!.exe, 00000001.00000003.1867399628.000001F0963D9000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000003.1867569214.000001F096409000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000003.1866887734.000001F0963D8000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000002.1885338288.000001F096412000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                    		high
                                                                    http://goo.gl/zeJZlNEVER OPEN!.exe, 00000001.00000002.1889881614.000001F096BA0000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                      		high
                                                                      https://tools.ietf.org/html/rfc3610NEVER OPEN!.exe, 00000001.00000003.1867399628.000001F0963D9000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000003.1867569214.000001F096409000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000003.1866887734.000001F0963D8000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000002.1885338288.000001F096412000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000003.1877031715.000001F09662C000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000002.1889135569.000001F09662C000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                        		high
                                                                        http://crl.dhimyotis.com/certignarootca.crlNEVER OPEN!.exe, 00000001.00000003.1793423772.000001F0976A2000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000003.1865696051.000001F095D0D000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000002.1891393968.000001F097504000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                          		high
                                                                          http://curl.haxx.se/rfc/cookie_spec.htmlNEVER OPEN!.exe, 00000001.00000002.1890206695.000001F096FF0000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                            		high
                                                                            http://docs.python.org/3/library/subprocess#subprocess.Popen.returncodeNEVER OPEN!.exe, 00000001.00000002.1890308306.000001F0970F0000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                              		high
                                                                              http://repository.swisssign.com/UNEVER OPEN!.exe, 00000001.00000003.1795108227.000001F09763E000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000003.1776290730.000001F09763E000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000003.1780149602.000001F09763E000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000003.1795186531.000001F097663000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000003.1793423772.000001F09763E000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                              • Avira URL Cloud: safe
                                                                              		unknown
                                                                              http://www.accv.es/legislacion_c.htmz1NEVER OPEN!.exe, 00000001.00000003.1872946214.000001F0971F1000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000002.1890462247.000001F097216000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                		high
                                                                                https://discord.com/oauth2/authorize?client_id=NEVER OPEN!.exe, 00000001.00000002.1893776235.000001F097EC0000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                  		high
                                                                                  https://zopeinterface.readthedocs.io/en/latest/NEVER OPEN!.exe, 00000001.00000002.1883414803.000001F095E2A000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000003.1746818736.000001F095E27000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000003.1869759132.000001F095E27000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000003.1748289517.000001F095E27000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                    		high
                                                                                    https://raw.githubusercontent.com/python-attrs/attrs/main/.github/sponsors/Tidelift.svgNEVER OPEN!.exe, 00000000.00000003.1728329882.0000027663DF9000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                      		high
                                                                                      https://www.cloudflare.com/cdn-cgi/tracep8BNEVER OPEN!.exe, 00000001.00000002.1894340923.000001F0983D0000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                        		high
                                                                                        https://datatracker.ietf.org/doc/html/rfc3986#section-3.2.3NEVER OPEN!.exe, 00000001.00000003.1874724322.000001F096584000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000003.1867285529.000001F096510000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000003.1866887734.000001F096510000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000002.1888632190.000001F0965A4000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000003.1872449458.000001F096566000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000003.1876289881.000001F0965A2000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000003.1873753770.000001F09656C000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000003.1870753414.000001F09654A000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                          		high
                                                                                          https://datatracker.ietf.org/doc/html/rfc3986#section-3.2.2NEVER OPEN!.exe, 00000001.00000003.1867399628.000001F0963D9000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000003.1874724322.000001F096584000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000003.1867569214.000001F096409000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000003.1867285529.000001F096510000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000003.1866887734.000001F0963D8000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000003.1866887734.000001F096510000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000002.1888632190.000001F0965A4000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000003.1872449458.000001F096566000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000002.1885338288.000001F096412000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000003.1876289881.000001F0965A2000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000003.1873753770.000001F09656C000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000003.1870753414.000001F09654A000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                            		high
                                                                                            https://wwww.certigna.fr/autorites/0mNEVER OPEN!.exe, 00000001.00000003.1869260303.000001F096684000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000003.1863855088.000001F096684000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000003.1788868906.000001F0976A2000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000003.1780149602.000001F0976A2000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000003.1793423772.000001F0976A2000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000003.1865696051.000001F095D0D000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000002.1889252951.000001F09668A000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                              		high
                                                                                              https://github.com/python/cpython/blob/839d7893943782ee803536a47f1d4de160314f85/Lib/importlib/readerNEVER OPEN!.exe, 00000001.00000003.1737866877.000001F093927000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000003.1870519237.000001F093913000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000002.1879447015.000001F093915000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000003.1738161329.000001F093927000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                		high
                                                                                                https://www.amazon.com/NEVER OPEN!.exe, 00000001.00000002.1894904086.000001F099640000.00000004.00001000.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000002.1894453507.000001F09858C000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                  		high
                                                                                                  https://httpbin.org/NEVER OPEN!.exe, 00000001.00000003.1870753414.000001F09654A000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                    		high
                                                                                                    https://github.com/microsoft/pyright/)).NEVER OPEN!.exe, 00000000.00000003.1728423649.0000027663E07000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000000.00000003.1728329882.0000027663E07000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000000.00000003.1728329882.0000027663DF9000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                      		high
                                                                                                      https://filepreviews.io/NEVER OPEN!.exe, 00000000.00000003.1728329882.0000027663DF9000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                        		high
                                                                                                        https://www.youtube.com/NEVER OPEN!.exe, 00000001.00000002.1894453507.000001F0985A4000.00000004.00001000.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000002.1894904086.000001F099628000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                          		high
                                                                                                          http://hg.python.org/cpython/file/603b4d593758/Lib/socket.py#l535NEVER OPEN!.exe, 00000001.00000003.1874217754.000001F095D70000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000003.1875606707.000001F095DA1000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000003.1870689292.000001F095922000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000003.1867207825.000001F09591C000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000003.1869627513.000001F095D5F000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000003.1877251993.000001F095DAB000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000003.1876866086.000001F095DA7000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000002.1881418163.000001F095923000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                            		high
                                                                                                            https://MD8.mozilla.org/1/mNEVER OPEN!.exe, 00000001.00000002.1894453507.000001F0985C0000.00000004.00001000.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000002.1894904086.000001F099640000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                              		high
                                                                                                              https://peps.python.org/pep-0681/)NEVER OPEN!.exe, 00000000.00000003.1728423649.0000027663E07000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000000.00000003.1728329882.0000027663E07000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000000.00000003.1728329882.0000027663DF9000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                              • Avira URL Cloud: safe
                                                                                                              		unknown
                                                                                                              https://www.bbc.co.uk/NEVER OPEN!.exe, 00000001.00000002.1894904086.000001F099640000.00000004.00001000.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000002.1894453507.000001F0985A4000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                                		high
                                                                                                                https://wiki.debian.org/XDGBaseDirectorySpecification#stateNEVER OPEN!.exe, 00000001.00000002.1880785392.000001F095840000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                  		high
                                                                                                                  http://crl.securetrust.com/STCA.crlNEVER OPEN!.exe, 00000001.00000003.1795042561.000001F0974DC000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000003.1864747713.000001F097602000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000003.1866412775.000001F097626000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000003.1766790298.000001F0974DC000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000003.1866338256.000001F097610000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000003.1863122925.000001F0975EE000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                    		high
                                                                                                                    https://tidelift.com/subscription/pkg/pypi-attrs?utm_source=pypi-attrs&utm_medium=referral&utm_campaNEVER OPEN!.exe, 00000000.00000003.1728329882.0000027663DF9000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                    • Avira URL Cloud: safe
                                                                                                                    		unknown
                                                                                                                    https://bugzilla.moNEVER OPEN!.exe, 00000001.00000002.1894340923.000001F0983D0000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                                      		high
                                                                                                                      http://crl.securetrust.com/SGCA.crlfts3NEVER OPEN!.exe, 00000001.00000003.1795042561.000001F0974DC000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                        		high
                                                                                                                        http://www.accv.es/fileadmin/Archivos/certificados/raizaccv1.crt0NEVER OPEN!.exe, 00000001.00000002.1892734894.000001F097719000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000003.1795276580.000001F097677000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000003.1795108227.000001F09763E000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000003.1866436381.000001F097716000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000003.1795396100.000001F09767F000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000003.1873103669.000001F095D16000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000002.1891810964.000001F0975A2000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000003.1766273937.000001F0975C8000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000003.1776290730.000001F09763E000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000003.1780149602.000001F09763E000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000003.1865696051.000001F095D0D000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000003.1795348868.000001F097645000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000003.1795186531.000001F097663000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000003.1793423772.000001F09763E000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                          		high
                                                                                                                          http://tools.ietf.org/html/rfc6125#section-6.4.3NEVER OPEN!.exe, 00000001.00000002.1890102466.000001F096EF0000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                                            		high
                                                                                                                            https://github.com/python-attrs/attrs/issues/1084)NEVER OPEN!.exe, 00000000.00000003.1728423649.0000027663E07000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000000.00000003.1728329882.0000027663E07000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000000.00000003.1728329882.0000027663DF9000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                              		high
                                                                                                                              https://www.attrs.org/en/stable/changelog.htmlNEVER OPEN!.exe, 00000000.00000003.1728329882.0000027663DF9000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                		high
                                                                                                                                https://docs.aiohttp.org/en/stable/client_advanced.html#client-tracingNEVER OPEN!.exe, 00000001.00000003.1795042561.000001F0974DC000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000003.1874305117.000001F0974F9000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000003.1872946214.000001F0971F1000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000003.1863985982.000001F0974DC000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000003.1766790298.000001F0974DC000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                • Avira URL Cloud: safe
                                                                                                                                		unknown
                                                                                                                                https://www.variomedia.de/NEVER OPEN!.exe, 00000000.00000003.1728329882.0000027663DF9000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                  		high
                                                                                                                                  http://crl.securetrust.com/SGCA.crlexNEVER OPEN!.exe, 00000001.00000003.1864747713.000001F097602000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000003.1866412775.000001F097626000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000003.1866338256.000001F097610000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000003.1863122925.000001F0975EE000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                    		high
                                                                                                                                    http://www.cert.fnmt.es/dpcs/NEVER OPEN!.exe, 00000001.00000003.1873581283.000001F097495000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000003.1864747713.000001F097602000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000003.1874932917.000001F0974B0000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000003.1866412775.000001F097626000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000003.1766273937.000001F0975C8000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000003.1866338256.000001F097610000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000003.1863122925.000001F0975EE000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                      		high
                                                                                                                                      https://google.com/mailNEVER OPEN!.exe, 00000001.00000003.1867399628.000001F0963D9000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000003.1874724322.000001F096584000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000003.1867569214.000001F096409000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000003.1867285529.000001F096510000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000003.1866887734.000001F0963D8000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000003.1866887734.000001F096510000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000003.1872449458.000001F096566000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000002.1888533425.000001F096587000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000002.1885338288.000001F096412000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000003.1873753770.000001F09656C000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000003.1870753414.000001F09654A000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                        		high
                                                                                                                                        https://github.com/jaraco/jaraco.functools/issues/5NEVER OPEN!.exe, 00000001.00000002.1883696004.000001F095E40000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                                                          		high
                                                                                                                                          http://www.accv.es00NEVER OPEN!.exe, 00000001.00000003.1872946214.000001F0971F1000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000003.1795108227.000001F09763E000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000003.1873103669.000001F095D16000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000002.1891810964.000001F0975A2000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000003.1776290730.000001F09763E000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000002.1890462247.000001F097216000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000003.1780149602.000001F09763E000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000003.1865696051.000001F095D0D000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000003.1795348868.000001F097645000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000003.1793423772.000001F09763E000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                            		high
                                                                                                                                            http://www.rfc-editor.org/info/rfc7253NEVER OPEN!.exe, 00000001.00000003.1872946214.000001F0971F1000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000002.1890431124.000001F097203000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                              		high
                                                                                                                                              https://www.iqiyi.com/NEVER OPEN!.exe, 00000001.00000002.1894904086.000001F099640000.00000004.00001000.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000002.1894453507.000001F0985A4000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                                                                		high
                                                                                                                                                https://github.com/urllib3/urllib3/issues/2513#issuecomment-1152559900.NEVER OPEN!.exe, 00000001.00000003.1867285529.000001F096510000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000003.1866887734.000001F096510000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000003.1871513780.000001F096512000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000003.1871824181.000001F096535000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000002.1887451073.000001F096536000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                  		high
                                                                                                                                                  https://www.attrs.org/NEVER OPEN!.exe, 00000000.00000003.1728329882.0000027663DF9000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                    		high
                                                                                                                                                    https://github.com/ronaldoussoren/altgraphNEVER OPEN!.exe, 00000000.00000003.1727627941.0000027663DF9000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                      		high
                                                                                                                                                      https://mahler:8092/site-updates.pyNEVER OPEN!.exe, 00000001.00000003.1874724322.000001F096584000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000003.1867285529.000001F096510000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000003.1866887734.000001F096510000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000003.1876188142.000001F0965AC000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000003.1872449458.000001F096566000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000003.1873753770.000001F09656C000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000003.1870753414.000001F09654A000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000002.1888675099.000001F0965AD000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                        		high
                                                                                                                                                        http://crl.securetrust.com/STCA.crldexNEVER OPEN!.exe, 00000001.00000003.1864747713.000001F097602000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000003.1866412775.000001F097626000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000003.1866338256.000001F097610000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000003.1863122925.000001F0975EE000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                          		high
                                                                                                                                                          https://www.cloudflare.com/cdn-cgi/traceNEVER OPEN!.exe, 00000001.00000002.1894340923.000001F0983D0000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                                                                            		high
                                                                                                                                                            https://cdnjs.cloudflare.com/ajax/libs/firacode/6.2.0/woff/FiraCode-Regular.woffNEVER OPEN!.exe, 00000001.00000003.1867399628.000001F0963D9000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000003.1867569214.000001F096409000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000003.1866887734.000001F0963D8000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000002.1885338288.000001F096412000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                              		high
                                                                                                                                                              https://github.com/pyinstaller/pyinstallerNEVER OPEN!.exe, 00000000.00000003.1733101901.0000027663DF9000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                		high
                                                                                                                                                                https://www.attrs.org/en/latest/glossary.html#term-dunder-methods)).NEVER OPEN!.exe, 00000000.00000003.1728329882.0000027663DF9000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                  		high
                                                                                                                                                                  https://github.com/ronaldoussoren/altgraph/issuesNEVER OPEN!.exe, 00000000.00000003.1727627941.0000027663DF9000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                    		high
                                                                                                                                                                    https://pyinstaller.readthedocs.io/en/v5.0.1/CHANGES.htmlNEVER OPEN!.exe, 00000000.00000003.1733101901.0000027663DF9000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                    • Avira URL Cloud: safe
                                                                                                                                                                    		unknown
                                                                                                                                                                    http://ocsp.accv.eseNEVER OPEN!.exe, 00000001.00000002.1892734894.000001F097719000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000003.1795276580.000001F097677000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000003.1795108227.000001F09763E000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000003.1866436381.000001F097716000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000003.1795396100.000001F09767F000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000003.1776290730.000001F09763E000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000003.1780149602.000001F09763E000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000003.1795186531.000001F097663000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000003.1793423772.000001F09763E000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                    • Avira URL Cloud: safe
                                                                                                                                                                    		unknown
                                                                                                                                                                    https://127.0.0.1:8443NEVER OPEN!.exe, 00000001.00000003.1867399628.000001F0963D9000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000003.1874724322.000001F096584000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000003.1867569214.000001F096409000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000003.1867285529.000001F096510000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000003.1866887734.000001F0963D8000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000003.1866887734.000001F096510000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000002.1888632190.000001F0965A4000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000003.1872449458.000001F096566000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000002.1885338288.000001F096412000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000003.1876289881.000001F0965A2000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000003.1873753770.000001F09656C000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000003.1870753414.000001F09654A000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                    • Avira URL Cloud: safe
                                                                                                                                                                    		unknown
                                                                                                                                                                    http://www.firmaprofesional.com/cps0NEVER OPEN!.exe, 00000001.00000003.1872946214.000001F0971F1000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000003.1795276580.000001F0976A2000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000003.1795331629.000001F0976B1000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000002.1890619309.000001F0972FC000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000003.1788868906.000001F0976A2000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000003.1865464973.000001F0976A2000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000003.1866464509.000001F0976B1000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000003.1780149602.000001F0976A2000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000003.1766273937.000001F0975C8000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000002.1890462247.000001F097216000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000003.1793423772.000001F0976A2000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000002.1892598384.000001F0976B4000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                      		high
                                                                                                                                                                      http://packages.python.org/altgraphNEVER OPEN!.exe, 00000000.00000003.1727627941.0000027663DF9000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                      • Avira URL Cloud: safe
                                                                                                                                                                      		unknown
                                                                                                                                                                      https://docs.python.org/3/library/re.html#re.subNEVER OPEN!.exe, 00000001.00000003.1743000479.000001F096335000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000002.1881898101.000001F095B40000.00000004.00001000.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000003.1743000479.000001F0962F5000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                        		high
                                                                                                                                                                        http://crl.securetrust.com/SGCA.crl0NEVER OPEN!.exe, 00000001.00000003.1795042561.000001F0974DC000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000003.1874305117.000001F0974F9000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000003.1874681025.000001F097500000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000003.1863985982.000001F0974DC000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000003.1766790298.000001F0974DC000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000002.1891271962.000001F0974EF000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000002.1891393968.000001F097504000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                          		high
                                                                                                                                                                          https://open.spotify.com/track/NEVER OPEN!.exe, 00000001.00000002.1893884891.000001F097FD0000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                                                                                            		high
                                                                                                                                                                            https://account.bellmedia.cNEVER OPEN!.exe, 00000001.00000002.1892734894.000001F097770000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000002.1894904086.000001F0996D4000.00000004.00001000.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000002.1894904086.000001F099628000.00000004.00001000.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000003.1792420967.000001F097770000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                              		high
                                                                                                                                                                              https://docs.aiohttp.org/en/stableNEVER OPEN!.exe, 00000001.00000002.1890619309.000001F0972FC000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                              • Avira URL Cloud: safe
                                                                                                                                                                              		unknown
                                                                                                                                                                              https://gist.github.com/XVilka/8346728NEVER OPEN!.exe, 00000001.00000002.1885338288.000001F096412000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                                		high
                                                                                                                                                                                https://login.microsoftonline.comNEVER OPEN!.exe, 00000001.00000002.1892734894.000001F097770000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000002.1894453507.000001F0985C0000.00000004.00001000.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000003.1795006849.000001F097608000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000003.1794679097.000001F0975C8000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000002.1894904086.000001F099640000.00000004.00001000.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000002.1894904086.000001F0996E8000.00000004.00001000.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000003.1792420967.000001F097770000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                                  		high
                                                                                                                                                                                  https://raw.githubusercontent.com/addi00000/empyrean-injection/main/obfuscated.jsNEVER OPEN!.exe, 00000001.00000002.1894453507.000001F09858C000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                                                                                                    		high
                                                                                                                                                                                    http://crl.thawte.com/ThawteTimestampingCA.crl0NEVER OPEN!.exe, 00000000.00000003.1720631750.0000027663DF9000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                                      		high
                                                                                                                                                                                      http://www.quovadisglobal.com/cps0NEVER OPEN!.exe, 00000001.00000003.1875330985.000001F097460000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000003.1877208570.000001F097472000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000003.1766457914.000001F097363000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000003.1874148217.000001F097453000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                                        		high
                                                                                                                                                                                        https://github.com/Rapptz/discord.pyNEVER OPEN!.exe, 00000001.00000002.1893884891.000001F097FD0000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                                                                                                          		high
                                                                                                                                                                                          https://github.com/pyparsing/pyparsing/wikiNEVER OPEN!.exe, 00000001.00000002.1884428139.000001F0962C9000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                                            		high
                                                                                                                                                                                            https://www.zhihu.com/NEVER OPEN!.exe, 00000001.00000002.1894453507.000001F0985C0000.00000004.00001000.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000002.1894904086.000001F09967C000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                                                                                                              		high
                                                                                                                                                                                              http://pypi.python.org/pypi/sphinxNEVER OPEN!.exe, 00000000.00000003.1727627941.0000027663DF9000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                                                		high
                                                                                                                                                                                                https://pygments.org/docs/styles/#getting-a-list-of-available-styles).NEVER OPEN!.exe, 00000001.00000003.1870753414.000001F09654A000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000003.1871824181.000001F096535000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                                                • Avira URL Cloud: safe
                                                                                                                                                                                                		unknown
                                                                                                                                                                                                https://www.attrs.org/en/stable/init.html#hooking-yourself-into-initialization).NEVER OPEN!.exe, 00000000.00000003.1728329882.0000027663DF9000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                                                • Avira URL Cloud: safe
                                                                                                                                                                                                		unknown
                                                                                                                                                                                                https://www.attrs.org/en/stable/changelog.html)NEVER OPEN!.exe, 00000000.00000003.1728329882.0000027663DF9000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                                                  		high
                                                                                                                                                                                                  http://docs.python.org/library/itertools.html#recipesNEVER OPEN!.exe, 00000001.00000003.1746818736.000001F095D1D000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000003.1748289517.000001F095DAC000.00000004.00000020.00020000.00000000.sdmp, NEVER OPEN!.exe, 00000001.00000002.1883696004.000001F095E40000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                                                                                                                    		high

                                                                                                                                                                                                    World Map of Contacted IPs

                                                                                                                                                                                                    • No. of IPs < 25%
                                                                                                                                                                                                    • 25% < No. of IPs < 50%
                                                                                                                                                                                                    • 50% < No. of IPs < 75%
                                                                                                                                                                                                    • 75% < No. of IPs

                                                                                                                                                                                                    Public IPs

                                                                                                                                                                                                    IPDomainCountryFlagASNASN NameMalicious
                                                                                                                                                                                                    162.159.137.232
                                                                                                                                                                                                    		discord.comUnited States
                                                                                                                                                                                                    		13335CLOUDFLARENETUSfalse
                                                                                                                                                                                                    185.199.110.133
                                                                                                                                                                                                    		raw.githubusercontent.comNetherlands
                                                                                                                                                                                                    		54113FASTLYUSfalse
                                                                                                                                                                                                    104.26.9.44
                                                                                                                                                                                                    		ipapi.coUnited States
                                                                                                                                                                                                    		13335CLOUDFLARENETUSfalse
                                                                                                                                                                                                    104.16.124.96
                                                                                                                                                                                                    		www.cloudflare.comUnited States
                                                                                                                                                                                                    		13335CLOUDFLARENETUSfalse

                                                                                                                                                                                                    General Information

                                                                                                                                                                                                    Joe Sandbox version:41.0.0 Charoite
                                                                                                                                                                                                    Analysis ID:1556387
                                                                                                                                                                                                    Start date and time:2024-11-15 10:47:08 +01:00
                                                                                                                                                                                                    Joe Sandbox product:CloudBasic
                                                                                                                                                                                                    Overall analysis duration:0h 12m 58s
                                                                                                                                                                                                    Hypervisor based Inspection enabled:false
                                                                                                                                                                                                    Report type:full
                                                                                                                                                                                                    Cookbook file name:default.jbs
                                                                                                                                                                                                    Analysis system description:Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
                                                                                                                                                                                                    Number of analysed new started processes analysed:54
                                                                                                                                                                                                    Number of new started drivers analysed:0
                                                                                                                                                                                                    Number of existing processes analysed:0
                                                                                                                                                                                                    Number of existing drivers analysed:0
                                                                                                                                                                                                    Number of injected processes analysed:0
                                                                                                                                                                                                    Technologies:
                                                                                                                                                                                                    • HCA enabled
                                                                                                                                                                                                    • EGA enabled
                                                                                                                                                                                                    • AMSI enabled
                                                                                                                                                                                                    Analysis Mode:default
                                                                                                                                                                                                    Analysis stop reason:Timeout
                                                                                                                                                                                                    Sample name:NEVER OPEN!.exe
                                                                                                                                                                                                    Detection:MAL
                                                                                                                                                                                                    Classification:mal100.rans.troj.spyw.evad.winEXE@78/365@4/4
                                                                                                                                                                                                    EGA Information:
                                                                                                                                                                                                    • Successful, ratio: 100%
                                                                                                                                                                                                    HCA Information:
                                                                                                                                                                                                    • Successful, ratio: 74%
                                                                                                                                                                                                    • Number of executed functions: 116
                                                                                                                                                                                                    • Number of non-executed functions: 193
                                                                                                                                                                                                    Cookbook Comments:
                                                                                                                                                                                                    • Found application associated with file extension: .exe

                                                                                                                                                                                                    Warnings

                                                                                                                                                                                                    • Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WMIADAP.exe, SIHClient.exe, conhost.exe
                                                                                                                                                                                                    • Excluded IPs from analysis (whitelisted): 4.245.163.56, 13.95.31.18, 13.85.23.206
                                                                                                                                                                                                    • Excluded domains from analysis (whitelisted): fe3.delivery.mp.microsoft.com, ocsp.digicert.com, otelrules.azureedge.net, slscr.update.microsoft.com, ctldl.windowsupdate.com.delivery.microsoft.com, glb.cws.prod.dcat.dsp.trafficmanager.net, sls.update.microsoft.com, ctldl.windowsupdate.com, wu-b-net.trafficmanager.net, d.4.1.9.1.6.7.1.0.0.0.0.0.0.0.0.1.0.0.9.0.0.1.f.1.1.1.0.1.0.a.2.ip6.arpa, glb.sls.prod.dcat.dsp.trafficmanager.net, fe3cr.delivery.mp.microsoft.com
                                                                                                                                                                                                    • Not all processes where analyzed, report is missing behavior information
                                                                                                                                                                                                    • Report creation exceeded maximum time and may have missing disassembly code information.
                                                                                                                                                                                                    • Report size exceeded maximum capacity and may have missing behavior information.
                                                                                                                                                                                                    • Report size exceeded maximum capacity and may have missing disassembly code.
                                                                                                                                                                                                    • Report size getting too big, too many NtEnumerateKey calls found.
                                                                                                                                                                                                    • Report size getting too big, too many NtOpenKeyEx calls found.
                                                                                                                                                                                                    • Report size getting too big, too many NtProtectVirtualMemory calls found.
                                                                                                                                                                                                    • Report size getting too big, too many NtQueryValueKey calls found.
                                                                                                                                                                                                    • Report size getting too big, too many NtQueryVolumeInformationFile calls found.
                                                                                                                                                                                                    • Report size getting too big, too many NtSetInformationFile calls found.
                                                                                                                                                                                                    • VT rate limit hit for: NEVER OPEN!.exe

                                                                                                                                                                                                    Simulations

                                                                                                                                                                                                    Behavior and APIs

                                                                                                                                                                                                    TimeTypeDescription
                                                                                                                                                                                                    04:48:13API Interceptor9x Sleep call for process: WMIC.exe modified
                                                                                                                                                                                                    09:48:15AutostartRun: HKCU\Software\Microsoft\Windows\CurrentVersion\Run empyrean C:\Users\user\AppData\Roaming\empyrean\run.bat
                                                                                                                                                                                                    09:48:23AutostartRun: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run empyrean C:\Users\user\AppData\Roaming\empyrean\run.bat

                                                                                                                                                                                                    Joe Sandbox View / Context

                                                                                                                                                                                                    IPs

                                                                                                                                                                                                    MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                                                                                                                                                                                    162.159.137.232YDW0S5K7hi.exeGet hashmaliciousSilverRatBrowse
                                                                                                                                                                                                      Xyq6rvzLJs.exeGet hashmaliciousSilverRatBrowse
                                                                                                                                                                                                        CFuejz2dRu.exeGet hashmaliciousDiscord Token StealerBrowse
                                                                                                                                                                                                          file.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                            SecuriteInfo.com.FileRepMalware.22561.28030.exeGet hashmaliciousPython Stealer, Exela StealerBrowse
                                                                                                                                                                                                              570ZenR882.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                                Ff0ZjqSI9Y.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                                  SecuriteInfo.com.Win32.MalwareX-gen.3620.22364.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                                    EUOgPjsBTC.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                                      webhook.ps1Get hashmaliciousUnknownBrowse
                                                                                                                                                                                                                        185.199.110.133sys_upd.ps1Get hashmaliciousUnknownBrowse
                                                                                                                                                                                                                        • raw.githubusercontent.com/Neth3N/na9ow3495raygwi4gyrhuawerawera/main/gaber.txt
                                                                                                                                                                                                                        cr_asm_menu..ps1Get hashmaliciousUnknownBrowse
                                                                                                                                                                                                                        • raw.githubusercontent.com/Neth3N/na9ow3495raygwi4gyrhuawerawera/main/gaber.txt
                                                                                                                                                                                                                        cr_asm_phshop..ps1Get hashmaliciousUnknownBrowse
                                                                                                                                                                                                                        • raw.githubusercontent.com/Neth3N/na9ow3495raygwi4gyrhuawerawera/main/gaber.txt
                                                                                                                                                                                                                        cr_asm_atCAD.ps1Get hashmaliciousUnknownBrowse
                                                                                                                                                                                                                        • raw.githubusercontent.com/Neth3N/na9ow3495raygwi4gyrhuawerawera/main/gaber.txt
                                                                                                                                                                                                                        vF20HtY4a4.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                                        • raw.githubusercontent.com/Neth3N/na9ow3495raygwi4gyrhuawerawera/main/gaber.txt
                                                                                                                                                                                                                        xK44OOt7vD.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                                        • raw.githubusercontent.com/Neth3N/na9ow3495raygwi4gyrhuawerawera/main/gaber.txt
                                                                                                                                                                                                                        Lm9IJ4r9oO.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                                        • raw.githubusercontent.com/Neth3N/na9ow3495raygwi4gyrhuawerawera/main/gaber.txt
                                                                                                                                                                                                                        cr_asm_crypter.ps1Get hashmaliciousUnknownBrowse
                                                                                                                                                                                                                        • raw.githubusercontent.com/Neth3N/na9ow3495raygwi4gyrhuawerawera/main/gaber.txt
                                                                                                                                                                                                                        SecuriteInfo.com.Trojan.GenericKD.74126573.27896.28845.dllGet hashmaliciousMetasploitBrowse
                                                                                                                                                                                                                        • raw.githubusercontent.com/Neth3N/na9ow3495raygwi4gyrhuawerawera/main/gaber_mnr.txt
                                                                                                                                                                                                                        104.26.9.44http://finnewsafrica.comGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                                        • ipapi.co/jsonp/?callback=__geoJSONPCallback

                                                                                                                                                                                                                        Domains

                                                                                                                                                                                                                        MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                                                                                                                                                                                                        discord.comHeilHitler.exeGet hashmaliciousBlank GrabberBrowse
                                                                                                                                                                                                                        • 162.159.128.233
                                                                                                                                                                                                                        file.exeGet hashmaliciousCStealerBrowse
                                                                                                                                                                                                                        • 162.159.138.232
                                                                                                                                                                                                                        B78DGDwttv.exeGet hashmaliciousSilverRatBrowse
                                                                                                                                                                                                                        • 162.159.135.232
                                                                                                                                                                                                                        YDW0S5K7hi.exeGet hashmaliciousSilverRatBrowse
                                                                                                                                                                                                                        • 162.159.137.232
                                                                                                                                                                                                                        cDRgXaadjD.exeGet hashmaliciousSilverRatBrowse
                                                                                                                                                                                                                        • 162.159.128.233
                                                                                                                                                                                                                        dens.exeGet hashmaliciousPython Stealer, Exela Stealer, Waltuhium GrabberBrowse
                                                                                                                                                                                                                        • 162.159.128.233
                                                                                                                                                                                                                        Xyq6rvzLJs.exeGet hashmaliciousSilverRatBrowse
                                                                                                                                                                                                                        • 162.159.137.232
                                                                                                                                                                                                                        00514DIRyT.exeGet hashmaliciousGO StealerBrowse
                                                                                                                                                                                                                        • 162.159.136.232
                                                                                                                                                                                                                        yuki.exeGet hashmaliciousLuna StealerBrowse
                                                                                                                                                                                                                        • 162.159.138.232
                                                                                                                                                                                                                        CFuejz2dRu.exeGet hashmaliciousDiscord Token StealerBrowse
                                                                                                                                                                                                                        • 162.159.135.232
                                                                                                                                                                                                                        www.cloudflare.comNewVoicemail - +1 392 504 7XXX00-33Rebecca.silvaTranscript.htmlGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                                        • 104.16.123.96
                                                                                                                                                                                                                        https://sos-at-vie-1.exo.io/bucketrack/dir62/final/prove-not-robot-check.htmlGet hashmaliciousCAPTCHA Scam ClickFixBrowse
                                                                                                                                                                                                                        • 104.16.123.96
                                                                                                                                                                                                                        Invitation Letter from Ministry of Defence China.htmlGet hashmaliciousHTMLPhisherBrowse
                                                                                                                                                                                                                        • 104.16.124.96
                                                                                                                                                                                                                        https://sv-management.solarflevoland.nl/wixGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                                        • 104.16.123.96
                                                                                                                                                                                                                        https://support-facebook.kb.help/your-facebook-account-has-been-restricted/Get hashmaliciousHTMLPhisherBrowse
                                                                                                                                                                                                                        • 104.16.124.96
                                                                                                                                                                                                                        https://krtra.com/t/vOPRDbTNH5dTGet hashmaliciousHTMLPhisherBrowse
                                                                                                                                                                                                                        • 104.16.123.96
                                                                                                                                                                                                                        http://go.wafykoe.com/0nbeGet hashmaliciousHTMLPhisherBrowse
                                                                                                                                                                                                                        • 104.16.123.96
                                                                                                                                                                                                                        http://mailsystem.clubreadymail.com/ls/click?upn=u001.dtlwkBC06DNvwxOIDozee7JfaEFoikK29eANg7C1JNJcXhZ5gVX-2FXngetD1DVBofJAdCxJYPz79KkHjQ4a88CWk3uwk0LHTd-2BQuqz7QlX5FT8W9oRLmLCtzSTX4k0IZqtxXd_tqQENWc9xFqnCCp3iHBun6Ny8Hr4S4LXflP5eWCRCPqMvoWfGV9u-2FwKqzOzsMAx2mMZTD10t6F-2Fa-2BzGZBzV05lc-2BTr9aqg9-2BqytIbVadpFenaHQ0v-2BIdTTiMe-2F-2BfHHsBDK3wAuPgwhtkcw4b5gAaeO6jGph7EzccXK6qZ9q3RXZcEXV8nVUtJyrcSCDmB-2Bn3qJnRr0-2BMlZvtkB3QnuJkj-2BigNgcTK7oh9PPlXl-2FakX6q-2BsTqF4DIEpeEYAXLd3sTGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                                        • 104.16.123.96
                                                                                                                                                                                                                        https://klickskydd.skolverket.org/?url=https%3A%2F%2Fonedrive.live.com%2Fredir%3Fresid%3DA2C259BD24DEB977%25211517%26authkey%3D%2521AMV6sdjMIZf95vs%26page%3DView%26wd%3Dtarget%2528Quick%2520Notes.one%257C8266a05f-045a-4cc0-bddc-4debc90069bb%252FNotera%2520H6TYD9J4rDFDFECZC-HUYW%257Ca949d04d-b4e2-4509-b99f-d04546199b7b%252F%2529%26wdorigin%3DNavigationUrl&id=71de&rcpt=johan.brandt@skolverket.se&tss=1729830791&msgid=2d0ccdeb-928a-11ef-8a2e-0050569b0508&html=1&h=008c08c0Get hashmaliciousUnknownBrowse
                                                                                                                                                                                                                        • 104.16.123.96
                                                                                                                                                                                                                        https://onlinepdf-qrsharedfile.com/index.html#XYW5uaWUua3lwcmlhbm91QGxjYXR0ZXJ0b24uY29tGet hashmaliciousHTMLPhisherBrowse
                                                                                                                                                                                                                        • 104.16.123.96
                                                                                                                                                                                                                        ipapi.coHess-INV87796-9_588115125.docGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                                        • 104.26.8.44
                                                                                                                                                                                                                        Hess-INV87796-9_588115125.docGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                                        • 172.67.69.226
                                                                                                                                                                                                                        phish_alert_sp2_2.0.0.0.emlGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                                        • 104.26.8.44
                                                                                                                                                                                                                        Steelcase Series 1 Sustainable Office Chair _ Steelcase.htmlGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                                        • 172.67.74.51
                                                                                                                                                                                                                        https://pub-6838e3dd185d4df89d3bb3eabe6469a4.r2.dev/index.html#Get hashmaliciousUnknownBrowse
                                                                                                                                                                                                                        • 188.114.96.3
                                                                                                                                                                                                                        https://pub-75eadb7757ac4bf2ab3de7c52d2a4895.r2.dev/index.html#'+tFjvjBPh,document%5B'body'%5D%5B'appendChild'%5D(para);Get hashmaliciousUnknownBrowse
                                                                                                                                                                                                                        • 188.114.97.3
                                                                                                                                                                                                                        https://pub-75eadb7757ac4bf2ab3de7c52d2a4895.r2.dev/index.html#'+tFjvjBPh,document%5B'body'%5D%5B'appendChild'%5D(para)Get hashmaliciousUnknownBrowse
                                                                                                                                                                                                                        • 188.114.97.3
                                                                                                                                                                                                                        https://pub-75eadb7757ac4bf2ab3de7c52d2a4895.r2.dev/index.html#'+tFjvjBPh,document%5B'body'%5D%5B'appendChild'%5D(para)Get hashmaliciousUnknownBrowse
                                                                                                                                                                                                                        • 188.114.96.3
                                                                                                                                                                                                                        https://pub-75eadb7757ac4bf2ab3de7c52d2a4895.r2.dev/index.html#'+tFjvjBPh,document%5B'body'%5D%5B'appendChild'%5D(para)Get hashmaliciousHTMLPhisherBrowse
                                                                                                                                                                                                                        • 188.114.97.3
                                                                                                                                                                                                                        https://ipfs.io/ipfs/QmNRd2YnNadczqweR7UkjNBG3cvGj4th37n2oBP7ZKKPD8#test@kghm.comGet hashmaliciousHTMLPhisherBrowse
                                                                                                                                                                                                                        • 172.67.69.226
                                                                                                                                                                                                                        bg.microsoft.map.fastly.netHeilHitler.exeGet hashmaliciousBlank GrabberBrowse
                                                                                                                                                                                                                        • 199.232.214.172
                                                                                                                                                                                                                        https://urlsand.esvalabs.com/?u=https%3A%2F%2Fwww.google.es%2Furl%3Fq%3Dquerydvj3%28spellCorrectionEnabled%253Atrue%252CrecentSearchParam%253A%28id%253A3891228890%252CdoLogHistory%253Atrue%29%252Cfilters%253AList%28%28type%253AREGION%252Cvalues%253AList%28%28id%253A103644278%252Ctext%253AUnited%252520States%252CselectionType%253AINCLUDED%29%29%29%29%252Ckeywords%253Aremote%29%26sessionId%3D5NTcRf4wT3OOZdAOuNu6%252FQ%253D%253Dquery%28spellCorrectionEnabled%253Atrue%252CrecentSearchParam%253A%28id%253A3891228890%252CdoLogHistory%253Atrue%29%252Cfilters%253AList%28%28type%253AREGION%252Cvalues%253AList%28%28id%253A103644278%252Ctext%253AUnited%252520States%252CselectionType%253AINCLUDED%29%29%29%29%252Ckeywords%253Aremote%29%26sessionId%3D5NTcRf4wT3OOZdAOuNu6%252FQ%253D%253Dquery%28spellCorrectionEnabled%253Atrue%252CrecentSearchParam%253A%28id%253A3891228890%252CdoLogHistory%253Atrue%29%252Cfilters%253AList%28%28type%253AREGION%252Cvalues%253AList%28%28id%253A103644278%252Ctext%253AUnited%252520States%252CselectionType%253AINCLUDED%29%29%29%29%252Ckeywords%253Aremote%29%26sessionId%3D5NTcRf4wT3OOZdAOuNu6%252FQ%253D%253Dquery%28spellCorrectionEnabled%253Atrue%252CrecentSearchParam%253A%28id%253A3891228890%252CdoLogHistory%253Atrue%29%252Cfilters%253AList%28%28type%253AREGION%252Cvalues%253AList%28%28id%253A103644278%252Ctext%253AUnited%252520States%252CselectionType%253AINCLUDED%29%29%29%29%252Ckeywords%253Aremote%29%26sessionId%3D5NTcRf4wT3OOZdAOuNu6%252FQ%253D%253D%26sa%3Dt%26url%3Damp%252fsafrareal.com.br%252fyoya%252fcwvw6vvf1g5bqgkdfsxdiiczthvxp3de8xxbs%2FcG1lQGZlZGVnYXJpYXNpYS5jb20%3D%24%3F&e=24a2acfd&h=70c4a2f4&f=n&p=yGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                                        • 199.232.214.172
                                                                                                                                                                                                                        dekont_7083037 T#U00dcRK#U0130YE HALK BANKASI A.#U015e pdf .exeGet hashmaliciousSnake Keylogger, VIP KeyloggerBrowse
                                                                                                                                                                                                                        • 199.232.210.172
                                                                                                                                                                                                                        5z3Wzl6uag.jsGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                                        • 199.232.210.172
                                                                                                                                                                                                                        https://kunnskapsfilm.noGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                                        • 199.232.210.172
                                                                                                                                                                                                                        https://www.google.es/url?q=queryrp18(spellCorrectionEnabled%3Atrue%2CrecentSearchParam%3A(id%3A3891228890%2CdoLogHistory%3Atrue)%2Cfilters%3AList((type%3AREGION%2Cvalues%3AList((id%3A103644278%2Ctext%3AUnited%2520States%2CselectionType%3AINCLUDED))))%2Ckeywords%3Aremote)&sessionId=5NTcRf4wT3OOZdAOuNu6%2FQ%3D%3Dquery(spellCorrectionEnabled%3Atrue%2CrecentSearchParam%3A(id%3A3891228890%2CdoLogHistory%3Atrue)%2Cfilters%3AList((type%3AREGION%2Cvalues%3AList((id%3A103644278%2Ctext%3AUnited%2520States%2CselectionType%3AINCLUDED))))%2Ckeywords%3Aremote)&sessionId=5NTcRf4wT3OOZdAOuNu6%2FQ%3D%3Dquery(spellCorrectionEnabled%3Atrue%2CrecentSearchParam%3A(id%3A3891228890%2CdoLogHistory%3Atrue)%2Cfilters%3AList((type%3AREGION%2Cvalues%3AList((id%3A103644278%2Ctext%3AUnited%2520States%2CselectionType%3AINCLUDED))))%2Ckeywords%3Aremote)&sessionId=5NTcRf4wT3OOZdAOuNu6%2FQ%3D%3Dquery(spellCorrectionEnabled%3Atrue%2CrecentSearchParam%3A(id%3A3891228890%2CdoLogHistory%3Atrue)%2Cfilters%3AList((type%3AREGION%2Cvalues%3AList((id%3A103644278%2Ctext%3AUnited%2520States%2CselectionType%3AINCLUDED))))%2Ckeywords%3Aremote)&sessionId=5NTcRf4wT3OOZdAOuNu6%2FQ%3D%3D&sa=t&url=amp%2fpreview.adope.jp%2fod%2f8gqnmo6zgfuuc6sej4k7rfdswihr8l%2fZnJhbnMuZW5nZWxicmVjaHRAYXJkYWdoZ3JvdXAuY29t$?Get hashmaliciousUnknownBrowse
                                                                                                                                                                                                                        • 199.232.214.172
                                                                                                                                                                                                                        https://www.payceconsultings.com/#choonghoon.kim@hyundaielevator.comGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                                        • 199.232.210.172
                                                                                                                                                                                                                        http://tvdseo.comGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                                        • 199.232.210.172
                                                                                                                                                                                                                        https://www.google.ch/url?sa=https://r20.rs6.net/tns.jsp?f=t&rct=j&q=&esrc=s&source=web&cd=&cad=rja&uact=8&ved=2ahUKEwjU1vfA9siJAxVNh_0HHcggMUkQFnoECB0QAQ&url=amp/s/afrotech2023.com%2Fdhj%2F4298727249/bmljay5zcHVybG9ja0BsZWcud2EuZ292Get hashmaliciousUnknownBrowse
                                                                                                                                                                                                                        • 199.232.210.172
                                                                                                                                                                                                                        https://www.google.com/url?sa=https://r20.rs6.net/tnt.jsp?f=t&rct=j&q=&esrc=s&source=web&cd=&cad=rja&uact=8&ved=2ahUKEwjU1vfA9siJAxVNh_0HHcggMUkQFnoECB0QAQ&url=amp/s/%73%61%66%65%74%79%77%6F%72%6B%73%6F%6C%75%74%69%6F%6E%73%2E%63%6F%6D%2F%73%78%7A%70%2F7220292368/am9lLm5ndXllbkBsZWcud2EuZ292Get hashmaliciousUnknownBrowse
                                                                                                                                                                                                                        • 199.232.214.172

                                                                                                                                                                                                                        ASNs

                                                                                                                                                                                                                        MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                                                                                                                                                                                                        CLOUDFLARENETUSHeilHitler.exeGet hashmaliciousBlank GrabberBrowse
                                                                                                                                                                                                                        • 162.159.128.233
                                                                                                                                                                                                                        ArenaWarsSetup.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                                        • 172.64.41.3
                                                                                                                                                                                                                        Email_sending_restriction_[sebastien.morel!](#HOHSM).htmlGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                                        • 172.67.151.164
                                                                                                                                                                                                                        ArenaWarsSetup.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                                        • 172.64.41.3
                                                                                                                                                                                                                        9RM52QaURq.exeGet hashmaliciousCredGrabber, Meduza StealerBrowse
                                                                                                                                                                                                                        • 172.67.74.152
                                                                                                                                                                                                                        HZ1BUCfTne.exeGet hashmaliciousCredGrabber, Meduza StealerBrowse
                                                                                                                                                                                                                        • 172.67.74.152
                                                                                                                                                                                                                        9RM52QaURq.exeGet hashmaliciousCredGrabber, Meduza StealerBrowse
                                                                                                                                                                                                                        • 172.67.74.152
                                                                                                                                                                                                                        bv2DbIiZeK.exeGet hashmaliciousCredGrabber, Meduza StealerBrowse
                                                                                                                                                                                                                        • 104.26.13.205
                                                                                                                                                                                                                        brozer.exeGet hashmaliciousCredGrabber, Meduza StealerBrowse
                                                                                                                                                                                                                        • 104.26.13.205
                                                                                                                                                                                                                        NewVoicemail - +1 392 504 7XXX00-33Rebecca.silvaTranscript.htmlGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                                        • 104.16.123.96
                                                                                                                                                                                                                        CLOUDFLARENETUSHeilHitler.exeGet hashmaliciousBlank GrabberBrowse
                                                                                                                                                                                                                        • 162.159.128.233
                                                                                                                                                                                                                        ArenaWarsSetup.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                                        • 172.64.41.3
                                                                                                                                                                                                                        Email_sending_restriction_[sebastien.morel!](#HOHSM).htmlGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                                        • 172.67.151.164
                                                                                                                                                                                                                        ArenaWarsSetup.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                                        • 172.64.41.3
                                                                                                                                                                                                                        9RM52QaURq.exeGet hashmaliciousCredGrabber, Meduza StealerBrowse
                                                                                                                                                                                                                        • 172.67.74.152
                                                                                                                                                                                                                        HZ1BUCfTne.exeGet hashmaliciousCredGrabber, Meduza StealerBrowse
                                                                                                                                                                                                                        • 172.67.74.152
                                                                                                                                                                                                                        9RM52QaURq.exeGet hashmaliciousCredGrabber, Meduza StealerBrowse
                                                                                                                                                                                                                        • 172.67.74.152
                                                                                                                                                                                                                        bv2DbIiZeK.exeGet hashmaliciousCredGrabber, Meduza StealerBrowse
                                                                                                                                                                                                                        • 104.26.13.205
                                                                                                                                                                                                                        brozer.exeGet hashmaliciousCredGrabber, Meduza StealerBrowse
                                                                                                                                                                                                                        • 104.26.13.205
                                                                                                                                                                                                                        NewVoicemail - +1 392 504 7XXX00-33Rebecca.silvaTranscript.htmlGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                                        • 104.16.123.96
                                                                                                                                                                                                                        FASTLYUSNewVoicemail - +1 392 504 7XXX00-33Rebecca.silvaTranscript.htmlGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                                        • 151.101.194.137
                                                                                                                                                                                                                        https://pxc.etemenonfor.com/lyKCxL5/#Ipoeschl@poeschl-tobacco.deGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                                        • 151.101.194.137
                                                                                                                                                                                                                        https://www.google.es/url?q=queryrp18(spellCorrectionEnabled%3Atrue%2CrecentSearchParam%3A(id%3A3891228890%2CdoLogHistory%3Atrue)%2Cfilters%3AList((type%3AREGION%2Cvalues%3AList((id%3A103644278%2Ctext%3AUnited%2520States%2CselectionType%3AINCLUDED))))%2Ckeywords%3Aremote)&sessionId=5NTcRf4wT3OOZdAOuNu6%2FQ%3D%3Dquery(spellCorrectionEnabled%3Atrue%2CrecentSearchParam%3A(id%3A3891228890%2CdoLogHistory%3Atrue)%2Cfilters%3AList((type%3AREGION%2Cvalues%3AList((id%3A103644278%2Ctext%3AUnited%2520States%2CselectionType%3AINCLUDED))))%2Ckeywords%3Aremote)&sessionId=5NTcRf4wT3OOZdAOuNu6%2FQ%3D%3Dquery(spellCorrectionEnabled%3Atrue%2CrecentSearchParam%3A(id%3A3891228890%2CdoLogHistory%3Atrue)%2Cfilters%3AList((type%3AREGION%2Cvalues%3AList((id%3A103644278%2Ctext%3AUnited%2520States%2CselectionType%3AINCLUDED))))%2Ckeywords%3Aremote)&sessionId=5NTcRf4wT3OOZdAOuNu6%2FQ%3D%3Dquery(spellCorrectionEnabled%3Atrue%2CrecentSearchParam%3A(id%3A3891228890%2CdoLogHistory%3Atrue)%2Cfilters%3AList((type%3AREGION%2Cvalues%3AList((id%3A103644278%2Ctext%3AUnited%2520States%2CselectionType%3AINCLUDED))))%2Ckeywords%3Aremote)&sessionId=5NTcRf4wT3OOZdAOuNu6%2FQ%3D%3D&sa=t&url=amp%2fpreview.adope.jp%2fod%2f8gqnmo6zgfuuc6sej4k7rfdswihr8l%2fZnJhbnMuZW5nZWxicmVjaHRAYXJkYWdoZ3JvdXAuY29t$?Get hashmaliciousUnknownBrowse
                                                                                                                                                                                                                        • 151.101.194.137
                                                                                                                                                                                                                        Request_for_Title_Commitment.htmlGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                                        • 151.101.66.137
                                                                                                                                                                                                                        Mark Qualman.zipGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                                        • 151.101.193.91
                                                                                                                                                                                                                        https://www.drawnames.com/wishlist/edit/D0gYBJzjFoJ7rv0HFu_iKQ-/JAvmRE-y4vYaeZ2GN316lg-Get hashmaliciousUnknownBrowse
                                                                                                                                                                                                                        • 151.101.1.16
                                                                                                                                                                                                                        http://www.drawnames.com/wishlist/add/GeoZyywvK48h1oNNizPuIQ-/W47fz4Y7Ik4eooK-94HN8w-Get hashmaliciousUnknownBrowse
                                                                                                                                                                                                                        • 151.101.66.132
                                                                                                                                                                                                                        https://linklock.titanhq.com/analyse?url=https%3A%2F%2Fmyarrowleaf1-my.sharepoint.com%2F%3Af%3A%2Fg%2Fpersonal%2Fmarge_penrod_myarrowleaf_org%2FElQV40bjfBZKivPSKIPxGuYBa20TAVuQG9ya4YrQRKjHiQ%3Fe%3D7nML8f&data=eJxVzctugzAQBdCvMbtGBqOkWXhBlOYhUiW0VaR0gyZgGyL80Ng05e8L6aaVZlZz7p2Kz5PlPI1BxBQqFtW8qkF14P2ssjrSfEEPxukjHONsHXlusRboSUrN_aG0VA-IPFyxVU0QOB7_dfS8CcF5wjKSbMbRAyDaeydAxk96mPkGUDjbmjDxybBM_mo1rhv_WQPdlARUonTCoK3LPzWlxUm-dMU5pdebXH3m7dfpPd-fvrf9ZQUJ_cjOfbFdDpBesHjLb7u2IGwjCFsvzOvhWf4A0NhYxQ%25%25Get hashmaliciousUnknownBrowse
                                                                                                                                                                                                                        • 151.101.2.137
                                                                                                                                                                                                                        Request_for_Title_Commitment.htmlGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                                        • 151.101.194.137
                                                                                                                                                                                                                        https://www.drawnames.com/wishlist/draw/GeoZyywvK48h1oNNizPuIQ-/W47fz4Y7Ik4eooK-94HN8w-/4Get hashmaliciousUnknownBrowse
                                                                                                                                                                                                                        • 151.101.65.16
                                                                                                                                                                                                                        CLOUDFLARENETUSHeilHitler.exeGet hashmaliciousBlank GrabberBrowse
                                                                                                                                                                                                                        • 162.159.128.233
                                                                                                                                                                                                                        ArenaWarsSetup.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                                        • 172.64.41.3
                                                                                                                                                                                                                        Email_sending_restriction_[sebastien.morel!](#HOHSM).htmlGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                                        • 172.67.151.164
                                                                                                                                                                                                                        ArenaWarsSetup.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                                        • 172.64.41.3
                                                                                                                                                                                                                        9RM52QaURq.exeGet hashmaliciousCredGrabber, Meduza StealerBrowse
                                                                                                                                                                                                                        • 172.67.74.152
                                                                                                                                                                                                                        HZ1BUCfTne.exeGet hashmaliciousCredGrabber, Meduza StealerBrowse
                                                                                                                                                                                                                        • 172.67.74.152
                                                                                                                                                                                                                        9RM52QaURq.exeGet hashmaliciousCredGrabber, Meduza StealerBrowse
                                                                                                                                                                                                                        • 172.67.74.152
                                                                                                                                                                                                                        bv2DbIiZeK.exeGet hashmaliciousCredGrabber, Meduza StealerBrowse
                                                                                                                                                                                                                        • 104.26.13.205
                                                                                                                                                                                                                        brozer.exeGet hashmaliciousCredGrabber, Meduza StealerBrowse
                                                                                                                                                                                                                        • 104.26.13.205
                                                                                                                                                                                                                        NewVoicemail - +1 392 504 7XXX00-33Rebecca.silvaTranscript.htmlGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                                        • 104.16.123.96

                                                                                                                                                                                                                        JA3 Fingerprints

                                                                                                                                                                                                                        ⊘No context

                                                                                                                                                                                                                        Dropped Files

                                                                                                                                                                                                                        MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_MEI2802\Crypto\Cipher\_ARC4.pydBootstrapper V1.19.exeGet hashmaliciousPython Stealer, Empyrean, Discord Token StealerBrowse
                                                                                                                                                                                                                          VXLauncher.exeGet hashmaliciousEmpyrean, Discord Token StealerBrowse
                                                                                                                                                                                                                            LisectAVT_2403002A_210.exeGet hashmaliciousPython Stealer, Empyrean, Discord Token StealerBrowse
                                                                                                                                                                                                                              Restortion.clinic.exeGet hashmaliciousEmpyrean, Discord Token StealerBrowse
                                                                                                                                                                                                                                0x000700000001ac52-36.exeGet hashmaliciousPython Stealer, Empyrean, Discord Token StealerBrowse
                                                                                                                                                                                                                                  8Zi7xnKKw7.exeGet hashmaliciousPython Stealer, DCRat, Discord Token Stealer, EmpyreanBrowse
                                                                                                                                                                                                                                    J54GP6x3r4.exeGet hashmaliciousDCRat, Discord Token Stealer, EmpyreanBrowse
                                                                                                                                                                                                                                      Bypass1.exeGet hashmaliciousPython Stealer, Discord Token Stealer, EmpyreanBrowse
                                                                                                                                                                                                                                        main.exeGet hashmaliciousPython Stealer, Discord Token Stealer, EmpyreanBrowse
                                                                                                                                                                                                                                          DiscordOptimizer__v1.1.8.exeGet hashmaliciousPython Stealer, Discord Token Stealer, EmpyreanBrowse

                                                                                                                                                                                                                                            Created / dropped Files

                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI2802\Crypto\Cipher\_ARC4.pyd

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Roaming\empyrean\dat.txt
                                                                                                                                                                                                                                            File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):9728
                                                                                                                                                                                                                                            Entropy (8bit):6.791071822964766
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:192:d519kKsPOR3drvDtDvIqEk7KzmYMJHFKHkyUxaVXFaLuH2:d57kKsWR3RvDtDvIqFmdwQHnUxaVXALX
                                                                                                                                                                                                                                            MD5:D9F2264898AAAA9EF6152A1414883D0F
                                                                                                                                                                                                                                            SHA1:E0661549D6BF59FFDA98FCCC00756F44CAF02228
                                                                                                                                                                                                                                            SHA-256:836CBA3B83B00427430FE6E1C4E45790616BC85C57DBD6E6D5B6930A9745B715
                                                                                                                                                                                                                                            SHA-512:BA033BAF7C3B93BBF8FCE4F24BC37930D6CE419EE3F517D2BC9702417E821F5FDA5FB9334A08B37FED55B3B9535CD194A3B79DD70653D1F8C4C0DD906EBF1B04
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Antivirus:
                                                                                                                                                                                                                                            • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                            Joe Sandbox View:
                                                                                                                                                                                                                                            • Filename: Bootstrapper V1.19.exe, Detection: malicious, Browse
                                                                                                                                                                                                                                            • Filename: VXLauncher.exe, Detection: malicious, Browse
                                                                                                                                                                                                                                            • Filename: LisectAVT_2403002A_210.exe, Detection: malicious, Browse
                                                                                                                                                                                                                                            • Filename: Restortion.clinic.exe, Detection: malicious, Browse
                                                                                                                                                                                                                                            • Filename: 0x000700000001ac52-36.exe, Detection: malicious, Browse
                                                                                                                                                                                                                                            • Filename: 8Zi7xnKKw7.exe, Detection: malicious, Browse
                                                                                                                                                                                                                                            • Filename: J54GP6x3r4.exe, Detection: malicious, Browse
                                                                                                                                                                                                                                            • Filename: Bypass1.exe, Detection: malicious, Browse
                                                                                                                                                                                                                                            • Filename: main.exe, Detection: malicious, Browse
                                                                                                                                                                                                                                            • Filename: DiscordOptimizer__v1.1.8.exe, Detection: malicious, Browse
                                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........&...H...H...H......H..I...H..I...H...I...H..M...H..L...H..K...H...@...H...H...H.......H...J...H.Rich..H.........................PE..d...ba.c.........." ...". .......p........................................................`.........................................L..........\............@........................................................@...........................................UPX0.....p..............................UPX1..... ..........................@....rsrc................"..............@......................................................................................................................................................................................................................................................................................................................................................3.96.UPX!.$..

                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI2802\Crypto\Cipher\_Salsa20.pyd

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Roaming\empyrean\dat.txt
                                                                                                                                                                                                                                            File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):10752
                                                                                                                                                                                                                                            Entropy (8bit):7.0813376258556
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:192:HPt6CkaiGEmxFlCFNbJqCBSkyUxaVXFaLon/F+:F6Ch3EmDlwbJqKSnUxaVXAL8k
                                                                                                                                                                                                                                            MD5:E3AE69E44C4C82D83082BBB8C25AA8DD
                                                                                                                                                                                                                                            SHA1:116D3B46E8DAA2AEFB2D58BE4B00BD3BFC09833F
                                                                                                                                                                                                                                            SHA-256:4229235814BBEE62311E3623C07898B03D3B22281CD4E5F1A87B86450B1B740F
                                                                                                                                                                                                                                            SHA-512:8A49128A79A9F9DE27AFE150402BD8DB224F8BAE6237D6C2D29C1F543E5A929E2FD15060BFD37B49B1C4A3190A70659AA041D36BDE09674A77171DC27415B2D4
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Antivirus:
                                                                                                                                                                                                                                            • Antivirus: ReversingLabs, Detection: 4%
                                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........EY.o+..o+..o+......o+...*..o+...*..o+..o*..o+......o+.../..o+...(..o+...#..o+...+..o+......o+...)..o+.Rich.o+.................PE..d...ca.c.........." ...".0.......p........................................................`.........................................L..........\............P..L.......................................................@...........................................UPX0.....p..............................UPX1.....0......."..................@....rsrc................&..............@..............................................................................................................................................................................................................................................................................................................................................................3.96.UPX!.$..

                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI2802\Crypto\Cipher\_chacha20.pyd

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Roaming\empyrean\dat.txt
                                                                                                                                                                                                                                            File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):10752
                                                                                                                                                                                                                                            Entropy (8bit):7.046269212433107
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:192:H7T6CkaiXcecnjMe0FXrdMIkCtOkyUxaVXFaL2nPVdX9lk:P6ChEcGeVWOnUxaVXALG/X9
                                                                                                                                                                                                                                            MD5:ED1BBDC7CC945DA2D1F5A914987EB885
                                                                                                                                                                                                                                            SHA1:C71F0A316E41C8AE5D21BE2E3A894E482D52774C
                                                                                                                                                                                                                                            SHA-256:1EECE2F714DC1F520D0608F9F71E692F5B269930603F8AFC330118EA38F16005
                                                                                                                                                                                                                                            SHA-512:1C26A0A0B223FD864BD01BCA8DE012DC385D116BE933C2479F25113983723DBBC2CEC147947F62C617BB7CCAD242518FECB653F008090BEEC0DEEEB5A1DFEAD4
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Antivirus:
                                                                                                                                                                                                                                            • Antivirus: ReversingLabs, Detection: 4%
                                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........EY.o+..o+..o+......o+...*..o+...*..o+..o*..o+......o+.../..o+...(..o+...#..o+...+..o+......o+...)..o+.Rich.o+.................PE..d...ca.c.........." ...".0.......p..p.....................................................`.........................................L..........\............P..d...................................................h...@...........................................UPX0.....p..............................UPX1.....0......."..................@....rsrc................&..............@..............................................................................................................................................................................................................................................................................................................................................................3.96.UPX!.$..

                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI2802\Crypto\Cipher\_pkcs1_decode.pyd

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Roaming\empyrean\dat.txt
                                                                                                                                                                                                                                            File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):10240
                                                                                                                                                                                                                                            Entropy (8bit):6.978550721417444
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:192:611+odumclYAItbK07UmzqMtJ9CE1r28kyUxaVXFaLf3BD:TH5Yy073zqU99DnUxaVXAL5
                                                                                                                                                                                                                                            MD5:3EFFD59CD95B6706C1F2DD661AA943FC
                                                                                                                                                                                                                                            SHA1:6D3C1B8899E38B31E7BE2670D87050921023C7F1
                                                                                                                                                                                                                                            SHA-256:4C29950A9EDEDBBC24A813F8178723F049A529605EF6D35F16C7955768AACE9E
                                                                                                                                                                                                                                            SHA-512:D6AF4A719694547DAE5E37C833DEF291CE3EAEA3703FAA360C6ADCC6B64BA36442E0D2783D44450E0F582BC6FA07F3496919FD6C70F88DD0FC29688956939412
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Antivirus:
                                                                                                                                                                                                                                            • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.............h...h...h......h..i...h..i...h...i...h..m...h..l...h..k...h...`...h...h...h.......h...j...h.Rich..h.........PE..d...aa.c.........." ...". .......p........................................................`.........................................L...p......\............P..........................................................@...........................................UPX0.....p..............................UPX1..... ....... ..................@....rsrc................$..............@......................................................................................................................................................................................................................................................................................................................................................................3.96.UPX!.$..

                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI2802\Crypto\Cipher\_raw_aes.pyd

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Roaming\empyrean\dat.txt
                                                                                                                                                                                                                                            File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):17920
                                                                                                                                                                                                                                            Entropy (8bit):7.483226756510774
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:384:NT0mEndi296LQpjT621uQ7nUxaVXALwcn:NQhvrpf6wuEvc
                                                                                                                                                                                                                                            MD5:671100B821EB357CEB5A4C5FF86BC31A
                                                                                                                                                                                                                                            SHA1:0604A7686029BECEBBEF102C14031CCF489854E9
                                                                                                                                                                                                                                            SHA-256:803E46354CDAB4AF6FF289E98DE9C56B5B08E3E9AD5F235D5A282005FA9F2D50
                                                                                                                                                                                                                                            SHA-512:2D916A41993EA1A5A0E72F0665A6D8C384C1541EE95A582EF5FBC59BE835720915046C7106ED2F9A1074EC0CDDFA7124E8079B2F837A442599C59479477960AF
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Antivirus:
                                                                                                                                                                                                                                            • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........&...H...H...H......H..I...H..I...H...I...H..M...H..L...H..K...H...@...H...H...H.......H...J...H.Rich..H.........................PE..d...^a.c.........." ...".@................................................... ............`.........................................L...........\.......................................................................@...........................................UPX0....................................UPX1.....@.......>..................@....rsrc................B..............@......................................................................................................................................................................................................................................................................................................................................................3.96.UPX!.$..

                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI2802\Crypto\Cipher\_raw_aesni.pyd

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Roaming\empyrean\dat.txt
                                                                                                                                                                                                                                            File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):11264
                                                                                                                                                                                                                                            Entropy (8bit):7.042646572293955
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:192:CZ1jziP8+lCPPQFUF/ylol0uBpDIkyUxaVXFaLmEnlA:kzulCPqUFCo5BpDInUxaVXALX
                                                                                                                                                                                                                                            MD5:DCD2F68680E2FB83E9FEFA18C7B4B3E0
                                                                                                                                                                                                                                            SHA1:8EC62148F1649477273607CDAA0DCE2331799741
                                                                                                                                                                                                                                            SHA-256:D63F63985356B7D2E0E61E7968720FB72DC6B57D73BED4F337E372918078F946
                                                                                                                                                                                                                                            SHA-512:BF311F048001C199F49B12B3B0893D132A139DD4B16D06ADB26DD9108F686B50C6FEDA2A73A59324473DB6EE9063FF13C72047A97E2FCB561C8F841EE3A8360C
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Antivirus:
                                                                                                                                                                                                                                            • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........eX.o...o...o.......o.......o.......o...o...o.......o.......o.......o.......o.......o.......o.......o..Rich.o..........................PE..d...^a.c.........." ...".0.......p.. .....................................................`.........................................L..........\............P.........................................................@...........................................UPX0.....p..............................UPX1.....0.......$..................@....rsrc................(..............@......................................................................................................................................................................................................................................................................................................................................................3.96.UPX!.$..

                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI2802\Crypto\Cipher\_raw_arc2.pyd

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Roaming\empyrean\dat.txt
                                                                                                                                                                                                                                            File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):12800
                                                                                                                                                                                                                                            Entropy (8bit):7.101710831645112
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:192:H68U1i2QelKEyhXjReC6SCeiJpHzoh7JfwoskyUxaVXFaLQHC:a8U8Dz1ESlinHzo5KosnUxaVXALV
                                                                                                                                                                                                                                            MD5:3F5FD606893B3DE6116D4A185E713CA3
                                                                                                                                                                                                                                            SHA1:5B0ABEB17AE2B3D59215FFFAE6688921B2A04EDA
                                                                                                                                                                                                                                            SHA-256:0898CDE5FCCFA86E2423CDF627A3745B1F59BB30DFEF0DD9423926D4167F9F82
                                                                                                                                                                                                                                            SHA-512:11580C06601D27755DF9D17DDFA8998E4E8E4FDEC55ECD1289963095BD752A69307B09606B06E5012CC73620D1B6D6CD41563C27A8218653DE7473F6E4BE1B2B
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Antivirus:
                                                                                                                                                                                                                                            • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........EY.o+..o+..o+......o+...*..o+...*..o+..o*..o+......o+.../..o+...(..o+...#..o+...+..o+......o+...)..o+.Rich.o+.................PE..d..._a.c.........." ...".0..........@.....................................................`.........................................L...........\............`......................................................8...@...........................................UPX0....................................UPX1.....0.......*..................@....rsrc...............................@..............................................................................................................................................................................................................................................................................................................................................................3.96.UPX!.$..

                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI2802\Crypto\Cipher\_raw_blowfish.pyd

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Roaming\empyrean\dat.txt
                                                                                                                                                                                                                                            File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):15360
                                                                                                                                                                                                                                            Entropy (8bit):7.390629788507205
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:384:gmM80nfSoKJZi3o0DYjHeja46nUxaVXALsD:gmMTf8Z4oiYj++T
                                                                                                                                                                                                                                            MD5:418CEC0CC45B20EE8165E86CAC35963C
                                                                                                                                                                                                                                            SHA1:51B8EE4C8663BE14E1EE5FA288F676ED180DA738
                                                                                                                                                                                                                                            SHA-256:694BF801227B26DADAF9DDFF373647AB551D7A0B9CFF6DE1B42747F04EFC510E
                                                                                                                                                                                                                                            SHA-512:7986BD0BB851DC87D983EAAEB438C6F6D406FE89526AF79CFCEE0F534177EFA70AA3175D3BC730745C5F344931132C235659E1CC7164C014520477633488A158
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Antivirus:
                                                                                                                                                                                                                                            • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........EY.o+..o+..o+......o+...*..o+...*..o+..o*..o+......o+.../..o+...(..o+...#..o+...+..o+......o+...)..o+.Rich.o+.................PE..d..._a.c.........." ...".@..........0.....................................................`.........................................L...........\............p......................................................(...@...........................................UPX0....................................UPX1.....@.......4..................@....rsrc................8..............@..............................................................................................................................................................................................................................................................................................................................................................3.96.UPX!.$..

                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI2802\Crypto\Cipher\_raw_cast.pyd

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Roaming\empyrean\dat.txt
                                                                                                                                                                                                                                            File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):20480
                                                                                                                                                                                                                                            Entropy (8bit):7.586579116038327
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:384:4VVgiBGs0qMuLjc5XzQk+JktIzZWFjoyXfHG1L4lcX22CnUxaVXALbUu:4VCicsfFL45KJk44NoyX/CucX8OUu
                                                                                                                                                                                                                                            MD5:243E336DEC71A28E7F61548A2425A2E1
                                                                                                                                                                                                                                            SHA1:66DCA0B999E704E9FB29861D3C5BCD065E2CB2C0
                                                                                                                                                                                                                                            SHA-256:BF53063304119CF151F22809356B5B4E44799131BBAB5319736D0321F3012238
                                                                                                                                                                                                                                            SHA-512:D0081025822FF86E7FC3E4442926988F95F91BFF3627C1952CE6B1AAEF69F8B3E42D5D3A9DD941C1A1526D6558CA6E3DAEF5AFCFB0431EEBC9B9920C7CA89101
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Antivirus:
                                                                                                                                                                                                                                            • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........EY.o+..o+..o+......o+...*..o+...*..o+..o*..o+......o+.../..o+...(..o+...#..o+...+..o+......o+...)..o+.Rich.o+.................PE..d...`a.c.........." ...".P................................................................`.........................................L...........\.......................................................................@...........................................UPX0....................................UPX1.....P.......H..................@....rsrc................L..............@..............................................................................................................................................................................................................................................................................................................................................................3.96.UPX!.$..

                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI2802\Crypto\Cipher\_raw_cbc.pyd

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Roaming\empyrean\dat.txt
                                                                                                                                                                                                                                            File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):10240
                                                                                                                                                                                                                                            Entropy (8bit):6.815145028259091
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:192:HG6CkaitEsE8Vm7wvukyUxaVXFaLy300:m6ChIV9unUxaVXALV
                                                                                                                                                                                                                                            MD5:FE44F698198190DE574DC193A0E1B967
                                                                                                                                                                                                                                            SHA1:5BAD88C7CC50E61487EC47734877B31F201C5668
                                                                                                                                                                                                                                            SHA-256:32FA416A29802EB0017A2C7360BF942EDB132D4671168DE26BD4C3E94D8DE919
                                                                                                                                                                                                                                            SHA-512:C841885DD7696F337635EF759E3F61EE7F4286B622A9FB8B695988D93219089E997B944321CA49CA3BD19D41440EE7C8E1D735BD3558052F67F762BF4D1F5FC3
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Antivirus:
                                                                                                                                                                                                                                            • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........EY.o+..o+..o+......o+...*..o+...*..o+..o*..o+......o+.../..o+...(..o+...#..o+...+..o+......o+...)..o+.Rich.o+.................PE..d...aa.c.........." ...". .......p..p.....................................................`.........................................L..........\............P..X...................................................h...@...........................................UPX0.....p..............................UPX1..... ....... ..................@....rsrc................$..............@..............................................................................................................................................................................................................................................................................................................................................................3.96.UPX!.$..

                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI2802\Crypto\Cipher\_raw_cfb.pyd

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Roaming\empyrean\dat.txt
                                                                                                                                                                                                                                            File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):10752
                                                                                                                                                                                                                                            Entropy (8bit):6.934741919099467
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:192:CaqmTnQIPnsvQPc6SltPZHloUYU9dOxLKFaEWakyUxaVXFaL2nC2:1DnQxvQPpSlNoUopKjWanUxaVXALj
                                                                                                                                                                                                                                            MD5:FF64FD41B794E0EF76A9EEAE1835863C
                                                                                                                                                                                                                                            SHA1:BF14E9D12B8187CA4CC9528D7331F126C3F5CA1E
                                                                                                                                                                                                                                            SHA-256:5D2D1A5F79B44F36AC87D9C6D886404D9BE35D1667C4B2EB8AAB59FB77BF8BAC
                                                                                                                                                                                                                                            SHA-512:03673F94525B63644A7DA45C652267077753F29888FB8966DA5B2B560578F961FDC67696B69A49D9577A8033FFCC7B4A6B98C051B4F53380227C392761562734
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Antivirus:
                                                                                                                                                                                                                                            • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......................;..................................................................W.............Rich............................PE..d...aa.c.........." ...".0.......p........................................................`.........................................L..........\............P..d.......................................................@...........................................UPX0.....p..............................UPX1.....0......."..................@....rsrc................&..............@......................................................................................................................................................................................................................................................................................................................................................3.96.UPX!.$..

                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI2802\Crypto\Cipher\_raw_ctr.pyd

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Roaming\empyrean\dat.txt
                                                                                                                                                                                                                                            File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):11264
                                                                                                                                                                                                                                            Entropy (8bit):6.939657038298525
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:192:Tkje/clVEmNVPjkTnA614twLFhS3YO7C6W1wQykyUxaVXFaL6nvYF:8L1Bjul19GjW1wBnUxaVXALx
                                                                                                                                                                                                                                            MD5:D67F83D1482D9600AC012868FB49D16E
                                                                                                                                                                                                                                            SHA1:55C34243CDD930D76155EDF2D723FAA60A3A6865
                                                                                                                                                                                                                                            SHA-256:AA463CD4D0B4BBD4159650D66C11A699B23775BF92455FB58A2206B932A65FEC
                                                                                                                                                                                                                                            SHA-512:94E9599723BF697EAEEB0401EF80A75E46208C1984DF63A315A3CDE1A7C97DB070353ACB0712CEC887C04CAD9755A2E4E357A10B2D40F23F0B44EE277D4F4BDB
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Antivirus:
                                                                                                                                                                                                                                            • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........F...(...(...(......(..)...(..)...(...)...(..-...(..,...(..+...(... ...(...(...(.......(...*...(.Rich..(.........PE..d...ba.c.........." ...".0.......p..@.....................................................`.........................................L..........\............P......................................................8...@...........................................UPX0.....p..............................UPX1.....0.......$..................@....rsrc................(..............@......................................................................................................................................................................................................................................................................................................................................................................3.96.UPX!.$..

                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI2802\Crypto\Cipher\_raw_des.pyd

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Roaming\empyrean\dat.txt
                                                                                                                                                                                                                                            File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):17408
                                                                                                                                                                                                                                            Entropy (8bit):7.508920120657843
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:384:/roOiYb00oHet1Y8z+r99tbr4FntSKVjoqDB+7XnUxaVXALP:/rpiDHm16B9RQSKCnrc
                                                                                                                                                                                                                                            MD5:B0EEF5CEAE8BA5E2A04C17B2B6AE87B5
                                                                                                                                                                                                                                            SHA1:6EA2736EE6F6955F0DBBD3A3ACC78CDD9121E468
                                                                                                                                                                                                                                            SHA-256:C9BBA124BE36ADA4549276D984BB3812EE2207C7DBF646EC6DF9A968E83205FB
                                                                                                                                                                                                                                            SHA-512:CE270FD23C2761D066D513B493C08A939CA29D94566EE39D0118BACB1619B5D860EBCFDCAE01F9A0B556DA95AFA8D34CF4E2234E302DE2408FFFA1972F643DEF
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Antivirus:
                                                                                                                                                                                                                                            • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........3.ANRg.NRg.NRg.G*..JRg...f.LRg..*f.MRg.NRf.hRg...b.BRg...c.FRg...d.JRg...o.ORg...g.ORg.....ORg...e.ORg.RichNRg.........PE..d...`a.c.........." ...".@..........`N... ...................................p............`.........................................Lb.......`..\....`..........l............b......................................XZ..@...........................................UPX0....................................UPX1.....@... ...<..................@....rsrc........`.......@..............@......................................................................................................................................................................................................................................................................................................................................................................3.96.UPX!.$..

                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI2802\Crypto\Cipher\_raw_des3.pyd

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Roaming\empyrean\dat.txt
                                                                                                                                                                                                                                            File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):17408
                                                                                                                                                                                                                                            Entropy (8bit):7.495463921230312
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:384:eroO1wQv0BMJr0DW6EeBrSBnUxaVXAL8:erp1w3eF0DxzrMX
                                                                                                                                                                                                                                            MD5:D892F9D789C22787D846E405D0240987
                                                                                                                                                                                                                                            SHA1:F3B728D04904E5FD3465C7665F7FDE2318E623C3
                                                                                                                                                                                                                                            SHA-256:100CD322EA2F8E3997432D6E292373F3A07F75818C7802D7386E9810BEE619B0
                                                                                                                                                                                                                                            SHA-512:00FFAC3215FFA3DFAB82A32B569BC632E704B134AF4E3418DFBC91CCE9FA09D7E10B471B24183DFA1AEFA292B345BDDC030547FCCE1162F6AC5E464DFA7CF0E9
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Antivirus:
                                                                                                                                                                                                                                            • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........3.ANRg.NRg.NRg.G*..JRg...f.LRg..*f.MRg.NRf.hRg...b.BRg...c.FRg...d.JRg...o.ORg...g.ORg.....ORg...e.ORg.RichNRg.........PE..d...`a.c.........." ...".@..........0N... ...................................p............`.........................................Lb.......`..\....`.......................b......................................(Z..@...........................................UPX0....................................UPX1.....@... ...<..................@....rsrc........`.......@..............@......................................................................................................................................................................................................................................................................................................................................................................3.96.UPX!.$..

                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI2802\Crypto\Cipher\_raw_ecb.pyd

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Roaming\empyrean\dat.txt
                                                                                                                                                                                                                                            File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):9216
                                                                                                                                                                                                                                            Entropy (8bit):6.822560284810641
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:192:h51aJh9fUQeV9tUhHQBYwkyUxaVXFaLuHB:h5k9s9tSHkYwnUxaVXALk
                                                                                                                                                                                                                                            MD5:F94726F6B584647142EA6D5818B0349D
                                                                                                                                                                                                                                            SHA1:4AA9931C0FF214BF520C5E82D8E73CEEB08AF27C
                                                                                                                                                                                                                                            SHA-256:B98297FD093E8AF7FCA2628C23A9916E767540C3C6FA8894394B5B97FFEC3174
                                                                                                                                                                                                                                            SHA-512:2B40A9B39F5D09EB8D7DDAD849C8A08AB2E73574EE0D5DB132FE8C8C3772E60298E0545516C9C26EE0B257EBDA59CFE1F56EF6C4357EF5BE9017C4DB4770D238
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Antivirus:
                                                                                                                                                                                                                                            • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......&6).bWG.bWG.bWG.k/..`WG.-+F.`WG.)/F.aWG.bWF.AWG.-+B.iWG.-+C.jWG.-+D.aWG.+O.cWG.+G.cWG.+..cWG.+E.cWG.RichbWG.........................PE..d...aa.c.........." ...". .......p........................................................`.................................................................@..........................................................@...........................................UPX0.....p..............................UPX1..... ..........................@....rsrc................ ..............@......................................................................................................................................................................................................................................................................................................................................................3.96.UPX!.$..

                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI2802\Crypto\Cipher\_raw_eksblowfish.pyd

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Roaming\empyrean\dat.txt
                                                                                                                                                                                                                                            File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):15872
                                                                                                                                                                                                                                            Entropy (8bit):7.411957303167114
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:384:emM80n0sH6HhpbHIQ5TsgOnLC9DS4pf12SnUxaVXALbOd:emMT0tzIQ5AgYmS4pf1DJ
                                                                                                                                                                                                                                            MD5:E5021B9925A53B20946C93B5BF686647
                                                                                                                                                                                                                                            SHA1:DEEA7DA72EE7D2511E68B9F3D28B20B3A4AD6676
                                                                                                                                                                                                                                            SHA-256:87922D0EE99AF46080AFD4BAA2F96219FA195731C0745FCB9C7789338ECC778F
                                                                                                                                                                                                                                            SHA-512:E8A6B382C17138D9B33AE6ED8C1DFE93166E304A987BF326D129AE31948F91429F73EBD204C772C9679B35AFEA0A8E9DF613BCEC7F46C6E1448B226EB2C2A507
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Antivirus:
                                                                                                                                                                                                                                            • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........EY.o+..o+..o+......o+...*..o+...*..o+..o*..o+......o+.../..o+...(..o+...#..o+...+..o+......o+...)..o+.Rich.o+.................PE..d..._a.c.........." ...".@................................................................`.........................................L...........\............p..........................................................@...........................................UPX0....................................UPX1.....@.......6..................@....rsrc................:..............@..............................................................................................................................................................................................................................................................................................................................................................3.96.UPX!.$..

                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI2802\Crypto\Cipher\_raw_ocb.pyd

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Roaming\empyrean\dat.txt
                                                                                                                                                                                                                                            File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):11776
                                                                                                                                                                                                                                            Entropy (8bit):7.033792220569869
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:192:Cm3adl/1JXscT11V9X8IdxqX+74RB6qT/lr5kyUxaVXFaLmHB:C6IXn11V9RrHkz6a5nUxaVXALs
                                                                                                                                                                                                                                            MD5:A76AEB47A31FD7F652C067AC1EA6D227
                                                                                                                                                                                                                                            SHA1:FF2D8E14E8A99F5C78C960C2AFD5BE2F9ED627AB
                                                                                                                                                                                                                                            SHA-256:C816F4A89CE6126DA70CB44062294A6A4AC0F73EC3A73EAD9269425B7B82288A
                                                                                                                                                                                                                                            SHA-512:C7CEC6A125904FCB42A6933520F88A6A1AA43FED9ECD40E20DDDDA9AC2DAC37E4D1D79951FF947A10AFB7C067C441DDF7DE9AF4E4BD56D73C1284962C085C1E9
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Antivirus:
                                                                                                                                                                                                                                            • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........%Y.oK..oK..oK......oK...J..oK...J..oK..oJ..oK...N..oK...O..oK...H..oK...C..oK...K..oK......oK...I..oK.Rich.oK.........................PE..d...ba.c.........." ...".0..........`.....................................................`.........................................L...........\............`..............H.......................................X...@...........................................UPX0....................................UPX1.....0.......&..................@....rsrc................*..............@......................................................................................................................................................................................................................................................................................................................................................3.96.UPX!.$..

                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI2802\Crypto\Cipher\_raw_ofb.pyd

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Roaming\empyrean\dat.txt
                                                                                                                                                                                                                                            File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):10240
                                                                                                                                                                                                                                            Entropy (8bit):6.750046576159352
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:192:HQE6Ckai65ePzhVTL8Q5xh9XkyUxaVXFaLy3MJ:Z6ChJstpDxh9XnUxaVXALl
                                                                                                                                                                                                                                            MD5:EEA83B9021675C8CA837DFE78B5A3A58
                                                                                                                                                                                                                                            SHA1:3660833FF743781E451342BB623FA59229AE614D
                                                                                                                                                                                                                                            SHA-256:45A4E35231E504B0D50A5FD5968AB6960CB27D197F86689477701D79D8B95B3B
                                                                                                                                                                                                                                            SHA-512:FCDCCEA603737364DBDBBCD5763FD85AEB0C175E6790128C93360AF43E2587D0FD173BEE4843C681F43FB63D57FCAEF1A58BE683625C905416E0C58AF5BF1D6C
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Antivirus:
                                                                                                                                                                                                                                            • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........EY.o+..o+..o+......o+...*..o+...*..o+..o*..o+......o+.../..o+...(..o+...#..o+...+..o+......o+...)..o+.Rich.o+.................PE..d...ba.c.........." ...". .......p........................................................`.........................................L..........\............P..X.......................................................@...........................................UPX0.....p..............................UPX1..... ....... ..................@....rsrc................$..............@..............................................................................................................................................................................................................................................................................................................................................................3.96.UPX!.$..

                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI2802\Crypto\Hash\_BLAKE2b.pyd

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Roaming\empyrean\dat.txt
                                                                                                                                                                                                                                            File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):11776
                                                                                                                                                                                                                                            Entropy (8bit):6.977802787830596
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:192:Hlqi6CkaiGp4OUdGyXOidiPFiV2ekyUxaVXFaL6n2fOG:FP6ChtCOesPDenUxaVXALDG
                                                                                                                                                                                                                                            MD5:1BF5CD751AED60DD92D0AB3CE6D773FA
                                                                                                                                                                                                                                            SHA1:897A5F74BBAC0B1BD7CB2DD598AA9B3B7BED326D
                                                                                                                                                                                                                                            SHA-256:CDA73AF34E4F542646952BBCB71559CCBDF3695AA74ED41D37A4A7D1F932A42D
                                                                                                                                                                                                                                            SHA-512:81113CFCEF2F434E9AC39B4B9CF08E67F1D84EAAA5A3CFFC5D088410E6E6480057DA1915AA22A8E01BE69418247C29D921D481D0577B810D99AC815D82D9F37E
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Antivirus:
                                                                                                                                                                                                                                            • Antivirus: ReversingLabs, Detection: 4%
                                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........EY.o+..o+..o+......o+...*..o+...*..o+..o*..o+......o+.../..o+...(..o+...#..o+...+..o+......o+...)..o+.Rich.o+.................PE..d...]a.c.........." ...".0.......p........................................................`.........................................L..........\............P..@.......................................................@...........................................UPX0.....p..............................UPX1.....0.......&..................@....rsrc................*..............@..............................................................................................................................................................................................................................................................................................................................................................3.96.UPX!.$..

                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI2802\Crypto\Hash\_BLAKE2s.pyd

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Roaming\empyrean\dat.txt
                                                                                                                                                                                                                                            File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):11264
                                                                                                                                                                                                                                            Entropy (8bit):7.1469700456721625
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:192:HbH1U5KE2S8oKi7hn8QEcJtFnlZlmJ6pcfUcqEQbxwl22wUF2MXkyUxaVXFaLtnj:iK1S8oh7h8BcJ5ZlmYcfUcqEQb2lzFNW
                                                                                                                                                                                                                                            MD5:821670341B5465047733CC460856A2F5
                                                                                                                                                                                                                                            SHA1:E0A1BBC859A1F502BA086DDD8BCED82AB6843399
                                                                                                                                                                                                                                            SHA-256:84780C05C9AD7B1E554211CD31BBCB02CBE587E4F08BD2D0B9561D104C4D125C
                                                                                                                                                                                                                                            SHA-512:5F617695EA9A5312DBBD13E379E124A96692CC228B0BC366B93CDCDAF3E23375602D9E81CF5A4286A5CEDEAAE635F11120C2C2390876BF3FD7398C59044BE82F
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Antivirus:
                                                                                                                                                                                                                                            • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........EY.o+..o+..o+......o+...*..o+...*..o+..o*..o+......o+.../..o+...(..o+...#..o+...+..o+......o+...)..o+.Rich.o+.................PE..d...]a.c.........." ...".0.......p........................................................`.........................................L..........\............P..@.......................................................@...........................................UPX0.....p..............................UPX1.....0.......$..................@....rsrc................(..............@..............................................................................................................................................................................................................................................................................................................................................................3.96.UPX!.$..

                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI2802\Crypto\Hash\_MD2.pyd

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Roaming\empyrean\dat.txt
                                                                                                                                                                                                                                            File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):10752
                                                                                                                                                                                                                                            Entropy (8bit):6.941977635771166
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:192:CR911+odumclYlXkeQ67WsVa6b0/XovtI2uLHkyUxaVXFaLtniW2B:COH5YmexVrblvl4HnUxaVXALg7B
                                                                                                                                                                                                                                            MD5:11A097C3DFDCFBB2ACB2EE0C92A9CB10
                                                                                                                                                                                                                                            SHA1:D15EF7DF71C8549B9B956DAC89E2542D1452ED08
                                                                                                                                                                                                                                            SHA-256:DAE038EB9D1CCDE31F9889818DB281AE70588FF5AB94A2AB7F33F8A1708F7325
                                                                                                                                                                                                                                            SHA-512:29149388B53FD85F7E77A0AE0ACFD172D73CC1443195A98B7392C494998998017EF11E16FAABBA479996FA2424D4C3CED2251FB5D8852A76FB2341F08AD08C01
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Antivirus:
                                                                                                                                                                                                                                            • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........%Y.oK..oK..oK......oK...J..oK...J..oK..oJ..oK...N..oK...O..oK...H..oK...C..oK...K..oK......oK...I..oK.Rich.oK.........................PE..d...Va.c.........." ...".0.......p........................................................`.........................................L..........\............P..(......................................................@...........................................UPX0.....p..............................UPX1.....0......."..................@....rsrc................&..............@......................................................................................................................................................................................................................................................................................................................................................3.96.UPX!.$..

                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI2802\Crypto\Hash\_MD4.pyd

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Roaming\empyrean\dat.txt
                                                                                                                                                                                                                                            File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):10752
                                                                                                                                                                                                                                            Entropy (8bit):7.05097021372971
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:192:CgwgkM1OqY2hQbIGcKqV31LGT63hjvYx4kyUxaVXFaLonXlFw:Cxw/hwI2q11LnO4nUxaVXALkXw
                                                                                                                                                                                                                                            MD5:D32A2064E2DA99B370F277026BB54747
                                                                                                                                                                                                                                            SHA1:1F12598490871A86B6E2B46527DD3F10B30B183D
                                                                                                                                                                                                                                            SHA-256:959EA4BB2F433F79CBC4AFD7E77CD256E3E67416E9E6AA0E3646BCAF686E40CD
                                                                                                                                                                                                                                            SHA-512:0A2ECE5075FF9212863D80AEFFAB356B314EED3CC806C599C7665F62C30CD726CE8EC00922DFDC2E8F5AE3E2A9D9B9F7B4BD1677A02623034332DFD0413D3E02
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Antivirus:
                                                                                                                                                                                                                                            • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........%Y.oK..oK..oK......oK...J..oK...J..oK..oJ..oK...N..oK...O..oK...H..oK...C..oK...K..oK......oK...I..oK.Rich.oK.........................PE..d...Va.c.........." ...".0.......p........................................................`.........................................L..........\............P..(.......................................................@...........................................UPX0.....p..............................UPX1.....0......."..................@....rsrc................&..............@......................................................................................................................................................................................................................................................................................................................................................3.96.UPX!.$..

                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI2802\Crypto\Hash\_MD5.pyd

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Roaming\empyrean\dat.txt
                                                                                                                                                                                                                                            File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):12288
                                                                                                                                                                                                                                            Entropy (8bit):7.136950075672147
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:192:C1sG1qextX4NJ9Lx8ZTZUaiQgp0AdXeST53lHA3WUkyUxaVXFaLHnU8:C2kX4NJOTmQg1dXeS1NAGUnUxaVXAL0
                                                                                                                                                                                                                                            MD5:EE11CB538BDAB49AA3499C394060F5CE
                                                                                                                                                                                                                                            SHA1:43B018D561A3201D3AA96951B8A1380D4AEB92B1
                                                                                                                                                                                                                                            SHA-256:23DDA5CE329198FE9471C7DCA31AF69144AB7A350D3E6F11D60E294C7996B1CA
                                                                                                                                                                                                                                            SHA-512:AFBDB4692AC186F62AE3B53803F8A7357E32EB40732D095A7086566B94592C3E056B48C6CA6C62742B8DE14C7F309496F83B664C42D55E679AFA60B4F1468832
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Antivirus:
                                                                                                                                                                                                                                            • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........%Y.oK..oK..oK......oK...J..oK...J..oK..oJ..oK...N..oK...O..oK...H..oK...C..oK...K..oK......oK...I..oK.Rich.oK.........................PE..d...Wa.c.........." ...".0.......p.......................................................`.........................................L..........\............P..X......................................................@...........................................UPX0.....p..............................UPX1.....0.......(..................@....rsrc................,..............@......................................................................................................................................................................................................................................................................................................................................................3.96.UPX!.$..

                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI2802\Crypto\Hash\_RIPEMD160.pyd

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Roaming\empyrean\dat.txt
                                                                                                                                                                                                                                            File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):11264
                                                                                                                                                                                                                                            Entropy (8bit):6.909373515854209
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:192:Hsi6CkaTs6Ac86kwsvQrehMrP+bekyUxaVXFaL2nPV7:p6ChT1AjzQa6P+benUxaVXALGp
                                                                                                                                                                                                                                            MD5:19CA6E706818CF08F91EBB82BF9911E9
                                                                                                                                                                                                                                            SHA1:AB53841686BD55FC58A7262A79568A714A6D870B
                                                                                                                                                                                                                                            SHA-256:11933E4F74368B334C1D2118D4E975533185517264CA45F3382274DD27540DEB
                                                                                                                                                                                                                                            SHA-512:658908AA5487DC398B58E9EA704E83A63146C7D87126FA275296263C981AF48D08AB3D20D541401EB0A22489AD23991E32E6238BCAF46DAFFFA971EC769FFE96
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Antivirus:
                                                                                                                                                                                                                                            • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........EY.o+..o+..o+......o+...*..o+...*..o+..o*..o+......o+.../..o+...(..o+...#..o+...+..o+......o+...)..o+.Rich.o+.................PE..d...\a.c.........." ...".0.......p.......................................................`.........................................L..........\............P..............$..........................................@...........................................UPX0.....p..............................UPX1.....0.......$..................@....rsrc................(..............@..............................................................................................................................................................................................................................................................................................................................................................3.96.UPX!.$..

                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI2802\Crypto\Hash\_SHA1.pyd

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Roaming\empyrean\dat.txt
                                                                                                                                                                                                                                            File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):13312
                                                                                                                                                                                                                                            Entropy (8bit):7.240942496482241
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:384:CDyIXn11ON21FUOyquRmMS17VCgHgmynUxaVXALana4:CDyQ11a21FYjRmMAVULZ
                                                                                                                                                                                                                                            MD5:D28807CB842B8A9F7611175CBBBC8867
                                                                                                                                                                                                                                            SHA1:FFB37BCC48B93D47EC6BA442E1BC7AA90A98246A
                                                                                                                                                                                                                                            SHA-256:C6870DB1D8518D0E594C7E7A0271636BCFCCAF58BE584A20E2A7EFCE1E3D4BB7
                                                                                                                                                                                                                                            SHA-512:0C9B1E751BDC8B995BF3BB8B90E884009F80D39E48AE679EB1551AD74D9A4987B80858EC180DCF81F25247571EB07B051E564F64594A4374E7BF5B07F68B90E8
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Antivirus:
                                                                                                                                                                                                                                            • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........%Y.oK..oK..oK......oK...J..oK...J..oK..oJ..oK...N..oK...O..oK...H..oK...C..oK...K..oK......oK...I..oK.Rich.oK.........................PE..d...Wa.c.........." ...".0................................................................`.........................................L...........\............`..X...........$...........................................@...........................................UPX0....................................UPX1.....0.......,..................@....rsrc................0..............@......................................................................................................................................................................................................................................................................................................................................................3.96.UPX!.$..

                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI2802\Crypto\Hash\_SHA224.pyd

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Roaming\empyrean\dat.txt
                                                                                                                                                                                                                                            File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):14848
                                                                                                                                                                                                                                            Entropy (8bit):7.292530574848384
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:384:C6PTNMvsMA5oqMs6C5JWBCZy6nUxaVXALe:C6pMvsbtqwvN
                                                                                                                                                                                                                                            MD5:3ADAFA903E2D2681181606C962A83E62
                                                                                                                                                                                                                                            SHA1:D9963B1A62DE6A0CD4E319BC24E1F6D86E5FB74C
                                                                                                                                                                                                                                            SHA-256:407318F348E50F68E9C0517467BD9FB9AB40823302A84CB56B4E015A76821D17
                                                                                                                                                                                                                                            SHA-512:F1B90E760878D8D3E8801C42CDA4F3651E95B0F12DF49458637D7BC4B87780B4E914345E5854EAC2EB34668E0A088F526BC6360B0DD0597A8B3CD38A1708D837
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Antivirus:
                                                                                                                                                                                                                                            • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........%Y.oK..oK..oK......oK...J..oK...J..oK..oJ..oK...N..oK...O..oK...H..oK...C..oK...K..oK......oK...I..oK.Rich.oK.........................PE..d...Ya.c.........." ...".@..........P.....................................................`.........................................L...........\............p..............4...$...................................H...@...........................................UPX0....................................UPX1.....@.......2..................@....rsrc................6..............@......................................................................................................................................................................................................................................................................................................................................................3.96.UPX!.$..

                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI2802\Crypto\Hash\_SHA256.pyd

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Roaming\empyrean\dat.txt
                                                                                                                                                                                                                                            File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):14848
                                                                                                                                                                                                                                            Entropy (8bit):7.305090410676597
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:384:C/PTNMvsMA5oqPFQrVLOhFsCpem+EnUxaVXALe:C/pMvspFQRihFsCppN
                                                                                                                                                                                                                                            MD5:FDA96B4CA2499DE84F3F982B536911DF
                                                                                                                                                                                                                                            SHA1:898E6DA58A9F99C2E97B7B968C7BB905CD1B8E3F
                                                                                                                                                                                                                                            SHA-256:DDAF1B7C30CC0BAC0A30845C8279D9DE3E3165149FBA5BCBF5FE9C06849E97CB
                                                                                                                                                                                                                                            SHA-512:91DE91D99D9E1AB1DECE569031B4C94EB31438235CC54FD5D9DB1C6C6588E99B5A12C8731ED02D89ADB635AE32A6217336D4EA212A28F318B8D2FA5D157674F1
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Antivirus:
                                                                                                                                                                                                                                            • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........%Y.oK..oK..oK......oK...J..oK...J..oK..oJ..oK...N..oK...O..oK...H..oK...C..oK...K..oK......oK...I..oK.Rich.oK.........................PE..d...Xa.c.........." ...".@..........P.....................................................`.........................................L...........\............p..............4...$...................................H...@...........................................UPX0....................................UPX1.....@.......2..................@....rsrc................6..............@......................................................................................................................................................................................................................................................................................................................................................3.96.UPX!.$..

                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI2802\Crypto\Hash\_SHA384.pyd

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Roaming\empyrean\dat.txt
                                                                                                                                                                                                                                            File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):15360
                                                                                                                                                                                                                                            Entropy (8bit):7.387902805722102
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:384:CZKaj0o+l4vgQDD7pvJhEkgEo9nUxaVXALQ6:C8MDWoFDnpvWbX
                                                                                                                                                                                                                                            MD5:961ED0A2E355E9D15D98918438E75F2C
                                                                                                                                                                                                                                            SHA1:044210C4B576E85333ACC7911D6B65AAA7D2AE6D
                                                                                                                                                                                                                                            SHA-256:F3526F51E53E2DC1251893DD345AD59F519F9C3C69860AE8320E029241676D59
                                                                                                                                                                                                                                            SHA-512:DD7E9352E0C132C9FCE841D0C9A40D27C99E99661F5452760E67A09CACC701081FCAE46BD90E1D81EBD7F1C641C271767BE5D1D76A72E8FD0728AA069B330606
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Antivirus:
                                                                                                                                                                                                                                            • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........%Y.oK..oK..oK......oK...J..oK...J..oK..oJ..oK...N..oK...O..oK...H..oK...C..oK...K..oK......oK...I..oK.Rich.oK.........................PE..d...Za.c.........." ...".@................................................................`.........................................L...........\...........................4...........................................@...........................................UPX0....................................UPX1.....@.......4..................@....rsrc................8..............@......................................................................................................................................................................................................................................................................................................................................................3.96.UPX!.$..

                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI2802\Crypto\Hash\_SHA512.pyd

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Roaming\empyrean\dat.txt
                                                                                                                                                                                                                                            File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):15360
                                                                                                                                                                                                                                            Entropy (8bit):7.456796403229419
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:384:CWKaj0t9/BuZh2MulpDvqyGxTvnUxaVXALF:CTMw9/BMhruKyGxDO
                                                                                                                                                                                                                                            MD5:17BDD9F18FC0BA23BCF7A2F0DBE6C34D
                                                                                                                                                                                                                                            SHA1:09D42AE8EC33CA02B9889132A4957D0FE4274BB5
                                                                                                                                                                                                                                            SHA-256:820C8E6E5C7480A709B3665848884BA9D852163C79560A651131DE89ACE0261A
                                                                                                                                                                                                                                            SHA-512:91DBCD8654F7404A8CD9A40912B995F45FE5A405AF78737B6DFB113DB6DAE12D9D36BF773CC702E2696BF79AB21F2EC505FFA87F74575DFD45C449A03C40A7F2
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Antivirus:
                                                                                                                                                                                                                                            • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........%Y.oK..oK..oK......oK...J..oK...J..oK..oJ..oK...N..oK...O..oK...H..oK...C..oK...K..oK......oK...I..oK.Rich.oK.........................PE..d...\a.c.........." ...".@................................................................`.........................................L...........\...........................4...........................................@...........................................UPX0....................................UPX1.....@.......4..................@....rsrc................8..............@......................................................................................................................................................................................................................................................................................................................................................3.96.UPX!.$..

                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI2802\Crypto\Hash\_ghash_clmul.pyd

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Roaming\empyrean\dat.txt
                                                                                                                                                                                                                                            File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):10752
                                                                                                                                                                                                                                            Entropy (8bit):6.789317389612839
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:192:p1U5KEc/Y4ELhbko1JQdwXBSkyUxaVXFaLZnxzm:EKX/shnQduSnUxaVXALr
                                                                                                                                                                                                                                            MD5:461EFFE91D16420811D0ADB865654DE7
                                                                                                                                                                                                                                            SHA1:863AD8549892CB921DFFC35559FC7385598BF0A9
                                                                                                                                                                                                                                            SHA-256:0F322BFB8F6C26DF329D6254B2FE8A25C1AB4AB51F9404F6EAE943E0A253F469
                                                                                                                                                                                                                                            SHA-512:CC05A3D9A6F48AFD8E70BFABC870156E50D2CE6509E4E46C0F5567EAF1C2CC1AB52B8CA1990861E46AF569DE9717219BB205860D48177241D44BF573C0F50CDF
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Antivirus:
                                                                                                                                                                                                                                            • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........&...H...H...H......H..I...H..I...H...I...H..M...H..L...H..K...H...@...H...H...H.......H...J...H.Rich..H.........................PE..d...]a.c.........." ...".0.......p.......................................................`.........................................T..........d............P..................$......................................@...........................................UPX0.....p..............................UPX1.....0......."..................@....rsrc................&..............@......................................................................................................................................................................................................................................................................................................................................................3.96.UPX!.$..

                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI2802\Crypto\Hash\_ghash_portable.pyd

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Roaming\empyrean\dat.txt
                                                                                                                                                                                                                                            File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):10752
                                                                                                                                                                                                                                            Entropy (8bit):6.817402405280982
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:192:Hje1U5KEc/Y4EL94AxD9JFkyUxaVXFaLfnpT:RKX/s9D9JFnUxaVXALh
                                                                                                                                                                                                                                            MD5:3057B01EC05D6ABD5CEE82EC2E4CFB06
                                                                                                                                                                                                                                            SHA1:A82D7D2183AD2C4D5B68B805DEA6487B9FDD3E43
                                                                                                                                                                                                                                            SHA-256:2DB1135EC696600AB7D53634BACAD4BBCB8DC25B09E6BD2C2633E8DF75736082
                                                                                                                                                                                                                                            SHA-512:1548894E039DFB33C17EB9CDB05C6C31F8D993C285898522E0776A063D2240F9F48F8717F9598A4957B5673B3256652E7FD2260D1E9DB34FA86D144925C06A52
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Antivirus:
                                                                                                                                                                                                                                            • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........EY.o+..o+..o+......o+...*..o+...*..o+..o*..o+......o+.../..o+...(..o+...#..o+...+..o+......o+...)..o+.Rich.o+.................PE..d...]a.c.........." ...".0.......p.......................................................`.........................................L..........\............P..X...............$......................................@...........................................UPX0.....p..............................UPX1.....0......."..................@....rsrc................&..............@..............................................................................................................................................................................................................................................................................................................................................................3.96.UPX!.$..

                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI2802\Crypto\Hash\_keccak.pyd

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Roaming\empyrean\dat.txt
                                                                                                                                                                                                                                            File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):12288
                                                                                                                                                                                                                                            Entropy (8bit):7.060617294398413
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:192:CVj1ole1gwA1QapW0MEGqvjtv7ovK+u8NsS1mZKQ6kkyUxaVXFaLHncx:CSe1rwtph4q7JoSb8N5cKHknUxaVXAL8
                                                                                                                                                                                                                                            MD5:EB197359306DAA1DF7E19DC1E85D046F
                                                                                                                                                                                                                                            SHA1:B0D013525C512F887BEB025F855E439D654877E3
                                                                                                                                                                                                                                            SHA-256:8BB9B9E91287E12F867A53E0D6C8067FB9344FFB46CE6D874E44A6E89C8FE14D
                                                                                                                                                                                                                                            SHA-512:EBD339879E0DA163008DF5195316C086035BB980878A61E031E34FDC74253BF7AD495EC97FE1057BD5FA3D322C6C707ADF405709DD44834238F705435E02CC1B
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Antivirus:
                                                                                                                                                                                                                                            • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........%Y.oK..oK..oK......oK...J..oK...J..oK..oJ..oK...N..oK...O..oK...H..oK...C..oK...K..oK......oK...I..oK.Rich.oK.........................PE..d...\a.c.........." ...".0.......p........................................................`.........................................L..........\............P..p...........@...........................................@...........................................UPX0.....p..............................UPX1.....0.......(..................@....rsrc................,..............@......................................................................................................................................................................................................................................................................................................................................................3.96.UPX!.$..

                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI2802\Crypto\Hash\_poly1305.pyd

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Roaming\empyrean\dat.txt
                                                                                                                                                                                                                                            File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):11776
                                                                                                                                                                                                                                            Entropy (8bit):7.021267811320247
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:192:CV011I5c1918YWN+ZnOsrjHDSyPrmnbNnYyDgIkyUxaVXFaLKnBC:CwYcfWYWJsrTDSKrmbYInUxaVXALY
                                                                                                                                                                                                                                            MD5:B18D6148260D3F01B4CFB38EE35F76BB
                                                                                                                                                                                                                                            SHA1:87064360D9A06D9B8507AA6CB3C9C49FACB2D159
                                                                                                                                                                                                                                            SHA-256:E82A778AB0A50807F9E895761E4BCDE2AB1F194B0BEA29BB1242F782388C3322
                                                                                                                                                                                                                                            SHA-512:6C2DB42605B6B8125860EB666149C186BB02ACD2CD769FE0D494E7566D30824663DC9C4A19A654FD6CB0DC62E9EC13B105FB6C67B288E8B8BEC65EC5DDF2CD9A
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Antivirus:
                                                                                                                                                                                                                                            • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........%Y.oK..oK..oK......oK...J..oK...J..oK..oJ..oK...N..oK...O..oK...H..oK...C..oK...K..oK......oK...I..oK.Rich.oK.........................PE..d...^a.c.........." ...".0.......p..`.....................................................`.........................................L..........\............P..|...................................................X...@...........................................UPX0.....p..............................UPX1.....0.......&..................@....rsrc................*..............@......................................................................................................................................................................................................................................................................................................................................................3.96.UPX!.$..

                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI2802\Crypto\Math\_modexp.pyd

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Roaming\empyrean\dat.txt
                                                                                                                                                                                                                                            File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):20480
                                                                                                                                                                                                                                            Entropy (8bit):7.522268054098919
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:384:jVIehK2iflZpwNAFvzReHErimGpOqQ8lxiFviBaDOA5/cnUxaVXALaY:jVruHdRecEJlw58A5EBY
                                                                                                                                                                                                                                            MD5:22720D896AFDBCDCBD949F5D5492C82B
                                                                                                                                                                                                                                            SHA1:86A9A1DC7F6B0BFB37977824DF983943BE3141CE
                                                                                                                                                                                                                                            SHA-256:6F355BF63DD20593F44DB12EAB941096EFD70F62D778BDEA546B48F0D055E881
                                                                                                                                                                                                                                            SHA-512:8F1840A9DAAC58AC18A13D2B810BA410FAEE133D12DF49BE76699073E96B766AA21C2116BEE9D45555E12CE0E2E516BCD3A561DF3528E9FA57980F1EA72C68EC
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Antivirus:
                                                                                                                                                                                                                                            • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......L..|.../.../.../..Q/.../G....../C....../.../#../G....../G....../G....../....../....../.=/.../....../Rich.../................PE..d...la.c.........." ...".P.......... ........................................ ............`.........................................L...d.......\...............$.......................................................@...........................................UPX0....................................UPX1.....P.......H..................@....rsrc................L..............@..............................................................................................................................................................................................................................................................................................................................................................3.96.UPX!.$..

                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI2802\Crypto\Protocol\_scrypt.pyd

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Roaming\empyrean\dat.txt
                                                                                                                                                                                                                                            File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):10240
                                                                                                                                                                                                                                            Entropy (8bit):6.826599062620208
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:192:z1Qxmkp6kBsHaEDzSbbc6PpnXJoBQ5hkyUxaVXFaLr3sUK:mbsHaEabcSJ5hnUxaVXALo
                                                                                                                                                                                                                                            MD5:FF7E401961C18D07C055B796A70E7D9F
                                                                                                                                                                                                                                            SHA1:71FEA35BE66E71445B22B957C9DE52CB72C42DAA
                                                                                                                                                                                                                                            SHA-256:0B23AC14EB398813E04F9116B66F77E93DEB2F9473C6534AAEEE0742128E219F
                                                                                                                                                                                                                                            SHA-512:3885E7579CA4953167CA8F171A239355E3A0B128620CD4919FD8336DDB7877BBAEA07B0EC987D3A3F00BE495778CA003EC2D694373CFA6450644A82F090CFE5D
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Antivirus:
                                                                                                                                                                                                                                            • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......................;..................................................................W.............Rich............................PE..d...ca.c.........." ...". .......p.......................................................`.........................................L...d......\............P..4......................................................@...........................................UPX0.....p..............................UPX1..... ....... ..................@....rsrc................$..............@......................................................................................................................................................................................................................................................................................................................................................3.96.UPX!.$..

                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI2802\Crypto\PublicKey\_ec_ws.pyd

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Roaming\empyrean\dat.txt
                                                                                                                                                                                                                                            File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):638976
                                                                                                                                                                                                                                            Entropy (8bit):7.998469740064385
                                                                                                                                                                                                                                            Encrypted:true
                                                                                                                                                                                                                                            SSDEEP:12288:3utRJVHFtuPQ5Yi66r+uWMkf51I6NqAvPBTd74LlSSgdd:+tRfltQiFrhWMkf53tvUhk
                                                                                                                                                                                                                                            MD5:9977AF4D41DBD25919E57275A3B6A60C
                                                                                                                                                                                                                                            SHA1:81BF50D93CB871B40F8E1C95A06BA7E1E5C77141
                                                                                                                                                                                                                                            SHA-256:7A467F18E2DFB9276F5CC6709102B70D004D8EEB55E3E53270419D3F3960EDFE
                                                                                                                                                                                                                                            SHA-512:C8021B01E0C7CFE3DA8006D1529DFEFE851B6ED9ECA104FACB17B3BDA2A6B6062143FA9A9B3462E4A0BE58E6579FC34B6520B9E267E1C9B27B9950AA0807C7C8
                                                                                                                                                                                                                                            Malicious:true
                                                                                                                                                                                                                                            Antivirus:
                                                                                                                                                                                                                                            • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......`...$..L$..L$..L-.#L"..Lk.M&..Lo.M'..L$..L...Lk.M(..Lk.M,..Lk.M'..L..M!..L..M%..L..OL%..L..M%..LRich$..L................PE..d...ha.c.........." ..."......... .......0................................................`.........................................L...d.......\...............l.......................................................@...........................................UPX0..... ..............................UPX1.........0......................@....rsrc...............................@..............................................................................................................................................................................................................................................................................................................................................................3.96.UPX!.$..

                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI2802\Crypto\PublicKey\_ed25519.pyd

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Roaming\empyrean\dat.txt
                                                                                                                                                                                                                                            File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):15872
                                                                                                                                                                                                                                            Entropy (8bit):7.446672321911902
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:384:N/6Y6GuC70NwWjL95yqC0AG1kOnUxaVXALR:J6UB7ewWOk1J6
                                                                                                                                                                                                                                            MD5:03AB1F87202DBBB7A0B911283F9628F6
                                                                                                                                                                                                                                            SHA1:968DCB59BFFFECD767160356449B2E6397CEB819
                                                                                                                                                                                                                                            SHA-256:7C6131D04BA4EBB0C4A5434ADD080A33A30E6DB7542A54BFE6EBE4CA3F13FAFF
                                                                                                                                                                                                                                            SHA-512:0170A3AE72141DABC95ACF21D3F9602F0BB0A47E1AA834E0FC01F7E75E727ACF9A6BEB66484327639EFEE12E0106A030E56121E604DEDA0DF3C44B3EA1C58706
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Antivirus:
                                                                                                                                                                                                                                            • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........Y.o...o...o.......o.......o.......o...o...o.......o.......o.......o.......o.......o....t..o.......o..Rich.o..................PE..d...ja.c.........." ...".@.......... .....................................................`.........................................L...0.......\...........................|...........................................@...........................................UPX0....................................UPX1.....@.......6..................@....rsrc................:..............@..............................................................................................................................................................................................................................................................................................................................................................3.96.UPX!.$..

                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI2802\Crypto\PublicKey\_ed448.pyd

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Roaming\empyrean\dat.txt
                                                                                                                                                                                                                                            File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):27136
                                                                                                                                                                                                                                            Entropy (8bit):7.716235505829019
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:384:N+U1/EIha4hI63riOlt0IVQNv3sdIHaOyyFOHBjXuwtd1INmDwvrFDh1nUxaVXAV:N+U1/jhVhd3riwKMTFJluwRE9fp0
                                                                                                                                                                                                                                            MD5:999485C3306CE844545D6FF32B1778F7
                                                                                                                                                                                                                                            SHA1:F6E146C47AA1992D91A46BDF1727BD752C9608A5
                                                                                                                                                                                                                                            SHA-256:933F66840E793D4897594E934B78D5513C5A4C6B28A930F2B3E89E5A0AA203AD
                                                                                                                                                                                                                                            SHA-512:315ED2B1CDDB0A5476DB91B6ABE041D772437E5C72E7F9D9A67B747E61E5DA2E5F4C035FE67487BB31E55B560F9846A908D927FBEF9CC791D36E578247B1CA6A
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Antivirus:
                                                                                                                                                                                                                                            • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......L..|.../.../.../..Q/.../G....../C....../.../#../G....../G....../G....../....../....../.=/.../....../Rich.../................PE..d...ka.c.........." ...".p...........s... ................................................`.........................................L...h......\............0..$...............$.......................................@...........................................UPX0....................................UPX1.....p... ...b..................@....rsrc................f..............@..............................................................................................................................................................................................................................................................................................................................................................3.96.UPX!.$..

                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI2802\Crypto\PublicKey\_x25519.pyd

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Roaming\empyrean\dat.txt
                                                                                                                                                                                                                                            File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):9216
                                                                                                                                                                                                                                            Entropy (8bit):6.731328673523401
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:192:O51aJh9fUQmKaF3wB0S57R2kyUxaVXFaLuHhE:O5k9C3a02R2nUxaVXALkE
                                                                                                                                                                                                                                            MD5:959E90A606763B4193A624D012974BB2
                                                                                                                                                                                                                                            SHA1:FC80DE8F6CFFFA0BA034948BCFFF8D8CDEBA29E5
                                                                                                                                                                                                                                            SHA-256:6D63F30609F05450906E8EBD8C90E47827BBBF9EA92906E984223FD51E4908A7
                                                                                                                                                                                                                                            SHA-512:78161B7FC028B90AC40477D1181A00294D4D96378BB88980B8D1A8B7C65814F50BACFDF389540EF3D8BAA3822282FC97981811C5685BD8123E59A614593B0EFB
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Antivirus:
                                                                                                                                                                                                                                            • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......&6!.bWO.bWO.bWO.k/..`WO.-+N.`WO.)/N.aWO.bWN.FWO.-+J.iWO.-+K.jWO.-+L.aWO.+G.cWO.+O.cWO.+..cWO.+M.cWO.RichbWO.........PE..d...ia.c.........." ...". .......p........................................................`.............................................P...................@..............P.......................................x...@...........................................UPX0.....p..............................UPX1..... ..........................@....rsrc................ ..............@......................................................................................................................................................................................................................................................................................................................................................................3.96.UPX!.$..

                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI2802\Crypto\Util\_cpuid_c.pyd

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Roaming\empyrean\dat.txt
                                                                                                                                                                                                                                            File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):9216
                                                                                                                                                                                                                                            Entropy (8bit):6.773387048001548
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:192:C51aJh9fUQeQT3VmqRDFkyUxaVXFaLuHxJ5:C5k9xrVmqBFnUxaVXAL0J5
                                                                                                                                                                                                                                            MD5:6499087EBA82E487F21D40A769C686B6
                                                                                                                                                                                                                                            SHA1:4C5E8759FB35C47221BDA61B6226499D75CBE7E4
                                                                                                                                                                                                                                            SHA-256:2F4B5EB8397D620FA37F794BCA32A95077F764B05DB51DBA9AD34C2E2946FF60
                                                                                                                                                                                                                                            SHA-512:CE183276F0FDCCAF8BE5C34F789F2C47BAB68DFB168E0C181DD0FCF8B4A8C99527CD83C59891DCD98BBEB160DBCE884C4ECEA5EE684DEEDFF845C6B3F8205518
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Antivirus:
                                                                                                                                                                                                                                            • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......&6).bWG.bWG.bWG.k/..`WG.-+F.`WG.)/F.aWG.bWF.AWG.-+B.iWG.-+C.jWG.-+D.aWG.+O.cWG.+G.cWG.+..cWG.+E.cWG.RichbWG.........................PE..d...aa.c.........." ...". .......p........................................................`.............................................|...................@..............|...........................................@...........................................UPX0.....p..............................UPX1..... ..........................@....rsrc................ ..............@......................................................................................................................................................................................................................................................................................................................................................3.96.UPX!.$..

                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI2802\Crypto\Util\_strxor.pyd

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Roaming\empyrean\dat.txt
                                                                                                                                                                                                                                            File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):9216
                                                                                                                                                                                                                                            Entropy (8bit):6.768064843872946
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:96:kbaMhzoscluM6bSM3cVhqj0rrp2C0DCLkyUx7P2EbfOlDhS+dY64At7S1TBIa+tm:zPWbS6Uhrl2hCLkyUxaVXFaLXHB
                                                                                                                                                                                                                                            MD5:9C34D1EC0B1C10FE8F53B9CAA572856A
                                                                                                                                                                                                                                            SHA1:141CDB91EC3C8135A4AC1FE879D82A9E078AB3CB
                                                                                                                                                                                                                                            SHA-256:4AB62B514BAE327476ADD45F5804895578E9F1658D8CF40AC5E7C4FB227469FA
                                                                                                                                                                                                                                            SHA-512:6447889FFE049579F3E09D5828393F7DC5268B2061895ED424F3C83B8C1929D6FECC6F8C9823C483F451C31458736D27D83EB3979A5C91703DAD913957717D09
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Antivirus:
                                                                                                                                                                                                                                            • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......&6).bWG.bWG.bWG.k/..`WG.-+F.`WG.)/F.aWG.bWF.AWG.-+B.iWG.-+C.jWG.-+D.aWG.+O.cWG.+G.cWG.+..cWG.+E.cWG.RichbWG.........................PE..d...ca.c.........." ...". .......p........................................................`.............................................t...................@..............t...........................................@...........................................UPX0.....p..............................UPX1..... ..........................@....rsrc................ ..............@......................................................................................................................................................................................................................................................................................................................................................3.96.UPX!.$..

                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI2802\PIL\_imaging.cp310-win_amd64.pyd

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Roaming\empyrean\dat.txt
                                                                                                                                                                                                                                            File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):750080
                                                                                                                                                                                                                                            Entropy (8bit):7.998268583758689
                                                                                                                                                                                                                                            Encrypted:true
                                                                                                                                                                                                                                            SSDEEP:12288:TcOlugK0Q4OCDzXvegFEiBqhzD/Yup9B2pMUHcNrIEvpyobII6QnKDzsrM/w+tR6:TcrCDD9bBqhzLhpvO3cNrDBnwQKDAMPp
                                                                                                                                                                                                                                            MD5:24B9ED7A68752B1FBFF8D6E4DEB3CCF2
                                                                                                                                                                                                                                            SHA1:B5F02F742F3E7DECA22B01AF2CDFE5049D187A86
                                                                                                                                                                                                                                            SHA-256:EA70560B18994EEC4C1E1856EDA5FD2108CC22F602F3721C1BEEDD1679996B12
                                                                                                                                                                                                                                            SHA-512:DB1373943986ED0B44DCA7FFAC7C96F955A648BE88B837805400CA774B5B70341D5A5F8AF2A6C59222B6BE2002737A40E74B1458344AA88417458699F928D978
                                                                                                                                                                                                                                            Malicious:true
                                                                                                                                                                                                                                            Antivirus:
                                                                                                                                                                                                                                            • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......#d.5g..fg..fg..fn}.fw..f(y.ge..f(yufc..f(y.gi..f(y.go..f(y.gc..f.p.ge..f,}.g`..fg..fc..f.y.g...fg..f|..f.y.g-..f.y.gf..f.ywff..f.y.gf..fRichg..f........PE..d.....'d.........." ...".p.......... .$...................................... %...........`...........................................%.`.....%.......%.......#............. .%. ...........................8.%.(...l.%.@...........................................UPX0....................................UPX1.....p.......h..................@....rsrc.........%......l..............@......................................................................................................................................................................................................................................................................................................................................3.96.UPX!.$..

                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI2802\PIL\_imagingcms.cp310-win_amd64.pyd

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Roaming\empyrean\dat.txt
                                                                                                                                                                                                                                            File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):96768
                                                                                                                                                                                                                                            Entropy (8bit):7.954287656970143
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:1536:8vaKG5Of6QM511dQ5FBvrlxRcqu0UrXQSYiEd+SU6+fRoPJH4NbrJ/Q/3aM6Q9/V:8SKy5dQ5XhxRDUrgbhdPF+fmBYN6OJf
                                                                                                                                                                                                                                            MD5:6733DB0C6AF1962358A2B0E819A23448
                                                                                                                                                                                                                                            SHA1:A7A095C71A3809DD1558CF5BEA17F7C16CBC5625
                                                                                                                                                                                                                                            SHA-256:3BCF5AD133FDD648C22B67D2819C923771D4586514D5E9D0051E088BA10BCBFC
                                                                                                                                                                                                                                            SHA-512:7FCC307ADD30ECDFEF1F2D7446CC6F202785195673A2ACE8F9C5250A2A64319FE7D7B9218847E9F93A1545CD65887D5D4A0B32EBB08EC012CD7D5AAA9306E099
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Antivirus:
                                                                                                                                                                                                                                            • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........rx..+..+..+...+..+...*..+...*..+...*..+...*..+!..*..+...*..+..+...+$..*...+$..*..+$..+..+$..*..+Rich..+........................PE..d.....'d.........." ...".p...........2.......................................P............`.........................................|D..h....@.......@..........\............D.......................................>..@...........................................UPX0....................................UPX1.....p.......p..................@....rsrc........@.......t..............@..............................................................................................................................................................................................................................................................................................................................................3.96.UPX!.$..

                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI2802\PIL\_imagingft.cp310-win_amd64.pyd

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Roaming\empyrean\dat.txt
                                                                                                                                                                                                                                            File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):692224
                                                                                                                                                                                                                                            Entropy (8bit):7.998379316295987
                                                                                                                                                                                                                                            Encrypted:true
                                                                                                                                                                                                                                            SSDEEP:12288:zj7kGcwm1BQ16D7fWH6uIcFVt19qDpBHlv+h9DBW7:zjIGcwmQKWH6SFTrqDpBx+LDa
                                                                                                                                                                                                                                            MD5:F63DA7EEDFC08FE144D3BF4E9556BF2D
                                                                                                                                                                                                                                            SHA1:727C28A211A6EB168FC4F1114D437530D0472C82
                                                                                                                                                                                                                                            SHA-256:78BAFB6ED313F0F5CC0115558FED81C46BA5055AADB5117B85373722C8DCCA16
                                                                                                                                                                                                                                            SHA-512:6A2A590CE32EA5581FAEB6B55DAE0D6156831267EC2B347E4B5C9602EE74A1EF58F182D56B25DCCF4E2C655ABFC2CD9240EC530536A1DBD0086B34EB37B793E3
                                                                                                                                                                                                                                            Malicious:true
                                                                                                                                                                                                                                            Antivirus:
                                                                                                                                                                                                                                            • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                            Preview:MZ......................@...................................(...........!..L.!This program cannot be run in DOS mode....$......................<................R............................X........................P.........Rich...........................PE..d.....'d.........." ..."................. ................................................`.........................................X...d......h............`..@.......................................................@...........................................UPX0....................................UPX1......... ......................@....rsrc...............................@......................................................................................................................................................................................................................................................................................................................3.96.UPX!.$..

                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI2802\PIL\_imagingtk.cp310-win_amd64.pyd

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Roaming\empyrean\dat.txt
                                                                                                                                                                                                                                            File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):12288
                                                                                                                                                                                                                                            Entropy (8bit):6.8574100581789965
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:192:DCK+UCIU7Aj+u54CJTiSVCWbFHj79+gCkyUxaVXFaL2HpAKdrye:D5CRt0iSVCWbZj78gCnUxaVXAL0AKdry
                                                                                                                                                                                                                                            MD5:94C237E6ACDBF6EE7F060D109C47B58B
                                                                                                                                                                                                                                            SHA1:ED5305A5CA7C5CA1E2246444A20C9EDC82F495C9
                                                                                                                                                                                                                                            SHA-256:78ACC538AB16006B8B1162704924979FC4F3EA32C96C3D7F419E45B5805251CF
                                                                                                                                                                                                                                            SHA-512:4632BFC70ACFED1F7915A1E4DF68DC48DA432A8D644D59849332AFDC82CFAAD4FC705E11B8B2BFBF56AA36C0878658BCD928BCB0A5B75A1EB1C928ED350127A6
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Antivirus:
                                                                                                                                                                                                                                            • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......bJ.?&+.l&+.l&+.l/S}l,+.liW.m$+.liW.m*+.liW.m.+.liW.m%+.l.^.m$+.lmS.m#+.l&+.l.+.l.W.m$+.l.W.m'+.l.W.l'+.l.W.m'+.lRich&+.l........................PE..d.....'d.........." ...".0..........0.....................................................`.............................................d....................`..............,.......................................(...@...........................................UPX0....................................UPX1.....0.......&..................@....rsrc................*..............@..............................................................................................................................................................................................................................................................................................................................................3.96.UPX!.$..

                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI2802\PIL\_webp.cp310-win_amd64.pyd

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Roaming\empyrean\dat.txt
                                                                                                                                                                                                                                            File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):216064
                                                                                                                                                                                                                                            Entropy (8bit):7.98646204031228
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:6144:nA5Pjci7Q5avbYeaWBn5wWD1YKrfyjCKXBVjtmbX:ePjcPgZPhnrfyOKXA
                                                                                                                                                                                                                                            MD5:96BF2F1EC99EDE91E4C85C1C55E88825
                                                                                                                                                                                                                                            SHA1:15CA18D5C4620E9BF1BDF46902FE238410A29B6D
                                                                                                                                                                                                                                            SHA-256:84498379B48C4FA2955688910F3409944BF4FC819C0F7C7FE07A5D1ED7D25EFA
                                                                                                                                                                                                                                            SHA-512:1A7229CA7AEB1F1B8A525BBCB9952D741AD43BBC597ADA0A423586F2A65C3C6045716313EBB073CAC03D2E8802ACE2A49C9350E95953E288B8D1AC5F4F07F8E5
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Antivirus:
                                                                                                                                                                                                                                            • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......O.4...Z...Z...Z.......Z.D.[...Z.@.[...Z.D._...Z.D.^...Z.D.Y...Z..[...Z...[.X.Z..^.].Z..R...Z..Z...Z......Z..X...Z.Rich..Z.........................PE..d.....'d.........." ...".P.......`.......p................................................`.........................................x...\.................... ...L..................................................x...@...........................................UPX0.....`..............................UPX1.....P...p...B..................@....rsrc................F..............@......................................................................................................................................................................................................................................................................................................................................3.96.UPX!.$..

                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI2802\VCRUNTIME140.dll

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Roaming\empyrean\dat.txt
                                                                                                                                                                                                                                            File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):109392
                                                                                                                                                                                                                                            Entropy (8bit):6.643764685776923
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:1536:DcghbEGyzXJZDWnEzWG9q4lVOiVgXjO5/Auecbq8qZU34zW/K0zD:DV3iC0h9q4v6XjKAuecbq8qGISb/
                                                                                                                                                                                                                                            MD5:870FEA4E961E2FBD00110D3783E529BE
                                                                                                                                                                                                                                            SHA1:A948E65C6F73D7DA4FFDE4E8533C098A00CC7311
                                                                                                                                                                                                                                            SHA-256:76FDB83FDE238226B5BEBAF3392EE562E2CB7CA8D3EF75983BF5F9D6C7119644
                                                                                                                                                                                                                                            SHA-512:0B636A3CDEFA343EB4CB228B391BB657B5B4C20DF62889CD1BE44C7BEE94FFAD6EC82DC4DB79949EDEF576BFF57867E0D084E0A597BF7BF5C8E4ED1268477E88
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Antivirus:
                                                                                                                                                                                                                                            • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........u...u...u.E.t...u.....u...t...u..v...u..q...u..p...u..u...u......u..w...u.Rich..u.........PE..d.....y..........." ...".....`.......................................................5....`A........................................`C..4....K...............p.......\..PO...........-..p............................,..@............................................text............................... ..`.rdata...A.......B..................@..@.data...0....`.......D..............@....pdata.......p.......H..............@..@_RDATA..\............T..............@..@.rsrc................V..............@..@.reloc...............Z..............@..B................................................................................................................................................................................................................................

                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI2802\VCRUNTIME140_1.dll

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Roaming\empyrean\dat.txt
                                                                                                                                                                                                                                            File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):49488
                                                                                                                                                                                                                                            Entropy (8bit):6.652691609629867
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:768:8EgYXUcHJcUJSDW/tfxL1qBS3hO6nb/TEHEXi9zufUKQXi9zug:8vGS8fZ1eUpreA+zuTc+zug
                                                                                                                                                                                                                                            MD5:BBA9680BC310D8D25E97B12463196C92
                                                                                                                                                                                                                                            SHA1:9A480C0CF9D377A4CAEDD4EA60E90FA79001F03A
                                                                                                                                                                                                                                            SHA-256:E0B66601CC28ECB171C3D4B7AC690C667F47DA6B6183BFF80604C84C00D265AB
                                                                                                                                                                                                                                            SHA-512:1575C786AC3324B17057255488DA5F0BC13AD943AC9383656BAF98DB64D4EC6E453230DE4CD26B535CE7E8B7D41A9F2D3F569A0EFF5A84AEB1C2F9D6E3429739
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Antivirus:
                                                                                                                                                                                                                                            • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..............L...L...L...M...L...M...L.FL...L...L...L...M...L...M...L...M...L...M...L..*L...L...M...LRich...L........................PE..d...%CU..........." ...".<...8.......A...............................................@....`A........................................0m.......m..x....................r..PO......D....c..p...........................pb..@............P..h............................text...0:.......<.................. ..`.rdata..."...P...$...@..............@..@.data................d..............@....pdata...............f..............@..@.rsrc................l..............@..@.reloc..D............p..............@..B................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI2802\_asyncio.pyd

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Roaming\empyrean\dat.txt
                                                                                                                                                                                                                                            File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):35712
                                                                                                                                                                                                                                            Entropy (8bit):7.649102416316352
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:768:+2sbZA5n1we/lPgOb1koYpu53VnJ2gl+NfOlQI75n2VYiSyvPRPxWED:+2RhZtXxkoYiTTENKQI75n2V7SynRPx
                                                                                                                                                                                                                                            MD5:CD9D22812520B671EED3964DA7E5CDB9
                                                                                                                                                                                                                                            SHA1:ADE6CC31B7610CFAE8EE8D2BA61C2C3D123AC5C1
                                                                                                                                                                                                                                            SHA-256:00275ADF6FFE251CA6C46864D44B6F2F29341B76CE5C9E26EB11721CB8B134AB
                                                                                                                                                                                                                                            SHA-512:A07E008D39B1044D89151A871FFFB18EA82814BF12574D6D959EF28CD590F2A09242D739FD9ABC4F6A4E32D1EB8CBD813BCEDCCA524551EAC1E1D92E2E245491
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Antivirus:
                                                                                                                                                                                                                                            • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........TF.q.F.q.F.q.O...D.q...p.D.q...t.J.q...u.N.q...r.E.q...p.E.q...p.D.q.F.p...q...|.G.q...q.G.q....G.q...s.G.q.RichF.q.................PE..d...$..c.........." ...".`.......... #.......................................P............`..........................................J..P....I..P....@......................DK..$..................................../..@...........................................UPX0....................................UPX1.....`.......R..................@....rsrc........@.......V..............@......................................................................................................................................................................................................................................................................................................................................................3.96.UPX!.$..

                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI2802\_bz2.pyd

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Roaming\empyrean\dat.txt
                                                                                                                                                                                                                                            File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):48504
                                                                                                                                                                                                                                            Entropy (8bit):7.773461990395197
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:768:7iQxyc/3D2HGItfsKbsonbgiHUoYVcW5I7tVbenYiSyv5PxWEDX:75xdEsKbtnbgqUoYt5I7tVb07SyxPx9
                                                                                                                                                                                                                                            MD5:758FFF1D194A7AC7A1E3D98BCF143A44
                                                                                                                                                                                                                                            SHA1:DE1C61A8E1FB90666340F8B0A34E4D8BFC56DA07
                                                                                                                                                                                                                                            SHA-256:F5E913A9F2ADF7D599EA9BB105E144BA11699BBCB1514E73EDCF7E062354E708
                                                                                                                                                                                                                                            SHA-512:468D7C52F14812D5BDE1E505C95CB630E22D71282BDA05BF66324F31560BFA06095CF60FC0D34877F8B361CCD65A1B61D0FD1F91D52FACB0BAF8E74F3FED31CC
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Antivirus:
                                                                                                                                                                                                                                            • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$....................a.........................................t.........................................Rich....................PE..d...2..c.........." ..."............pd....................................................`.............................................H.................... .. ..................................................hp..@...........................................UPX0....................................UPX1................................@....rsrc...............................@..............................................................................................................................................................................................................................................................................................................................................3.96.UPX!.$..

                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI2802\_ctypes.pyd

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Roaming\empyrean\dat.txt
                                                                                                                                                                                                                                            File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):58232
                                                                                                                                                                                                                                            Entropy (8bit):7.821424155463504
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:1536:JUP3/jolpinLX2rRaWMzhB8yLI7QP7U7SykPxiM:u3/jolwXuRaW6SOI7QP7U2xB
                                                                                                                                                                                                                                            MD5:6CA9A99C75A0B7B6A22681AA8E5AD77B
                                                                                                                                                                                                                                            SHA1:DD1118B7D77BE6BB33B81DA65F6B5DC153A4B1E8
                                                                                                                                                                                                                                            SHA-256:D39390552C55D8FD4940864905CD4437BC3F8EFE7FF3CA220543B2C0EFAB04F8
                                                                                                                                                                                                                                            SHA-512:B0B5F2979747D2F6796D415DD300848F32B4E79EDE59827AC447AF0F4EA8709B60D6935D09E579299B3BC54B6C0F10972F17F6C0D1759C5388AD5B14689A23FE
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Antivirus:
                                                                                                                                                                                                                                            • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                            Preview:MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$.......NC..."..."..."...Z..."..E^..."..E^..."..E^..."..E^..."...^..."...P..."...P..."...K..."..."..."...^..."...^..."...^x.."...^..."..Rich."..........................PE..d.../..c.........." ...".........p..P........................................@............`.........................................H<.......9.......0..........,............<......................................X%..@...........................................UPX0.....p..............................UPX1................................@....rsrc........0......................@..............................................................................................................................................................................................................................................................................................................................3.96.UPX!.$..

                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI2802\_decimal.pyd

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Roaming\empyrean\dat.txt
                                                                                                                                                                                                                                            File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):106368
                                                                                                                                                                                                                                            Entropy (8bit):7.935447983813077
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:3072:ggCMV2Mz94bMgxECS8kePpTn8XI75qNp8mx:g1MV2Mz94og2tJePpwFp
                                                                                                                                                                                                                                            MD5:EB45EA265A48348CE0AC4124CB72DF22
                                                                                                                                                                                                                                            SHA1:ECDC1D76A205F482D1ED9C25445FA6D8F73A1422
                                                                                                                                                                                                                                            SHA-256:3881F00DBC4AADF9E87B44C316D93425A8F6BA73D72790987226238DEFBC7279
                                                                                                                                                                                                                                            SHA-512:F7367BF2A2D221A7508D767AD754B61B2B02CDD7AE36AE25B306F3443D4800D50404AC7E503F589450ED023FF79A2FB1DE89A30A49AA1DD32746C3E041494013
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Antivirus:
                                                                                                                                                                                                                                            • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........|RTy..Ty..Ty..]...Zy......Vy......Yy......\y......Py......Wy......Vy..Ty...y......Uy......[y......Uy......Uy......Uy..RichTy..........PE..d...)..c.........." ...".p................................................... ............`.............................................P........................'......................................................@...........................................UPX0....................................UPX1.....p.......d..................@....rsrc................h..............@......................................................................................................................................................................................................................................................................................................................................................3.96.UPX!.$..

                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI2802\_hashlib.pyd

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Roaming\empyrean\dat.txt
                                                                                                                                                                                                                                            File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):34688
                                                                                                                                                                                                                                            Entropy (8bit):7.615342100631813
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:768:aU3dM1TMhvg8KNML5TOuzSsI/RYdI75ImtYiSyvfPxWEabVV/:aedM1TMho8iMLPmv/KdI75Imt7SyXPxA
                                                                                                                                                                                                                                            MD5:0D723BC34592D5BB2B32CF259858D80E
                                                                                                                                                                                                                                            SHA1:EACFABD037BA5890885656F2485C2D7226A19D17
                                                                                                                                                                                                                                            SHA-256:F2B927AAA856D23F628B01380D5A19BFE9233DB39C9078C0E0585D376948C13F
                                                                                                                                                                                                                                            SHA-512:3E79455554D527D380ADCA39AC10DBF3914CA4980D8EE009B7DAF30AEB4E9359D9D890403DA9CC2B69327C695C57374C390FA780A8FD6148BBEA3136138EAD33
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Antivirus:
                                                                                                                                                                                                                                            • Antivirus: ReversingLabs, Detection: 4%
                                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........_.A.>...>...>...F2..>...B...>...B...>...B...>...B...>..iB...>...L...>...D...>...>..Q>..iB...>..iB...>..iB^..>..iB...>..Rich.>..........................PE..d.../..c.........." ...".P..........p........................................@............`..........................................;..P....9.......0.......................;......................................h*..@...........................................UPX0....................................UPX1.....P.......L..................@....rsrc........0.......P..............@......................................................................................................................................................................................................................................................................................................................................3.96.UPX!.$..

                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI2802\_lzma.pyd

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Roaming\empyrean\dat.txt
                                                                                                                                                                                                                                            File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):86392
                                                                                                                                                                                                                                            Entropy (8bit):7.918616838915833
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:1536:I1KvmqFMCNL6eKmtYs76LBlBqLBxcZiV6IHxdc/k4Ncs7I7e1gT7SyJPxs:aqdLCOz76LBl4VxYcdc/19I7e1gTvxs
                                                                                                                                                                                                                                            MD5:ABCEECEAEFF3798B5B0DE412AF610F58
                                                                                                                                                                                                                                            SHA1:C3C94C120B5BED8BCCF8104D933E96AC6E42CA90
                                                                                                                                                                                                                                            SHA-256:216AA4BB6F62DD250FD6D2DCDE14709AA82E320B946A21EDEEC7344ED6C2C62E
                                                                                                                                                                                                                                            SHA-512:3E1A2EB86605AA851A0C5153F7BE399F6259ECAAD86DBCBF12EEAE5F985DC2EA2AB25683285E02B787A5B75F7DF70B4182AE8F1567946F99AD2EC7B27D4C7955
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Antivirus:
                                                                                                                                                                                                                                            • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......b.J[&.$.&.$.&.$./..".$.i.%.$.$.i.!.*.$.i. ...$.i.'.%.$...%.%.$...%.$.$.&.%.C.$...)...$...$.'.$.....'.$...&.'.$.Rich&.$.........PE..d...B..c.........." ...". ................................................................`.........................................4...L....................P..........................................................@...........................................UPX0....................................UPX1..... ..........................@....rsrc...............................@..............................................................................................................................................................................................................................................................................................................................................................3.96.UPX!.$..

                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI2802\_multiprocessing.pyd

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Roaming\empyrean\dat.txt
                                                                                                                                                                                                                                            File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):25984
                                                                                                                                                                                                                                            Entropy (8bit):7.493810835339704
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:768:Gmy6HNbpr+8C6LSf93tePBI7Rt2lYiSyvPPxWEa5Z:d9+8FKR0PBI7Rt2l7SynPxeZ
                                                                                                                                                                                                                                            MD5:0D48797F8115161D1F4F607862C894F8
                                                                                                                                                                                                                                            SHA1:377E116CE713CEF85764A722D83A6E43BDAB30A7
                                                                                                                                                                                                                                            SHA-256:5D5C7C93157A6C483D03FEA46AAD60D91A53D87707D744FA7810134A0E6D2CD9
                                                                                                                                                                                                                                            SHA-512:A61119FDD99A2900AF4CC738BA4BB9ACD7171906F15DDDBCF27CD2D4830EA155BBB590C2B4E9459EA70A17285CCF5649EFACDA81F05B9EF15CE4E4BFA77CD73A
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Antivirus:
                                                                                                                                                                                                                                            • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........$Z*.E4y.E4y.E4y.=.y.E4y.95x.E4y.91x.E4y.90x.E4y.97x.E4yS95x.E4y.E5y.E4y?75x.E4yS99x.E4yS94x.E4yS9.y.E4yS96x.E4yRich.E4y........................PE..d...+..c.........." ...".0..........p.....................................................`.........................................4...`....................`......................................................x...@...........................................UPX0....................................UPX1.....0.......,..................@....rsrc................0..............@..............................................................................................................................................................................................................................................................................................................................................3.96.UPX!.$..

                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI2802\_overlapped.pyd

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Roaming\empyrean\dat.txt
                                                                                                                                                                                                                                            File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):31616
                                                                                                                                                                                                                                            Entropy (8bit):7.5665023159396565
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:768:5k8GDYwKGtevarixdxu3dI7st2bYiSyvxPxWEa:2ETi93dI7st2b7SypPx
                                                                                                                                                                                                                                            MD5:D22D51B9F7E5273373A380B832905832
                                                                                                                                                                                                                                            SHA1:5B96CBD365101AFF5F9FEA55065A015ECFCD9725
                                                                                                                                                                                                                                            SHA-256:A56E339E622E613E0664705988A2166168873CFC9507385BB6F7AC17E0546701
                                                                                                                                                                                                                                            SHA-512:93B3C5031A67F2EC68BF6F12A795CE7DCA87D04D470E7097B47E8C1C2FB246C4D8D56FF4C6EC61D271815EB79FEFAE311A05D135B0B69CEC012D319DBBB4C40B
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Antivirus:
                                                                                                                                                                                                                                            • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........({..F(..F(..F(...(..F(..G)..F(..C)..F(..B)..F(..E)..F(..G)..F(..G(..F(c.G)..F(c.B)..F(..K)..F(..F)..F(...(..F(..D)..F(Rich..F(................PE..d...-..c.........." ...".@................................................................`.........................................x...X...............................................................................@...........................................UPX0....................................UPX1.....@.......@..................@....rsrc................D..............@..............................................................................................................................................................................................................................................................................................................................................3.96.UPX!.$..

                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI2802\_queue.pyd

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Roaming\empyrean\dat.txt
                                                                                                                                                                                                                                            File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):24960
                                                                                                                                                                                                                                            Entropy (8bit):7.453287262532455
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:384:rQpaT/6xXedjhX9CYLxhfcggnUxaVXALAZI77U2NuIYiSy1pCQAqfUvPxh8E9VFX:DSxw19p9uzZI77U2xYiSyvlfUvPxWEl
                                                                                                                                                                                                                                            MD5:0D267BB65918B55839A9400B0FB11AA2
                                                                                                                                                                                                                                            SHA1:54E66A14BEA8AE551AB6F8F48D81560B2ADD1AFC
                                                                                                                                                                                                                                            SHA-256:13EE41980B7D0FB9CE07F8E41EE6A309E69A30BBF5B801942F41CBC357D59E9C
                                                                                                                                                                                                                                            SHA-512:C2375F46A98E44F54E2DD0A5CC5F016098500090BB78DE520DC5E05AEF8E6F11405D8F6964850A03060CAED3628D0A6303091CBA1F28A0AA9B3B814217D71E56
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Antivirus:
                                                                                                                                                                                                                                            • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........._ZF.1.F.1.F.1.O..D.1...0.D.1...4.J.1...5.N.1...2.E.1...0.E.1...0.D.1.F.0...1...<.G.1...1.G.1.....G.1...3.G.1.RichF.1.........PE..d...&..c.........." ...".0..........`.....................................................`.............................................L.......P............`..............<.......................................X...@...........................................UPX0....................................UPX1.....0.......(..................@....rsrc................,..............@..............................................................................................................................................................................................................................................................................................................................................................3.96.UPX!.$..

                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI2802\_socket.pyd

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Roaming\empyrean\dat.txt
                                                                                                                                                                                                                                            File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):42880
                                                                                                                                                                                                                                            Entropy (8bit):7.6996745691481285
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:768:GL7Syo5lzOt+ufVwPVXahccu0D+gFiPnmJsSK0I7QwbmAYiSyvb9ZPxWEl:mkbzcKNGu0yXwbK0I7QwbmA7Syj/Px
                                                                                                                                                                                                                                            MD5:AFD296823375E106C4B1AC8B39927F8B
                                                                                                                                                                                                                                            SHA1:B05D811E5A5921D5B5CC90B9E4763FD63783587B
                                                                                                                                                                                                                                            SHA-256:E423A7C2CE5825DFDD41CFC99C049FF92ABFB2AA394C85D0A9A11DE7F8673007
                                                                                                                                                                                                                                            SHA-512:95E98A24BE9E603B2870B787349E2AA7734014AC088C691063E4078E11A04898C9C547D6998224B1B171FC4802039C3078A28C7E81D59F6497F2F9230D8C9369
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Antivirus:
                                                                                                                                                                                                                                            • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........Z..{4..{4..{4......{4...5..{4...1..{4...0..{4...7..{4.U.5..{4..{5.\{4.9.5..{4.U.9..{4.U.4..{4.U....{4.U.6..{4.Rich.{4.........................PE..d...0..c.........." ...".p..........0m....................................................`.............................................P.......h............ ..l...........X.......................................8y..@...........................................UPX0....................................UPX1.....p.......l..................@....rsrc................p..............@..............................................................................................................................................................................................................................................................................................................................................3.96.UPX!.$..

                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI2802\_sqlite3.pyd

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Roaming\empyrean\dat.txt
                                                                                                                                                                                                                                            File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):50048
                                                                                                                                                                                                                                            Entropy (8bit):7.763546199450955
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:1536:u8Mdv1OCWk0z+q3QCjbouAfI75QrA7SyDPx:hQO00zrrvbgI75QrANx
                                                                                                                                                                                                                                            MD5:7B45AFC909647C373749EF946C67D7CF
                                                                                                                                                                                                                                            SHA1:81F813C1D8C4B6497C01615DCB6AA40B92A7BD20
                                                                                                                                                                                                                                            SHA-256:A5F39BFD2B43799922E303A3490164C882F6E630777A3A0998E89235DC513B5E
                                                                                                                                                                                                                                            SHA-512:FE67E58F30A2C95D7D42A102ED818F4D57BAA524C5C2D781C933DE201028C75084C3E836FF4237E066F3C7DD6A5492933C3DA3FEE76EB2C50A6915996EF6D7FB
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Antivirus:
                                                                                                                                                                                                                                            • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......8..|...|...|...u...z...3...~...3.~.}...3...q...3...t...3..........y.......~...|..........u......}....|.}......}...Rich|...........PE..d...[..c.........." ...".........@..0....P................................................`.............................................P.......4............`..............(.......................................(...@...........................................UPX0.....@..............................UPX1.........P......................@....rsrc...............................@......................................................................................................................................................................................................................................................................................................................................................3.96.UPX!.$..

                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI2802\_ssl.pyd

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Roaming\empyrean\dat.txt
                                                                                                                                                                                                                                            File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):62328
                                                                                                                                                                                                                                            Entropy (8bit):7.850362561913567
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:1536:CedJItp3BP6kGsJMthwMtbyG68sj8I7t7QOC7SycPxu:P8tVBPpGsUt+usYI7t7QT+xu
                                                                                                                                                                                                                                            MD5:1E643C629F993A63045B0FF70D6CF7C6
                                                                                                                                                                                                                                            SHA1:9AF2D22226E57DC16C199CAD002E3BEB6A0A0058
                                                                                                                                                                                                                                            SHA-256:4A50B4B77BF9E5D6F62C7850589B80B4CAA775C81856B0D84CB1A73D397EB38A
                                                                                                                                                                                                                                            SHA-512:9D8CD6E9C03880CC015E87059DB28FF588881679F8E3F5A26A90F13E2C34A5BD03FB7329D9A4E33C4A01209C85A36FC999E77D9ECE42CEBDB738C2F1FD6775AF
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Antivirus:
                                                                                                                                                                                                                                            • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......,z..h.gLh.gLh.gLac.Ln.gL'gfMj.gL'gbMe.gL'gcM`.gL'gdMk.gL.gfMj.gL.afMl.gLh.fL..gL.ifMo.gL.gjMj.gL.ggMi.gL.g.Li.gL.geMi.gLRichh.gL................PE..d...3..c.........." ..."............ .....................................................`.........................................p...d....................P......................................................(...@...........................................UPX0....................................UPX1................................@....rsrc...............................@..............................................................................................................................................................................................................................................................................................................................................3.96.UPX!.$..

                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI2802\_uuid.pyd

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Roaming\empyrean\dat.txt
                                                                                                                                                                                                                                            File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):22400
                                                                                                                                                                                                                                            Entropy (8bit):7.361536802022009
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:384:YbjUslT24o0uNnUxaVXALkpiI7ewWYcIYiSy1pCQDMaPxh8E9VF0Nyvzo:6j3lKNfpiI7ewWQYiSyvfPxWEx
                                                                                                                                                                                                                                            MD5:81DFA68CA3CB20CED73316DBC78423F6
                                                                                                                                                                                                                                            SHA1:8841CF22938AA6EE373FF770716BB9C6D9BC3E26
                                                                                                                                                                                                                                            SHA-256:D0CB6DD98A2C9D4134C6EC74E521BAD734BC722D6A3B4722428BF79E7B66F190
                                                                                                                                                                                                                                            SHA-512:E24288AE627488251682CD47C1884F2DC5F4CD834D7959B9881E5739C42D91FD0A30E75F0DE77F5B5A0D63D9BAEBCAFA56851E7E40812DF367FD433421C0CCDB
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Antivirus:
                                                                                                                                                                                                                                            • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........;$p^ZJ#^ZJ#^ZJ#W".#\ZJ#.&K"\ZJ#.&O"RZJ#.&N"VZJ#.&I"]ZJ#.&K"\ZJ#.(K"[ZJ#^ZK#tZJ#.&B"_ZJ#.&J"_ZJ#.&.#_ZJ#.&H"_ZJ#Rich^ZJ#................PE..d...+..c.........." ...". .......`.......p................................................`.........................................8...L....................@......................................................x...@...........................................UPX0.....`..............................UPX1..... ...p......................@....rsrc................"..............@......................................................................................................................................................................................................................................................................................................................................................3.96.UPX!.$..

                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI2802\_win32sysloader.pyd

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Roaming\empyrean\dat.txt
                                                                                                                                                                                                                                            File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):11776
                                                                                                                                                                                                                                            Entropy (8bit):6.772611075994812
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:192:lpadimkU6KnFt4Zdcpbd8m5OonxCe4W7Oj5aLRkyUxaVXFaL2cxa/UQ0D:C4KFtycpbd8EOonxCeZOFaLRnUxaVXAt
                                                                                                                                                                                                                                            MD5:CA5D703BECCFFFB4CEF13729E56DE725
                                                                                                                                                                                                                                            SHA1:F5AEB8D98D4FEDE04F3EF76A8C2E3A6AC5CE1C64
                                                                                                                                                                                                                                            SHA-256:3113117C0B67CD9532053ADEE0D87A83B32E9EEC4101BEA437EE3AB3F6D1D6A2
                                                                                                                                                                                                                                            SHA-512:BED0F5490DA5593C7C94C9F292B5FB2698A6040A8F4FB1151709BED3E450D55E8D74F9B558EEB0893EA89BF01B05A5DF714B67CFC2B419A52E0C2C00BB2A16AA
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Antivirus:
                                                                                                                                                                                                                                            • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......tSf.02..02..02..9J..22..bG..22..$Y..22..bG..;2..bG..82..bG..32..[..32..02...2...G..12...G..12...G..12..Rich02..................PE..d......d.........." .....0.......... .....................................................`.............................................`...x...P.......x....`..............(...........................................8...........................................UPX0....................................UPX1.....0.......$..................@....rsrc................(..............@..............................................................................................................................................................................................................................................................................................................................................................3.96.UPX!.$..

                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI2802\aiohttp\_helpers.cp310-win_amd64.pyd

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Roaming\empyrean\dat.txt
                                                                                                                                                                                                                                            File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):26112
                                                                                                                                                                                                                                            Entropy (8bit):7.670706649814581
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:768:HAgts4wZXjNKzfSpVzDaDywUIHruBnZ356:HxtJijNppVdIL6X6
                                                                                                                                                                                                                                            MD5:D76A7F9B8481AEE6DB8555A88F3EEE13
                                                                                                                                                                                                                                            SHA1:A50C77A84B8FCBC393F91244CBC8FE98D7FDE74C
                                                                                                                                                                                                                                            SHA-256:1EF0FDCB5EFE630D7674AE83D9BF82DAEE980BA5F3C6ACB76F148FFE2148C008
                                                                                                                                                                                                                                            SHA-512:502C6AC9DB73C852ABFFA59B74243D646AD005F94DEF2B7DCA2E441C74FBA3D1F3955EF0C11D2FC19A47B2D705128AC0F84D68C725129C53F72D5C3CCF5287E3
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Antivirus:
                                                                                                                                                                                                                                            • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........oB[..,...,...,..v....,...-...,..v-...,.../...,...(...,...)...,.f{-...,...-...,..$...,..,...,......,......,.Rich..,.........................PE..d....A.g.........." ...).`..........0?.......................................`............`.........................................@R..`....P..P....P.......................R......................................(K..@...........................................UPX0....................................UPX1.....`.......^..................@....rsrc........P.......b..............@..............................................................................................................................................................................................................................................................................................................................................3.96.UPX!.$..

                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI2802\aiohttp\_http_parser.cp310-win_amd64.pyd

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Roaming\empyrean\dat.txt
                                                                                                                                                                                                                                            File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):82944
                                                                                                                                                                                                                                            Entropy (8bit):7.949991955133753
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:1536:7DJzqoj6kwZ0YWPXwlnsYUdjecK7UBopf3YcjRNt3WMdaNvalbgEM9xI:7DYoj6k/YKgtsYuw7UB4YQRpa
                                                                                                                                                                                                                                            MD5:858F1D3F9D32C1E6A35C8C5C81E5A5E8
                                                                                                                                                                                                                                            SHA1:4A2AF60C0DB12ADB12AFE781F9FC9675D11D1B9E
                                                                                                                                                                                                                                            SHA-256:8A26BCFBD4797E6713BE6F5E5ABDA60747BBD6C9CF58B983CD79AB86A990275C
                                                                                                                                                                                                                                            SHA-512:EC5EE5A38A2240913673535A95E1CB329BE1E835B1F1C7F68B153513DB152F70029204E118397D7A215F05025D851137EF971C83E3D7BE093C9D682311DCF03F
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Antivirus:
                                                                                                                                                                                                                                            • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........9...WR..WR..WR...R..WR.kVS..WR.VS..WRj.VS..WR..VRF.WR.kTS..WR.kSS..WR.kRS..WR.j_S..WR.jWS..WR.j.R..WR.jUS..WRRich..WR........................PE..d....A.g.........." ...).@.......p.. .....................................................`..................................................................@..............\...........................................@...........................................UPX0.....p..............................UPX1.....@.......8..................@....rsrc................<..............@..............................................................................................................................................................................................................................................................................................................................................3.96.UPX!.$..

                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI2802\aiohttp\_http_writer.cp310-win_amd64.pyd

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Roaming\empyrean\dat.txt
                                                                                                                                                                                                                                            File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):25088
                                                                                                                                                                                                                                            Entropy (8bit):7.716205811403458
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:768:agf7VnuWhwjmpHKTjQ6j0+l123fPA/f9:agf7VnWUHKTjjmvI/V
                                                                                                                                                                                                                                            MD5:305F44C62CF1E39AD97CEFE02D16E52D
                                                                                                                                                                                                                                            SHA1:77F2FD9A86702DDF56813EEDCC7D26E014AA7E28
                                                                                                                                                                                                                                            SHA-256:9A156861ED877D905D4CF1F1BCC45BA0C4B33AE961138B75B817018454C8BBF7
                                                                                                                                                                                                                                            SHA-512:30E485D6802F572F8D7F5E49DA17059E041850B2B9CF3FDAB99F4B097A2A15F99EFF5113C60CDAAC0338C8C56EBCBAFB5A309293786CD9085BAB8E526FAFC73B
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Antivirus:
                                                                                                                                                                                                                                            • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........o.T.............v?..............v..............................b{..........4................S...........Rich....................PE..d....A.g.........." ...).`...........l... ................................................`.........................................@...h.......P............ ..0....................................................x..@...........................................UPX0....................................UPX1.....`... ...Z..................@....rsrc................^..............@......................................................................................................................................................................................................................................................................................................................................................3.96.UPX!.$..

                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI2802\aiohttp\_websocket.cp310-win_amd64.pyd

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Roaming\empyrean\dat.txt
                                                                                                                                                                                                                                            File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):20480
                                                                                                                                                                                                                                            Entropy (8bit):7.543311887865824
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:384:alZn4Hp1CV3K/CqTERpJz08tWrPPBE0nUxaVXALeD:alF0X/CqTCJzGV
                                                                                                                                                                                                                                            MD5:3EE2A9C44E8E057107B6DA68572451E9
                                                                                                                                                                                                                                            SHA1:BE80779B8BB447F40E80A526DAEFA1028738422A
                                                                                                                                                                                                                                            SHA-256:95ADAEC9FE8FE1EAD0B7199298D813FC8A01052D9868D5633BAA89E6F59A5E61
                                                                                                                                                                                                                                            SHA-512:249CB0F40307968055994AE49776DACCF38B0E42955F2DE4F0E14F788A96C69115F25AF05549D9E27F99632592E4C8E39CA44DA9F49A9BBDA6ADFC246320AC53
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Antivirus:
                                                                                                                                                                                                                                            • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........oB[..,...,...,..v....,...-...,..v-...,.../...,...(...,...)...,.f{-...,...-.%.,..$...,..,...,......,......,.Rich..,.........................PE..d....A.g.........." ...).P..........p.....................................................`.........................................@...d.......P...............4...................................................h...@...........................................UPX0....................................UPX1.....P.......H..................@....rsrc................L..............@..............................................................................................................................................................................................................................................................................................................................................3.96.UPX!.$..

                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI2802\altgraph-0.17.4.dist-info\INSTALLER

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Roaming\empyrean\dat.txt
                                                                                                                                                                                                                                            File Type:ASCII text
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):4
                                                                                                                                                                                                                                            Entropy (8bit):1.5
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:3:Mn:M
                                                                                                                                                                                                                                            MD5:365C9BFEB7D89244F2CE01C1DE44CB85
                                                                                                                                                                                                                                            SHA1:D7A03141D5D6B1E88B6B59EF08B6681DF212C599
                                                                                                                                                                                                                                            SHA-256:CEEBAE7B8927A3227E5303CF5E0F1F7B34BB542AD7250AC03FBCDE36EC2F1508
                                                                                                                                                                                                                                            SHA-512:D220D322A4053D84130567D626A9F7BB2FB8F0B854DA1621F001826DC61B0ED6D3F91793627E6F0AC2AC27AEA2B986B6A7A63427F05FE004D8A2ADFBDADC13C1
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:pip.

                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI2802\altgraph-0.17.4.dist-info\LICENSE

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Roaming\empyrean\dat.txt
                                                                                                                                                                                                                                            File Type:ASCII text
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):1002
                                                                                                                                                                                                                                            Entropy (8bit):5.178870450986544
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:24:wy+rmJHcwH0MP3gt99QHOsUv4eOk4/+/m3oqMSFJ:9+aJ8YHvEnQHOs5exm3oEFJ
                                                                                                                                                                                                                                            MD5:3590EB8D695BDCEA3BA57E74ADF8A4ED
                                                                                                                                                                                                                                            SHA1:5B3C3863D521CF35E75E36A22E5EC4A80C93C528
                                                                                                                                                                                                                                            SHA-256:6C194D6DB0C64D45535D10C95142B9B0CDA7B7DCC7F1DDEE302B3D536F3DBE46
                                                                                                                                                                                                                                            SHA-512:405E4F136E282352DF9FC60C2CE126E26A344DD63F92AAB0E77DE60694BD155A13CF41C13E88C00FB95032A90526AD32C9E4B7D53CA352E03C3882ED648821F0
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:Copyright (c) 2004 Istvan Albert unless otherwise noted..Copyright (c) 2006-2010 Bob Ippolito.Copyright (2) 2010-2020 Ronald Oussoren, et. al...Permission is hereby granted, free of charge, to any person obtaining a copy.of this software and associated documentation files (the "Software"), to.deal in the Software without restriction, including without limitation the.rights to use, copy, modify, merge, publish, distribute, sublicense,.and/or sell copies of the Software, and to permit persons to whom the.Software is furnished to do so...THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR.IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,.FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE.AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER.LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING.FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS.IN THE SOFTWARE

                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI2802\altgraph-0.17.4.dist-info\METADATA

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Roaming\empyrean\dat.txt
                                                                                                                                                                                                                                            File Type:ASCII text
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):7264
                                                                                                                                                                                                                                            Entropy (8bit):4.9335139350342505
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:96:D4lWAqZjaaYxmPktjas13ieOGZND9REZ4y+KezAYx09zB5KENViyh5YZXc9Me6WW:QqW8GZNjiui9KUQHDyKtZx
                                                                                                                                                                                                                                            MD5:22177E21CADF554A961F1EB13DA4CEAF
                                                                                                                                                                                                                                            SHA1:35610F8C8AE735AC6A03C7556B55170248748D6B
                                                                                                                                                                                                                                            SHA-256:691116CB60E4B1DD5554077804932FD0290357120FC9921F03D27664526B1295
                                                                                                                                                                                                                                            SHA-512:A213C826D1B84BD7207BB6FA652B2F618D27B05ABC9F308086D704FD6A5D4A26BE75522786EC77C650AB52D35D2B34A6096BCBD9553D8C7AC1372EE4B59F72B3
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:Metadata-Version: 2.1.Name: altgraph.Version: 0.17.4.Summary: Python graph (network) package.Home-page: https://altgraph.readthedocs.io.Download-URL: http://pypi.python.org/pypi/altgraph.Author: Ronald Oussoren.Author-email: ronaldoussoren@mac.com.Maintainer: Ronald Oussoren.Maintainer-email: ronaldoussoren@mac.com.License: MIT.Keywords: graph.Platform: any.Classifier: Intended Audience :: Developers.Classifier: License :: OSI Approved :: MIT License.Classifier: Programming Language :: Python.Classifier: Programming Language :: Python :: 2.Classifier: Programming Language :: Python :: 2.7.Classifier: Programming Language :: Python :: 3.Classifier: Programming Language :: Python :: 3.4.Classifier: Programming Language :: Python :: 3.5.Classifier: Programming Language :: Python :: 3.6.Classifier: Programming Language :: Python :: 3.7.Classifier: Programming Language :: Python :: 3.8.Classifier: Programming Language :: Python :: 3.9.Classifier: Programming Language :: Python :: 3.10.Class

                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI2802\altgraph-0.17.4.dist-info\RECORD

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Roaming\empyrean\dat.txt
                                                                                                                                                                                                                                            File Type:CSV text
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):1466
                                                                                                                                                                                                                                            Entropy (8bit):5.80543063460573
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:24:Hzn/2zDiTzv5MIzZOTzHz4BsXWzlrIhikTz39+SWUz4EUbR4w1+4V1LkzcRG2lkx:HznuXiTzyIzYTzHz4TzlriHTz39+7I4a
                                                                                                                                                                                                                                            MD5:8F6CAAF90B4C653279EFD81CCFFFF5E3
                                                                                                                                                                                                                                            SHA1:A95049B0512A670C609D9FF2AD68CBDC62712BCA
                                                                                                                                                                                                                                            SHA-256:2D8DCE3D5542EC6ABA57299511AE6BD61EBD4789C52AE67715E219B616CC356C
                                                                                                                                                                                                                                            SHA-512:304185EE1A09C94D73C1D2D98FA5694F7BE2E5475111EE03C491FAC79F3C888D4E63C2D564B7611C339A9589A7B26E4D67E8638A887257EDB61864E20958E2B3
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:altgraph-0.17.4.dist-info/INSTALLER,sha256=zuuue4knoyJ-UwPPXg8fezS7VCrXJQrAP7zeNuwvFQg,4..altgraph-0.17.4.dist-info/LICENSE,sha256=bBlNbbDGTUVTXRDJUUK5sM2nt9zH8d3uMCs9U289vkY,1002..altgraph-0.17.4.dist-info/METADATA,sha256=aREWy2Dksd1VVAd4BJMv0CkDVxIPyZIfA9J2ZFJrEpU,7264..altgraph-0.17.4.dist-info/RECORD,,..altgraph-0.17.4.dist-info/WHEEL,sha256=a-zpFRIJzOq5QfuhBzbhiA1eHTzNCJn8OdRvhdNX0Rk,110..altgraph-0.17.4.dist-info/top_level.txt,sha256=HEBeRWf5ItVPc7Y9hW7hGlrLXZjPoL4by6CAhBV_BwA,9..altgraph-0.17.4.dist-info/zip-safe,sha256=AbpHGcgLb-kRsJGnwFEktk7uzpZOCcBY74-YBdrKVGs,1..altgraph/Dot.py,sha256=gKEp6Su_CoOWQYt5HIVs_7MBYK1BEOhKX0RLAAA-vQs,9929..altgraph/Graph.py,sha256=6b6fSHLA5QSqMDnSHIO7_WJnBYIdq3K5Bt8VipRODwg,20788..altgraph/GraphAlgo.py,sha256=Uu9aTjSKWi38iQ_e9ZrwCnzQaI1WWFDhJ6kfmu0jxAA,5645..altgraph/GraphStat.py,sha256=LKya4BKXJ5GZi5-sNYU17aOBTLxqn_tVgbiw4sWGYIU,1888..altgraph/GraphUtil.py,sha256=1T4DJc2bJn6EIU_Ct4m0oiKlXWkXvqcXE8CGL2K9en8,3990..altgraph/ObjectGraph.py,sha256=o7f

                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI2802\altgraph-0.17.4.dist-info\WHEEL

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Roaming\empyrean\dat.txt
                                                                                                                                                                                                                                            File Type:ASCII text
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):110
                                                                                                                                                                                                                                            Entropy (8bit):4.798786725303218
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:3:RtEeX7MWcSlVlhVMSgP+tPCCf7irO5S:RtBMwlVSZWBBwt
                                                                                                                                                                                                                                            MD5:F1EFFD0B429F462BD08132474A8B4FA6
                                                                                                                                                                                                                                            SHA1:A9D3050AF622BDA1BD73C00DC377625FF44D2559
                                                                                                                                                                                                                                            SHA-256:6BECE9151209CCEAB941FBA10736E1880D5E1D3CCD0899FC39D46F85D357D119
                                                                                                                                                                                                                                            SHA-512:EF7D53063CFCB54155F4C700C9E99ADBA9BF6085296B8CF1E3AB86767B7C96D1A4EBF4F6B19D4942DA7F6CBC0AC25DFEA8EAE4CE461B1701CB1ACF9B2B68BB6D
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:Wheel-Version: 1.0.Generator: bdist_wheel (0.40.0).Root-Is-Purelib: true.Tag: py2-none-any.Tag: py3-none-any..

                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI2802\altgraph-0.17.4.dist-info\top_level.txt

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Roaming\empyrean\dat.txt
                                                                                                                                                                                                                                            File Type:ASCII text
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):9
                                                                                                                                                                                                                                            Entropy (8bit):2.94770277922009
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:3:gRUEv:gee
                                                                                                                                                                                                                                            MD5:BEB0CA64AA7DD6722F65930793F447D5
                                                                                                                                                                                                                                            SHA1:9BBA1BCE17FB25BDC9E6AA7AD8077999422EFD86
                                                                                                                                                                                                                                            SHA-256:1C405E4567F922D54F73B63D856EE11A5ACB5D98CFA0BE1BCBA08084157F0700
                                                                                                                                                                                                                                            SHA-512:BC4C40BCC527A9E40A934B6B594278A89625C9142795582C223E227A2D6ECCEB3233F10AA790E87D44171207AC0FEAC09581BD63C71937F97BB8F07E8CC88F30
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:altgraph.

                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI2802\altgraph-0.17.4.dist-info\zip-safe

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Roaming\empyrean\dat.txt
                                                                                                                                                                                                                                            File Type:very short file (no magic)
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):1
                                                                                                                                                                                                                                            Entropy (8bit):0.0
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:3:v:v
                                                                                                                                                                                                                                            MD5:68B329DA9893E34099C7D8AD5CB9C940
                                                                                                                                                                                                                                            SHA1:ADC83B19E793491B1C6EA0FD8B46CD9F32E592FC
                                                                                                                                                                                                                                            SHA-256:01BA4719C80B6FE911B091A7C05124B64EEECE964E09C058EF8F9805DACA546B
                                                                                                                                                                                                                                            SHA-512:BE688838CA8686E5C90689BF2AB585CEF1137C999B48C70B92F67A5C34DC15697B5D11C982ED6D71BE1E1E7F7B4E0733884AA97C3F7A339A8ED03577CF74BE09
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:.

                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI2802\attrs-23.1.0.dist-info\INSTALLER

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Roaming\empyrean\dat.txt
                                                                                                                                                                                                                                            File Type:ASCII text
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):4
                                                                                                                                                                                                                                            Entropy (8bit):1.5
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:3:Mn:M
                                                                                                                                                                                                                                            MD5:365C9BFEB7D89244F2CE01C1DE44CB85
                                                                                                                                                                                                                                            SHA1:D7A03141D5D6B1E88B6B59EF08B6681DF212C599
                                                                                                                                                                                                                                            SHA-256:CEEBAE7B8927A3227E5303CF5E0F1F7B34BB542AD7250AC03FBCDE36EC2F1508
                                                                                                                                                                                                                                            SHA-512:D220D322A4053D84130567D626A9F7BB2FB8F0B854DA1621F001826DC61B0ED6D3F91793627E6F0AC2AC27AEA2B986B6A7A63427F05FE004D8A2ADFBDADC13C1
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:pip.

                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI2802\attrs-23.1.0.dist-info\METADATA

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Roaming\empyrean\dat.txt
                                                                                                                                                                                                                                            File Type:HTML document, Unicode text, UTF-8 text
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):11348
                                                                                                                                                                                                                                            Entropy (8bit):5.155260943272538
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:192:j/sUYExPRtXLt5Yy9EqOmoKTioEJdQ/0GmlWEx+VqAI6OfmEIPSo9t+kwLaH:j/sW6y9EqHoKvgAml9rqOnQLy8
                                                                                                                                                                                                                                            MD5:7774D77D730C0C295CB6E3E46817DAD6
                                                                                                                                                                                                                                            SHA1:406B5C84945B8DC1035BD53EB33F289B9AE699FC
                                                                                                                                                                                                                                            SHA-256:CA0970517928EF943E209E8B98F550E18F7D2894B708F2B4356F28BD7158B038
                                                                                                                                                                                                                                            SHA-512:6E991F3144CCA536E906A180DA7FAF3198521C81EFF4143FB943ECC6C6FAA558D0B1F2AA1379A7294BAA039D67202C671027D12C821D95B859EC25E0F78C2C21
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:Metadata-Version: 2.1.Name: attrs.Version: 23.1.0.Summary: Classes Without Boilerplate.Project-URL: Documentation, https://www.attrs.org/.Project-URL: Changelog, https://www.attrs.org/en/stable/changelog.html.Project-URL: Bug Tracker, https://github.com/python-attrs/attrs/issues.Project-URL: Source Code, https://github.com/python-attrs/attrs.Project-URL: Funding, https://github.com/sponsors/hynek.Project-URL: Tidelift, https://tidelift.com/subscription/pkg/pypi-attrs?utm_source=pypi-attrs&utm_medium=pypi.Author-email: Hynek Schlawack <hs@ox.cx>.License-Expression: MIT.License-File: LICENSE.Keywords: attribute,boilerplate,class.Classifier: Development Status :: 5 - Production/Stable.Classifier: Intended Audience :: Developers.Classifier: License :: OSI Approved :: MIT License.Classifier: Programming Language :: Python :: 3.7.Classifier: Programming Language :: Python :: 3.8.Classifier: Programming Language :: Python :: 3.9.Classifier: Programming Language :: Python :: 3.10.Classifier: P

                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI2802\attrs-23.1.0.dist-info\RECORD

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Roaming\empyrean\dat.txt
                                                                                                                                                                                                                                            File Type:CSV text
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):3642
                                                                                                                                                                                                                                            Entropy (8bit):5.807416853955938
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:96:QalxI0guUoqipQEqdwBxTGNmmUuAqG2PX2rUXjiFcoqL/+Q:zaUoUTGwnuA2XE9Q
                                                                                                                                                                                                                                            MD5:A3AD7B8CDA8539786366BBBEC93D29AD
                                                                                                                                                                                                                                            SHA1:D79FE6C3773C0E56AB64F6288B2CEF36BACC10A6
                                                                                                                                                                                                                                            SHA-256:0C4D6F02B4FECD5A3A81D45A6D684D38998F2A8DAB51490548A27D85A5377299
                                                                                                                                                                                                                                            SHA-512:03A7FBF8AE5FB6C4BAD790EDC6C3479BB604FB7E3F8CCCCB96FE7A8EF45DCEB1BCF12415D51437C5048AA01183A3CD0E55D5A64FA1E7B22D7DAB8031822ED77B
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:attr/__init__.py,sha256=dSRUBxRVTh-dXMrMR_oQ3ZISu2QSfhSZlik03Mjbu30,3241..attr/__init__.pyi,sha256=rIK-2IakIoehVtqXK5l5rs9_fJNCbnYtKTS3cOAVJD8,17609..attr/__pycache__/__init__.cpython-310.pyc,,..attr/__pycache__/_cmp.cpython-310.pyc,,..attr/__pycache__/_compat.cpython-310.pyc,,..attr/__pycache__/_config.cpython-310.pyc,,..attr/__pycache__/_funcs.cpython-310.pyc,,..attr/__pycache__/_make.cpython-310.pyc,,..attr/__pycache__/_next_gen.cpython-310.pyc,,..attr/__pycache__/_version_info.cpython-310.pyc,,..attr/__pycache__/converters.cpython-310.pyc,,..attr/__pycache__/exceptions.cpython-310.pyc,,..attr/__pycache__/filters.cpython-310.pyc,,..attr/__pycache__/setters.cpython-310.pyc,,..attr/__pycache__/validators.cpython-310.pyc,,..attr/_cmp.py,sha256=diMUQV-BIg7IjIb6-o1hswtnjrR4qdAUz_tE8gxS96w,4098..attr/_cmp.pyi,sha256=sGQmOM0w3_K4-X8cTXR7g0Hqr290E8PTObA9JQxWQqc,399..attr/_compat.py,sha256=d3cpIu60IbKrLywPni17RUEQY7MvkqqKifyzJ5H3zRU,5803..attr/_config.py,sha256=5W8lgRePuIOWu1ZuqF1899e2CmXGc9

                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI2802\attrs-23.1.0.dist-info\WHEEL

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Roaming\empyrean\dat.txt
                                                                                                                                                                                                                                            File Type:ASCII text
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):87
                                                                                                                                                                                                                                            Entropy (8bit):4.699003560068366
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:3:RtEeXAaCQnvxP+tPCCfA5I:Rt2PQZWBB3
                                                                                                                                                                                                                                            MD5:14CCD3CE79ED5ED7DAD2420CD7C0D412
                                                                                                                                                                                                                                            SHA1:388B959646735E0095900E61F3AF8A90F594F0A3
                                                                                                                                                                                                                                            SHA-256:108D89B06C9DC142F918FF6DEA4CD9BFB1B71C33E2EC5B990C37FD227E9A9913
                                                                                                                                                                                                                                            SHA-512:6EA1321D7F62E8284C3C5B29A3D7940890A4488503832457BF6580108351C0B2A0EE871928561DFF7F71C9BA9D1B89B2D93C1C5839EEC4815032E89E670934B4
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:Wheel-Version: 1.0.Generator: hatchling 1.14.0.Root-Is-Purelib: true.Tag: py3-none-any.

                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI2802\attrs-23.1.0.dist-info\licenses\LICENSE

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Roaming\empyrean\dat.txt
                                                                                                                                                                                                                                            File Type:ASCII text
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):1109
                                                                                                                                                                                                                                            Entropy (8bit):5.104415762129373
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:24:bGf8rUrmJHHH0yN3gtsHw1hC09QHOsUv4eOk4/+/m3oqLFh:bW8rUaJHlxE3dQHOs5exm3ogFh
                                                                                                                                                                                                                                            MD5:5E55731824CF9205CFABEAB9A0600887
                                                                                                                                                                                                                                            SHA1:243E9DD038D3D68C67D42C0C4BA80622C2A56246
                                                                                                                                                                                                                                            SHA-256:882115C95DFC2AF1EEB6714F8EC6D5CBCABF667CAFF8729F42420DA63F714E9F
                                                                                                                                                                                                                                            SHA-512:21B242BF6DCBAFA16336D77A40E69685D7E64A43CC30E13E484C72A93CD4496A7276E18137DC601B6A8C3C193CB775DB89853ECC6D6EB2956DEEE36826D5EBFE
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:The MIT License (MIT)..Copyright (c) 2015 Hynek Schlawack and the attrs contributors..Permission is hereby granted, free of charge, to any person obtaining a copy.of this software and associated documentation files (the "Software"), to deal.in the Software without restriction, including without limitation the rights.to use, copy, modify, merge, publish, distribute, sublicense, and/or sell.copies of the Software, and to permit persons to whom the Software is.furnished to do so, subject to the following conditions:..The above copyright notice and this permission notice shall be included in all.copies or substantial portions of the Software...THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR.IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,.FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE.AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER.LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHE

                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI2802\base_library.zip

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Roaming\empyrean\dat.txt
                                                                                                                                                                                                                                            File Type:Zip archive data, at least v2.0 to extract, compression method=store
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):831920
                                                                                                                                                                                                                                            Entropy (8bit):5.700113193168901
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:12288:9gYJuVvEWSxVqF8MgFA4a2YCdXVwxjfpEreiSRMN7:9gYJz1x3La2xVwxjfpErefMN7
                                                                                                                                                                                                                                            MD5:524A85217DC9EDC8C9EFC73159CA955D
                                                                                                                                                                                                                                            SHA1:A4238CBDE50443262D00A843FFE814435FB0F4E2
                                                                                                                                                                                                                                            SHA-256:808549964ADB09AFAFB410CDC030DF4813C5C2A7276A94E7F116103AF5DE7621
                                                                                                                                                                                                                                            SHA-512:F5A929B35A63F073BDC7600155BA2F0F262E6F60CF67EFB38FA44E8B3BE085CF1D5741D66D25A1ECAAF3F94ABFE9BBE97D135F8A47C11F2B811D2AAC6876F46C
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:PK..........!...`.5...5......._collections_abc.pyco........%.A........................@.......d.Z.d.d.l.m.Z.m.Z...d.d.l.Z.e.e.e.....Z.e.d...Z.d.d...Z.e.e...Z.[.g.d...Z.d.Z.e.e.d.....Z.e.e.e.......Z.e.e.i.........Z.e.e.i.........Z.e.e.i.........Z.e.e.g.....Z.e.e.e.g.......Z.e.e.e.d.......Z.e.e.e.d.d.>.......Z.e.e.e.......Z.e.e.d.....Z e.e.d.....Z!e.e.e"......Z#e.i.......Z$e.i.......Z%e.i.......Z&e.e.j'..Z(e.d.d.......Z)d.d...Z*e*..Z*e.e*..Z+e*.,....[*d.d...Z-e-..Z-e.e-..Z.[-d.d...Z/G.d.d...d.e.d...Z0G.d.d...d.e.d...Z1G.d.d...d.e1..Z2e2.3e+....G.d.d...d.e.d...Z4G.d.d ..d e4..Z5G.d!d"..d"e5..Z6e6.3e.....G.d#d$..d$e.d...Z7G.d%d&..d&e7..Z8e8.3e.....e8.3e.....e8.3e.....e8.3e.....e8.3e.....e8.3e.....e8.3e.....e8.3e.....e8.3e.....e8.3e.....e8.3e ....e8.3e!....e8.3e#....G.d'd(..d(e7..Z9G.d)d*..d*e8..Z:e:.3e)....G.d+d,..d,e.d...Z;G.d-d...d.e.d...Z<G.d/d0..d0e;e7e<..Z=G.d1d2..d2e...Z>d3d4..Z?d5d6..Z@d7d8..ZAG.d9d:..d:e.d...ZBG.d;d<..d<e=..ZCeC.3eD....G.d=d>..d>eC..ZEeE.3e.....G.d?d@..d@e=..ZFeF

                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI2802\certifi\cacert.pem

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Roaming\empyrean\dat.txt
                                                                                                                                                                                                                                            File Type:ASCII text
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):299427
                                                                                                                                                                                                                                            Entropy (8bit):6.047872935262006
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:6144:QW1x/M8fRR1jplkXURrVADwYCuCigT/QRSRqNb7d8iu5Nahx:QWb/TRJLWURrI5RWavdF08/
                                                                                                                                                                                                                                            MD5:50EA156B773E8803F6C1FE712F746CBA
                                                                                                                                                                                                                                            SHA1:2C68212E96605210EDDF740291862BDF59398AEF
                                                                                                                                                                                                                                            SHA-256:94EDEB66E91774FCAE93A05650914E29096259A5C7E871A1F65D461AB5201B47
                                                                                                                                                                                                                                            SHA-512:01ED2E7177A99E6CB3FBEF815321B6FA036AD14A3F93499F2CB5B0DAE5B713FD2E6955AA05F6BDA11D80E9E0275040005E5B7D616959B28EFC62ABB43A3238F0
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:.# Issuer: CN=GlobalSign Root CA O=GlobalSign nv-sa OU=Root CA.# Subject: CN=GlobalSign Root CA O=GlobalSign nv-sa OU=Root CA.# Label: "GlobalSign Root CA".# Serial: 4835703278459707669005204.# MD5 Fingerprint: 3e:45:52:15:09:51:92:e1:b7:5d:37:9f:b1:87:29:8a.# SHA1 Fingerprint: b1:bc:96:8b:d4:f4:9d:62:2a:a8:9a:81:f2:15:01:52:a4:1d:82:9c.# SHA256 Fingerprint: eb:d4:10:40:e4:bb:3e:c7:42:c9:e3:81:d3:1e:f2:a4:1a:48:b6:68:5c:96:e7:ce:f3:c1:df:6c:d4:33:1c:99.-----BEGIN CERTIFICATE-----.MIIDdTCCAl2gAwIBAgILBAAAAAABFUtaw5QwDQYJKoZIhvcNAQEFBQAwVzELMAkG.A1UEBhMCQkUxGTAXBgNVBAoTEEdsb2JhbFNpZ24gbnYtc2ExEDAOBgNVBAsTB1Jv.b3QgQ0ExGzAZBgNVBAMTEkdsb2JhbFNpZ24gUm9vdCBDQTAeFw05ODA5MDExMjAw.MDBaFw0yODAxMjgxMjAwMDBaMFcxCzAJBgNVBAYTAkJFMRkwFwYDVQQKExBHbG9i.YWxTaWduIG52LXNhMRAwDgYDVQQLEwdSb290IENBMRswGQYDVQQDExJHbG9iYWxT.aWduIFJvb3QgQ0EwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDaDuaZ.jc6j40+Kfvvxi4Mla+pIH/EqsLmVEQS98GPR4mdmzxzdzxtIK+6NiY6arymAZavp.xy0Sy6scTHAHoT0KMM0VjU/43dSMUBUc71DuxC73/OlS8pF94G3VNTCOXkNz

                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI2802\charset_normalizer\md.cp310-win_amd64.pyd

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Roaming\empyrean\dat.txt
                                                                                                                                                                                                                                            File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):9728
                                                                                                                                                                                                                                            Entropy (8bit):6.7152932063633255
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:192:vf0YFowZibj4wNg2ne15sZ7aaucmkyUxaVXFaLuH2iX:vN+wZiPg2eQoXcmnUxaVXALXi
                                                                                                                                                                                                                                            MD5:AC03714161DA507E824756742A877DA9
                                                                                                                                                                                                                                            SHA1:702DBD2296CA50F6502BC5AAC5B826B63CF9E200
                                                                                                                                                                                                                                            SHA-256:CAFC9C2BEFC85AF6CC0F9CF0FA7681BAE89C9ACF511CADC39A0CEE77D174B2C2
                                                                                                                                                                                                                                            SHA-512:6B773B2F31512211A0944391733B77F25EF720D07A4057AB8432941950403FACED50C8BC3166B36F648E6394BDF0D9943CCD81E689622558719DFE782C59BB2C
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Antivirus:
                                                                                                                                                                                                                                            • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$....................X...................................^............................4...........Rich....................PE..d...c#.g.........." ...). .......p........................................................`.........................................@...p......P............@..........................................................@...........................................UPX0.....p..............................UPX1..... ..........................@....rsrc................"..............@......................................................................................................................................................................................................................................................................................................................................................3.96.UPX!.$..

                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI2802\charset_normalizer\md__mypyc.cp310-win_amd64.pyd

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Roaming\empyrean\dat.txt
                                                                                                                                                                                                                                            File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):40448
                                                                                                                                                                                                                                            Entropy (8bit):7.852971014132377
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:768:lwMuNrL6Rm1CUja3BN0ep4U0Kv8WCpg1gkkX+vv5uwgSz:lJuNrLoeab3OW62XwPk
                                                                                                                                                                                                                                            MD5:150731368D678F5B2F9EA8CB1A966B8A
                                                                                                                                                                                                                                            SHA1:8263055AEE278B6724E30AFF7BD4BD471BB1C904
                                                                                                                                                                                                                                            SHA-256:08BBCCF9BE3982BBB356E5DF1E6FDDAA94BB5F12B765BCA7BD5701C86141F814
                                                                                                                                                                                                                                            SHA-512:A5E984F9995E13FEFD8A1750B8FEF7670CFEF11FF019880AF06D4DFF453416B43E077084F529E37FC24F4A70C1951CFC101F2611D7C860924BBF2922A98027A8
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Antivirus:
                                                                                                                                                                                                                                            • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........VyR.7...7...7...O...7.......7...O...7.......7.......7.......7..JB...7...7..b7......7......7......7......7..Rich.7..........PE..d...b#.g.........." ...).............H.......................................p............`..........................................b..d....`.......`......................<c.......................................T..@...........................................UPX0....................................UPX1................................@....rsrc........`......................@..............................................................................................................................................................................................................................................................................................................................................................3.96.UPX!.$..

                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI2802\frozenlist\_frozenlist.cp310-win_amd64.pyd

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Roaming\empyrean\dat.txt
                                                                                                                                                                                                                                            File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):37376
                                                                                                                                                                                                                                            Entropy (8bit):7.8223066199355635
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:768:DX5NQnY+H236BVyqRLjqutCwYUw/8WM+6OxWFfT0:lNQRWKBcIqgpw/2+NgR
                                                                                                                                                                                                                                            MD5:E115982EE531ACD056BF254EC6C7EE81
                                                                                                                                                                                                                                            SHA1:E8BF6292B21E93A9CD308561726899526F92B14F
                                                                                                                                                                                                                                            SHA-256:85C4106E07C01945F8A26D105E53F9E149635B7B976EBEFD6B2211CAA1E001D7
                                                                                                                                                                                                                                            SHA-512:10831AD85CD53277F30C13653958509909183003C2CDCBCD866EE3FBFE40A6D147EBB0EE3EE8AC6EF3272D814F320D02C827037E0FE6551465BB091D785A2C45
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Antivirus:
                                                                                                                                                                                                                                            • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......r.56..f6..f6..f?.Ef2..f&5.g4..f}..g4..f&5.g5..f&5.g>..f&5.g;..f...g5..f6..f...f}4.g7..f}4.g7..f}4)f7..f}4.g7..fRich6..f........PE..d...V..g.........." ...).........0.......@................................................`.............................................h....................p..|.......................................................@...........................................UPX0.....0..............................UPX1.........@......................@....rsrc...............................@..............................................................................................................................................................................................................................................................................................................................................................3.96.UPX!.$..

                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI2802\libcrypto-1_1.dll

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Roaming\empyrean\dat.txt
                                                                                                                                                                                                                                            File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):1189728
                                                                                                                                                                                                                                            Entropy (8bit):7.9451398145343335
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:24576:xffQrZJIe6/4gho5HE1F03fkOyUU/BtSIgA0ft+rBFOWRIQ6sCYB1CPwDv3uFfJp:pf8JWwgho5HL3fknPSIKorCo1CPwDv3Q
                                                                                                                                                                                                                                            MD5:DA5FE6E5CFC41381025994F261DF7148
                                                                                                                                                                                                                                            SHA1:13998E241464952D2D34EB6E8ECFCD2EB1F19A64
                                                                                                                                                                                                                                            SHA-256:DE045C36AE437A5B40FC90A8A7CC037FACD5B7E307CFCF9A9087C5F1A6A2CF18
                                                                                                                                                                                                                                            SHA-512:A0D7EBF83204065236439D495EB3C97BE093C41DAAC2E6CFBBB1AA8FFEAC049402A3DEA7139B1770D2E1A45E08623A56A94D64C8F0C5BE74C5BAE039A2BC6CA9
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Antivirus:
                                                                                                                                                                                                                                            • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........a...2...2...2...2...2..3...2..3...2..3...2..3...2...2...2L.3...2..3...2..3.2..3...2..p2...2..3...2Rich...2........................PE..d...m..b.........." ... .........@%.025..P%..................................P7...........`......................................... H5......C5.h....@5......`2.............H7......................................=5.@...........................................UPX0.....@%.............................UPX1.........P%.....................@....rsrc........@5.....................@..............................................................................................................................................................................................................................................................................................................................................3.96.UPX!.$..

                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI2802\libffi-7.dll

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Roaming\empyrean\dat.txt
                                                                                                                                                                                                                                            File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):24088
                                                                                                                                                                                                                                            Entropy (8bit):7.529671673324906
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:384:TRZBxuj5W4IBzuU2CUvOEvbY4nUxaVXALNxZRCXTpnYPLxDG4y80uzFLhHj:lwlGuUm2EvbrmWpWDG4yKRF
                                                                                                                                                                                                                                            MD5:B5150B41CA910F212A1DD236832EB472
                                                                                                                                                                                                                                            SHA1:A17809732C562524B185953FFE60DFA91BA3CE7D
                                                                                                                                                                                                                                            SHA-256:1A106569AC0AD3152F3816FF361AA227371D0D85425B357632776AC48D92EA8A
                                                                                                                                                                                                                                            SHA-512:9E82B0CAA3D72BB4A7AD7D66EBFB10EDB778749E89280BCA67C766E72DC794E99AAB2BC2980D64282A384699929CE6CC996462A73584898D2DF67A57BFF2A9C6
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Antivirus:
                                                                                                                                                                                                                                            • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......6.3.r}]Ar}]Ar}]A{..Ap}]A .\@p}]A..\@q}]Ar}\AU}]A .X@~}]A .Y@z}]A .^@q}]A..Y@t}]A..^@s}]A..]@s}]A.._@s}]ARichr}]A........................PE..d......].........." .....@................................................................`.........................................................................................................................................................................UPX0....................................UPX1.....@.......:..................@...UPX2.................>..............@......................................................................................................................................................................................................................................................................................................................................................3.96.UPX!.$..

                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI2802\libssl-1_1.dll

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Roaming\empyrean\dat.txt
                                                                                                                                                                                                                                            File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):208224
                                                                                                                                                                                                                                            Entropy (8bit):7.921732676851239
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:3072:XSI3oPlWLlPVVc5MpJa1pOjJnnioIZW8/Qf6bRXGKrs8qJjueW1LR/oSBZLetz:CIek5VC0FiHof6Z1rgJ63R/oSi
                                                                                                                                                                                                                                            MD5:48D792202922FFFE8EA12798F03D94DE
                                                                                                                                                                                                                                            SHA1:F8818BE47BECB8CCF2907399F62019C3BE0EFEB5
                                                                                                                                                                                                                                            SHA-256:8221A76831A103B2B2AE01C3702D0BBA4F82F2AFD4390A3727056E60B28650CC
                                                                                                                                                                                                                                            SHA-512:69F3A8B556DD517AE89084623F499EF89BD0F97031E3006677CEED330ED13FCC56BF3CDE5C9ED0FC6C440487D13899FFDA775E6A967966294CADFD70069B2833
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Antivirus:
                                                                                                                                                                                                                                            • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........D.p*..p*..p*......p*...+..p*.\.+..p*.../..p*......p*...)..p*...+..p*..p+.iq*......p*...*..p*.....p*...(..p*.Rich.p*.........PE..d......b.........." ... .....P...`..@....p................................................`..........................................6..4@...3.......0...........M...........v......................................8%..@...........................................UPX0.....`..............................UPX1.........p......................@....rsrc....P...0...H..................@..............................................................................................................................................................................................................................................................................................................................................................3.96.UPX!.$..

                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI2802\mfc140u.dll

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Roaming\empyrean\dat.txt
                                                                                                                                                                                                                                            File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):5653424
                                                                                                                                                                                                                                            Entropy (8bit):6.729277267882055
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:49152:EuEsNcEc8/CK4b11P5ViH8gw0+NVQD5stWIlE7lva8iposS9j5fzSQzs7ID+AVuS:EnL8+5fiEnQFLOAkGkzdnEVomFHKnPS
                                                                                                                                                                                                                                            MD5:03A161718F1D5E41897236D48C91AE3C
                                                                                                                                                                                                                                            SHA1:32B10EB46BAFB9F81A402CB7EFF4767418956BD4
                                                                                                                                                                                                                                            SHA-256:E06C4BD078F4690AA8874A3DEB38E802B2A16CCB602A7EDC2E077E98C05B5807
                                                                                                                                                                                                                                            SHA-512:7ABCC90E845B43D264EE18C9565C7D0CBB383BFD72B9CEBB198BA60C4A46F56DA5480DA51C90FF82957AD4C84A4799FA3EB0CEDFFAA6195F1315B3FF3DA1BE47
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Antivirus:
                                                                                                                                                                                                                                            • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......Q.cu...&...&...&...'...&...'...&...'...&..&...&G..'...&G..'...&...'...&...&..&G..'...&G..'...&G..'...&G..'...&G..&...&G..'...&Rich...&................PE..d....~.a.........." .....(-..X)......X,.......................................V......YV...`A..........................................:.....h.;.......?......`=..8....V..'...PU.0p..p.5.T...........................`...8............@-.P...0.:......................text....&-......(-................. ..`.rdata.......@-......,-.............@..@.data....6... <.......<.............@....pdata...8...`=..:....<.............@..@.didat..H.....?.......?.............@....rsrc.........?.......?.............@..@.reloc..0p...PU..r....T.............@..B................................................................................................................................................................................

                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI2802\multidict\_multidict.cp310-win_amd64.pyd

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Roaming\empyrean\dat.txt
                                                                                                                                                                                                                                            File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):20480
                                                                                                                                                                                                                                            Entropy (8bit):7.620137621014922
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:384:3j0inCNIw61COjZ0FbIj/jvIUrn+HHRCkmJeZMF50aEB1lZ9nUxaVXALeqg8:3w1D6vjZd1SxCjeZM0TBX1q
                                                                                                                                                                                                                                            MD5:0A9B975CEE2760BFF77865A34F7028F0
                                                                                                                                                                                                                                            SHA1:55FCC33419E41A43FB5B52EF81A9A150C480F98E
                                                                                                                                                                                                                                            SHA-256:20424D01666FC6C53F2DE690C68DD4E0755BD40BF26D983C0E986DDDC7995615
                                                                                                                                                                                                                                            SHA-512:86C8B09FDC5355614E831AB869D02EC5423F6943DE158F51896422CDFC3F4BD8CFD9664F47AB2EE87DB0BE2BB48CF10DD42CF877542DE0593FE6FEACB69731D7
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Antivirus:
                                                                                                                                                                                                                                            • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........o.T.............v?............v........................&{................................S.............Rich............PE..d....|.f.........." ...).P...................................................@............`.........................................@2..d....0..P....0.......................2.......................................&..@...........................................UPX0....................................UPX1.....P.......H..................@....rsrc........0.......L..............@..............................................................................................................................................................................................................................................................................................................................................................3.96.UPX!.$..

                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI2802\propcache\_helpers_c.cp310-win_amd64.pyd

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Roaming\empyrean\dat.txt
                                                                                                                                                                                                                                            File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):32768
                                                                                                                                                                                                                                            Entropy (8bit):7.777596001077688
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:768:saXim60eBsX5cAR0NOhDEuU8dP0LAZ2dP97MTT5:saXi0eB45cAASDEuNd8LAZ2p97Mn
                                                                                                                                                                                                                                            MD5:1E8E455DAB1C155FA2ADC89C244971BA
                                                                                                                                                                                                                                            SHA1:8347F3A0888D4389749D4401044318651698F0E2
                                                                                                                                                                                                                                            SHA-256:960CFB8E43176D3F11309A9A6FB646F5349E5F323A41082DC9745D2430180887
                                                                                                                                                                                                                                            SHA-512:BA3E3F0E8D7CCF0A368D2DCD67B80F73A3364287460427079BA45489F0F257A4E515775A5F8980352C1F971054DBB3941FA17E09F305E74921834C50E7C33611
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Antivirus:
                                                                                                                                                                                                                                            • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........o.T.............v?..............v..............................b{...........................S...........Rich....................PE..d......g.........." ...)................. ................................................`.........................................@...d......P............@..l.......................................................@...........................................UPX0....................................UPX1......... ...x..................@....rsrc................|..............@......................................................................................................................................................................................................................................................................................................................................................3.96.UPX!.$..

                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI2802\psutil\_psutil_windows.pyd

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Roaming\empyrean\dat.txt
                                                                                                                                                                                                                                            File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):34816
                                                                                                                                                                                                                                            Entropy (8bit):7.787702936942791
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:768:l5HOA2w0JLJLH+AKL7/d2gt6UDsPioZLxivYG7HWFynfcwRVG:LHOE0T+AKL70g/oZ9sY22Ef9V
                                                                                                                                                                                                                                            MD5:FB17B2F2F09725C3FFCA6345ACD7F0A8
                                                                                                                                                                                                                                            SHA1:B8D747CC0CB9F7646181536D9451D91D83B9FC61
                                                                                                                                                                                                                                            SHA-256:9C7D401418DB14353DB85B54FF8C7773EE5D17CBF9A20085FDE4AF652BD24FC4
                                                                                                                                                                                                                                            SHA-512:B4ACB60045DA8639779B6BB01175B13344C3705C92EA55F9C2942F06C89E5F43CEDAE8C691836D63183CACF2D0A98AA3BCB0354528F1707956B252206991BF63
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Antivirus:
                                                                                                                                                                                                                                            • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............O..O..O...O..O..N..O..N..O..N..O..N..O...N..O..N..O..O,.OY..N..OY..N..OY.pO..OY..N..ORich..O........PE..d.....=d.........." ............. ......0................................................`.........................................8...`......H............P..X......................................................8...........................................UPX0..... ..............................UPX1.........0...~..................@....rsrc...............................@..............................................................................................................................................................................................................................................................................................................................................................3.96.UPX!.$..

                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI2802\pyexpat.pyd

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Roaming\empyrean\dat.txt
                                                                                                                                                                                                                                            File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):88440
                                                                                                                                                                                                                                            Entropy (8bit):7.917287109292123
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:1536:HqOsxiaMRf0wQhTR0lJrTMQLFrwAx0qHMKVqhgjOE+hpeWpUM2MkNpho8aI7Qhgk:K8kmJfMQLFD+XWq+aDBplFk+I7Qhge0g
                                                                                                                                                                                                                                            MD5:5A328B011FA748939264318A433297E2
                                                                                                                                                                                                                                            SHA1:D46DD2BE7C452E5B6525E88A2D29179F4C07DE65
                                                                                                                                                                                                                                            SHA-256:E8A81B47029E8500E0F4E04CCF81F8BDF23A599A2B5CD627095678CDF2FABC14
                                                                                                                                                                                                                                            SHA-512:06FA8262378634A42F5AB8C1E5F6716202544C8B304DE327A08AA20C8F888114746F69B725ED3088D975D09094DF7C3A37338A93983B957723AA2B7FDA597F87
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Antivirus:
                                                                                                                                                                                                                                            • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......9h..}..}..}..tqu.q..2u....2u.p..2u.u..2u.~...u....{.~..}......u.y...u.|...u..|...u.|..Rich}..................PE..d...+..c.........." ...". ........... .......................................@............`..........................................<..P....9.......0.......................<.......................................,..@...........................................UPX0....................................UPX1..... ..........................@....rsrc........0......."..............@......................................................................................................................................................................................................................................................................................................................................................3.96.UPX!.$..

                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI2802\pyinstaller-5.1.dist-info\COPYING.txt

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Roaming\empyrean\dat.txt
                                                                                                                                                                                                                                            File Type:ASCII text
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):30634
                                                                                                                                                                                                                                            Entropy (8bit):4.687948422038189
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:384:8+ztint/HdxEUwi5rDL676yV12rPd34ZomzM2FR+qWi9vlKM1zJlFvmNz5VrlkTv:rzolHv7FgixMFzMqd9TzJlFvAfxk1rt
                                                                                                                                                                                                                                            MD5:371FE7FDEE041250F12B3A4658A14278
                                                                                                                                                                                                                                            SHA1:A4AAA06709FF77945CA1A42ECCC06C9C99182A27
                                                                                                                                                                                                                                            SHA-256:DD7315735D0C3CBB0CC861A3EA4D9CEE497568B98CACEA64AF3EA51F4E4B5386
                                                                                                                                                                                                                                            SHA-512:77FBA931238B59A44357996EC3A39D5E8CDD8E8CBED963927A814B30AADA1F0FF88FB2D62D2DCD9955DBA9458C4A310252B72E52963FEBD0E80639ABA53A9D19
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:================================. The PyInstaller licensing terms.================================. ..Copyright (c) 2010-2022, PyInstaller Development Team.Copyright (c) 2005-2009, Giovanni Bajo.Based on previous work under copyright (c) 2002 McMillan Enterprises, Inc....PyInstaller is licensed under the terms of the GNU General Public License.as published by the Free Software Foundation; either version 2 of the License,.or (at your option) any later version....Bootloader Exception.--------------------..In addition to the permissions in the GNU General Public License, the.authors give you unlimited permission to link or embed compiled bootloader.and related files into combinations with other programs, and to distribute.those combinations without any restriction coming from the use of those.files. (The General Public License restrictions do apply in other respects;.for example, they cover modification of the files, and distribution when.not linked into a combined executable.). . .Bootlo

                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI2802\pyinstaller-5.1.dist-info\INSTALLER

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Roaming\empyrean\dat.txt
                                                                                                                                                                                                                                            File Type:ASCII text
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):4
                                                                                                                                                                                                                                            Entropy (8bit):1.5
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:3:Mn:M
                                                                                                                                                                                                                                            MD5:365C9BFEB7D89244F2CE01C1DE44CB85
                                                                                                                                                                                                                                            SHA1:D7A03141D5D6B1E88B6B59EF08B6681DF212C599
                                                                                                                                                                                                                                            SHA-256:CEEBAE7B8927A3227E5303CF5E0F1F7B34BB542AD7250AC03FBCDE36EC2F1508
                                                                                                                                                                                                                                            SHA-512:D220D322A4053D84130567D626A9F7BB2FB8F0B854DA1621F001826DC61B0ED6D3F91793627E6F0AC2AC27AEA2B986B6A7A63427F05FE004D8A2ADFBDADC13C1
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:pip.

                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI2802\pyinstaller-5.1.dist-info\METADATA

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Roaming\empyrean\dat.txt
                                                                                                                                                                                                                                            File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):7292
                                                                                                                                                                                                                                            Entropy (8bit):5.0285832056593485
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:192:VZBasM/s4VN2ZKMWNOXMdUUmUqhpVqhkHv:K72ZRCOXmUU8hpukHv
                                                                                                                                                                                                                                            MD5:E7753706452DF740FDC082E289749E18
                                                                                                                                                                                                                                            SHA1:EDC4321CB411C97514854D84230FE513596B798F
                                                                                                                                                                                                                                            SHA-256:B7F3A310E76406C2DFF20B84BF92BC7507E9612ED063C010291F1A93FA28C73C
                                                                                                                                                                                                                                            SHA-512:D5BC6F1146DB79A73F2435823A21F579FED659AD8FC36563C4C833160E2E829687AE7C086C309F2487E9551E2EFB65494CCEA21474E8AFC340F163766371DF0F
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:Metadata-Version: 2.1..Name: pyinstaller..Version: 5.1..Summary: PyInstaller bundles a Python application and all its dependencies into a single package...Home-page: https://www.pyinstaller.org/..Author: Hartmut Goebel, Giovanni Bajo, David Vierra, David Cortesi, Martin Zibricky..License: GPLv2-or-later with a special exception which allows to use PyInstaller to build and distribute non-free programs (including commercial ones)..Project-URL: Source, https://github.com/pyinstaller/pyinstaller..Keywords: packaging, app, apps, bundle, convert, standalone, executable,pyinstaller, cxfreeze, freeze, py2exe, py2app, bbfreeze..Classifier: Development Status :: 6 - Mature..Classifier: Environment :: Console..Classifier: Intended Audience :: Developers..Classifier: Intended Audience :: Other Audience..Classifier: Intended Audience :: System Administrators..Classifier: License :: OSI Approved :: GNU General Public License v2 (GPLv2)..Classifier: Natural Language :: English..Classifier: Operating

                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI2802\pyinstaller-5.1.dist-info\RECORD

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Roaming\empyrean\dat.txt
                                                                                                                                                                                                                                            File Type:CSV text
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):61650
                                                                                                                                                                                                                                            Entropy (8bit):5.605684014075479
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:1536:HqEIJtsSWQJQq4WPY1y0yvtZY6W3+j73wt5a14bXPA+Yla1U9MZhGO5oLZlu:CU/ZiL7u
                                                                                                                                                                                                                                            MD5:FB69230F6D30CF6906AD4EC3BD4964E4
                                                                                                                                                                                                                                            SHA1:51EDDAD0A01A5393084943BD928AFB8D00CDB36A
                                                                                                                                                                                                                                            SHA-256:AAA4F7B839D22619D352A1E644E3F625DFD04B70052C337898D192C85B5E3227
                                                                                                                                                                                                                                            SHA-512:0032D514C6957C68C2A77AA6ED6136F81D54216B25006E1A1DF9F031C48BBAE72BE7E9AC7EE3043AD46C3FB9D445C754D0567259FF14F5ECADC4B97C3E728496
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:../../Scripts/pyi-archive_viewer.exe,sha256=zeUWRldhfNTI8CFN69VnOZ4InP-GQYR5AlTOz7hI7ZU,108441..../../Scripts/pyi-bindepend.exe,sha256=zJH--FKRys5R8kVEf73Gcl2sEaFuEbmvDaZPY1xfREo,108436..../../Scripts/pyi-grab_version.exe,sha256=BCM902Q4Utj6Bb-VQYMVNHdnJAR6u6H88j_4FKARIZ4,108439..../../Scripts/pyi-makespec.exe,sha256=LCvrmmuKraQ0Wsh1HqXoGZO5k13qWk_t80W3U8UGgU4,108435..../../Scripts/pyi-set_version.exe,sha256=7LDhhmmiEm9WkWCJ75QC2EIWB7NBiYgAQGIgKkh8c6E,108438..../../Scripts/pyinstaller.exe,sha256=-kiDALlfa3e3PjBy0wMqRd_-gR0qLShqogOn9qtzK1c,108420..PyInstaller/__init__.py,sha256=yxwRT03ZzCOJlfU8-OxhCCUTqjifnWlXnZQtpEOzjoo,2995..PyInstaller/__main__.py,sha256=2KLwhQRzVi24ICVDCEe-QQOXvk5q1eoPa6HMMnAyD0g,6688..PyInstaller/__pycache__/__init__.cpython-310.pyc,,..PyInstaller/__pycache__/__main__.cpython-310.pyc,,..PyInstaller/__pycache__/_recursion_to_deep_message.cpython-310.pyc,,..PyInstaller/__pycache__/_shared_with_waf.cpython-310.pyc,,..PyInstaller/__pycache__/compat.cpython-310.pyc,,..P

                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI2802\pyinstaller-5.1.dist-info\WHEEL

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Roaming\empyrean\dat.txt
                                                                                                                                                                                                                                            File Type:ASCII text
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):91
                                                                                                                                                                                                                                            Entropy (8bit):4.718144065224423
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:3:RtEeXMRYFAQb6gP+tPCCfA5S:RtC1cxWBBf
                                                                                                                                                                                                                                            MD5:F8DE0AF416CFA64B783E891E98B23FB2
                                                                                                                                                                                                                                            SHA1:49C79C79C440ED3BC40387054075670F05445FCF
                                                                                                                                                                                                                                            SHA-256:474E8F0375156074E1C07BF1B9158CA9A19CAFE3EE9E25DA8708E641114C1246
                                                                                                                                                                                                                                            SHA-512:04FDA440B27B7A1B701EE33731253FAF850B5ACE046F0CF3B7A02FF66EB268975177589430ABF049D1D1DD9CB58C73019A763BE06DDCEACB0348E4089B60B6FF
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:Wheel-Version: 1.0.Generator: setuptools (75.5.0).Root-Is-Purelib: true.Tag: py3-none-any..

                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI2802\pyinstaller-5.1.dist-info\direct_url.json

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Roaming\empyrean\dat.txt
                                                                                                                                                                                                                                            File Type:JSON data
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):109
                                                                                                                                                                                                                                            Entropy (8bit):4.639181519626878
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:3:YBM7W/RzQXjHxi6KjAXWKVVtgK3rIlw3rIldrDJOXIeUHY:Ym6RzKRihjFGPbIKbIrVOX5U4
                                                                                                                                                                                                                                            MD5:4E1763FA942DDBF4753FE8C21D7BD31C
                                                                                                                                                                                                                                            SHA1:3DDDF2939F1488DE229B8C4B9FBB3DA9D4CDEF13
                                                                                                                                                                                                                                            SHA-256:D006A8C986B233A281FDDB267AFDAC05E79B1CDF2A79E8B0B3A761EDFDACC781
                                                                                                                                                                                                                                            SHA-512:700B0AAF9E9B17DA82853D74C2725D1B054658D2552102E0E634FE61B71E574BF2C978E251BA830B61BA57DDCC1FB8383C31DD11D52C4C723987DDAC0946C0E9
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:{"dir_info": {}, "url": "file:///C:/Users/poops/Downloads/empyrean-main/empyrean-main/build/pyinstaller-5.1"}

                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI2802\pyinstaller-5.1.dist-info\entry_points.txt

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Roaming\empyrean\dat.txt
                                                                                                                                                                                                                                            File Type:ASCII text
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):360
                                                                                                                                                                                                                                            Entropy (8bit):4.529432579272841
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:6:1VkKXL0DjyXLfUynXLEB85AQFXLHHVtAcRNnXLAX2OXFnXLLMi:1qKXIyXLpXg4hX7VtdFXsX2OXFnXMi
                                                                                                                                                                                                                                            MD5:E15B5909D49DAB451BEB91C31B9732BF
                                                                                                                                                                                                                                            SHA1:83A5F4EFEF9C91101FA2E7AC0CBED17FE9282145
                                                                                                                                                                                                                                            SHA-256:933880B425B47C933547830B21387BA2144517BCA3638B213A88F4E3441DBD02
                                                                                                                                                                                                                                            SHA-512:AE280B4B217AA95D7275B58DC73E7586C1999DC363A0B83E7CA350207541F13B18F30B2BB634EB4BA2F4C191940B5CCC7FC201024000E4FD28431AE6C4A69617
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:[console_scripts].pyi-archive_viewer = PyInstaller.utils.cliutils.archive_viewer:run.pyi-bindepend = PyInstaller.utils.cliutils.bindepend:run.pyi-grab_version = PyInstaller.utils.cliutils.grab_version:run.pyi-makespec = PyInstaller.utils.cliutils.makespec:run.pyi-set_version = PyInstaller.utils.cliutils.set_version:run.pyinstaller = PyInstaller.__main__:run.

                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI2802\pyinstaller-5.1.dist-info\top_level.txt

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Roaming\empyrean\dat.txt
                                                                                                                                                                                                                                            File Type:ASCII text
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):12
                                                                                                                                                                                                                                            Entropy (8bit):3.418295834054489
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:3:rLWTXvn:f8Xvn
                                                                                                                                                                                                                                            MD5:0A28E8E758F80C4B73AFD9DBEF9F96DD
                                                                                                                                                                                                                                            SHA1:10072E4EC58C0E15D5A62FD256AC9D7BC6A28BCB
                                                                                                                                                                                                                                            SHA-256:1AE466BD65C64D124D6262B989618E82536FE0BDDBCBB60A68488AC9C359E174
                                                                                                                                                                                                                                            SHA-512:38D7A1B6198701708F90750C9D82390A150972FB898FC91C825FF6F6FE2A560B3BCC381A388BB7FE5DFAE63550BEC2A6A7CFED1390E620A5B2A559726C1439E5
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:PyInstaller.

                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI2802\python3.dll

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Roaming\empyrean\dat.txt
                                                                                                                                                                                                                                            File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):64896
                                                                                                                                                                                                                                            Entropy (8bit):6.101810529421494
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:768:Y88LeBLeeFtp5V1BfO2yvSk70QZF1nEyjnskQkr/RFB1qucwdBeCw0myou6ZwJq9:Y8wewnvtjnsfwERI7Q0L7SyCPx
                                                                                                                                                                                                                                            MD5:C17B7A4B853827F538576F4C3521C653
                                                                                                                                                                                                                                            SHA1:6115047D02FBBAD4FF32AFB4EBD439F5D529485A
                                                                                                                                                                                                                                            SHA-256:D21E60F3DFBF2BAB0CC8A06656721FA3347F026DF10297674FC635EBF9559A68
                                                                                                                                                                                                                                            SHA-512:8E08E702D69DF6840781D174C4565E14A28022B40F650FDA88D60172BE2D4FFD96A3E9426D20718C54072CA0DA27E0455CC0394C098B75E062A27559234A3DF7
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Antivirus:
                                                                                                                                                                                                                                            • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......]{....e...e...e..fm...e..fe...e..f....e..fg...e.Rich..e.........................PE..d......c.........." ..."..................................................................`.........................................`...`................................)..............T............................................................................rdata..............................@..@.rsrc...............................@..@................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI2802\python310.dll

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Roaming\empyrean\dat.txt
                                                                                                                                                                                                                                            File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):1513336
                                                                                                                                                                                                                                            Entropy (8bit):7.992007410704943
                                                                                                                                                                                                                                            Encrypted:true
                                                                                                                                                                                                                                            SSDEEP:24576:3mhx0O5yMVUEV51zVZ/7KqaI0jVSn/OCNYLfUehwHqDdt9OJzoCr2TAY/f+TNX56:3mT0OjUK51xZ/7s6GDwKDD9OJEwsAE2C
                                                                                                                                                                                                                                            MD5:69D4F13FBAEEE9B551C2D9A4A94D4458
                                                                                                                                                                                                                                            SHA1:69540D8DFC0EE299A7FF6585018C7DB0662AA629
                                                                                                                                                                                                                                            SHA-256:801317463BD116E603878C7C106093BA7DB2BECE11E691793E93065223FC7046
                                                                                                                                                                                                                                            SHA-512:8E632F141DAF44BC470F8EE677C6F0FDCBCACBFCE1472D928576BF7B9F91D6B76639D18E386D5E1C97E538A8FE19DD2D22EA47AE1ACF138A0925E3C6DD156378
                                                                                                                                                                                                                                            Malicious:true
                                                                                                                                                                                                                                            Antivirus:
                                                                                                                                                                                                                                            • Antivirus: ReversingLabs, Detection: 4%
                                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........<...R..R..R...S..R......R...W..R...V..R...Q..R.....R.K.S..R..S..R.'._.X.R.'.R..R.'....R.'.P..R.Rich..R.........PE..d......c.........." ...". ......../...E.../...................................F...........`...........................................F.......F.d.....F.......B...............F.......................................E.@...........................................UPX0....../.............................UPX1..... ..../.....................@....rsrc.........F.....................@..............................................................................................................................................................................................................................................................................................................................................................3.96.UPX!.$..

                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI2802\pythoncom310.dll

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Roaming\empyrean\dat.txt
                                                                                                                                                                                                                                            File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):198144
                                                                                                                                                                                                                                            Entropy (8bit):7.899184952490433
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:6144:irs7d9ovn0ICgOdewE9SJy9sZQ3KfmPpd:b59ovn0IC1yl3xPpd
                                                                                                                                                                                                                                            MD5:9051ABAE01A41EA13FEBDEA7D93470C0
                                                                                                                                                                                                                                            SHA1:B06BD4CD4FD453EB827A108E137320D5DC3A002F
                                                                                                                                                                                                                                            SHA-256:F12C8141D4795719035C89FF459823ED6174564136020739C106F08A6257B399
                                                                                                                                                                                                                                            SHA-512:58D8277EC4101AD468DD8C4B4A9353AB684ECC391E5F9DB37DE44D5C3316C17D4C7A5FFD547CE9B9A08C56E3DD6D3C87428EAE12144DFB72FC448B0F2CFC47DA
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Antivirus:
                                                                                                                                                                                                                                            • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......B..x...+...+...+..P+...+T..*...+T..*...+T..*...+T..*...+..*...+...*...+...*...+...*...+...+U..+..*W..+..*...+..*...+Rich...+................PE..d...k..d.........." .........p.......7....................................................`.........................................0W...c..pS.......P..p....@...z..................................................C..8...........................................UPX0....................................UPX1................................@....rsrc....p...P...l..................@..............................................................................................................................................................................................................................................................................................................................................3.96.UPX!.$..

                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI2802\pywintypes310.dll

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Roaming\empyrean\dat.txt
                                                                                                                                                                                                                                            File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):64000
                                                                                                                                                                                                                                            Entropy (8bit):7.542185527581843
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:1536:k2xBKwcTFzoNwouLGtUHhYrn/irawXffuJm8ei:kaBKwGOwoKGtUHhsnalvfuTe
                                                                                                                                                                                                                                            MD5:6F2AA8FA02F59671F99083F9CEF12CDA
                                                                                                                                                                                                                                            SHA1:9FD0716BCDE6AC01CD916BE28AA4297C5D4791CD
                                                                                                                                                                                                                                            SHA-256:1A15D98D4F9622FA81B60876A5F359707A88FBBBAE3AE4E0C799192C378EF8C6
                                                                                                                                                                                                                                            SHA-512:F5D5112E63307068CDB1D0670FE24B65A9F4942A39416F537BDBC17DEDFD99963861BF0F4E94299CDCE874816F27B3D86C4BEBB889C3162C666D5EE92229C211
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Antivirus:
                                                                                                                                                                                                                                            • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........9.$.X.w.X.w.X.w. [w.X.w.-.v.X.w.75w.X.w.-.v.X.w.-.v.X.w.-.v.X.w.3.v.X.wJ1.v.X.w.3.v.X.w.X.w.X.w,-.v.X.w,-.v.X.w,-.v.X.wRich.X.w........................PE..d......d.........." .........P.......z....................................................`.........................................p...dB..p...........p.......L......................................................8...........................................UPX0....................................UPX1................................@....rsrc....P.......J..................@......................................................................................................................................................................................................................................................................................................................................3.96.UPX!.$..

                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI2802\select.pyd

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Roaming\empyrean\dat.txt
                                                                                                                                                                                                                                            File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):24952
                                                                                                                                                                                                                                            Entropy (8bit):7.398475586533855
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:384:wm71gl6dfHKsz8nUxaVXALcTwI77G26hMWIYiSy1pCQ0AA7Pxh8E9VF0Nym5ty:/1gl65HKXzTwI77G2BYiSyv87PxWEgC
                                                                                                                                                                                                                                            MD5:72009CDE5945DE0673A11EFB521C8CCD
                                                                                                                                                                                                                                            SHA1:BDDB47AC13C6302A871A53BA303001837939F837
                                                                                                                                                                                                                                            SHA-256:5AAA15868421A46461156E7817A69EEEB10B29C1E826A9155B5F8854FACF3DCA
                                                                                                                                                                                                                                            SHA-512:D00A42700C9201F23A44FD9407FEA7EA9DF1014C976133F33FF711150727BF160941373D53F3A973F7DD6CA7B5502E178C2B88EA1815CA8BCE1A239ED5D8256D
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Antivirus:
                                                                                                                                                                                                                                            • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........].t.<r'.<r'.<r'.D.'.<r'.@s&.<r'.@w&.<r'.@v&.<r'.@q&.<r'i@s&.<r'.<s'.<r'.Ns&.<r'i@.&.<r'i@r&.<r'i@.'.<r'i@p&.<r'Rich.<r'........PE..d...&..c.........." ...".0..........@.....................................................`......................................... ...L....................`..............l.......................................H...@...........................................UPX0....................................UPX1.....0.......(..................@....rsrc................,..............@..............................................................................................................................................................................................................................................................................................................................................................3.96.UPX!.$..

                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI2802\sqlite3.dll

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Roaming\empyrean\dat.txt
                                                                                                                                                                                                                                            File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):623480
                                                                                                                                                                                                                                            Entropy (8bit):7.993548202681751
                                                                                                                                                                                                                                            Encrypted:true
                                                                                                                                                                                                                                            SSDEEP:12288:qZNIrMyJHzTarSwdWd5Xhm/27cz5hQYuHDiL1IcUq4P8ryHn5+8yjz:2NPsHzTaWwdS5xV70QYMDiCc34e8nI8+
                                                                                                                                                                                                                                            MD5:B70D218798C0FEC39DE1199C796EBCE8
                                                                                                                                                                                                                                            SHA1:73B9F8389706790A0FEC3C7662C997D0A238A4A0
                                                                                                                                                                                                                                            SHA-256:4830E8D4AE005A73834371FE7BB5B91CA8A4C4C3A4B9A838939F18920F10FAFF
                                                                                                                                                                                                                                            SHA-512:2EDE15CC8A229BFC599980CE7180A7A3C37C0264415470801CF098EF4DAC7BCF857821F647614490C1B0865882619A24E3AC0848B5AEA1796FAD054C0DD6F718
                                                                                                                                                                                                                                            Malicious:true
                                                                                                                                                                                                                                            Antivirus:
                                                                                                                                                                                                                                            • Antivirus: ReversingLabs, Detection: 4%
                                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......CG;..&U..&U..&U..^..&U.HZT..&U.HZP..&U.HZQ..&U.HZV..&U..TT..&U..&T..&U..Z]..&U..ZU..&U..Z...&U..ZW..&U.Rich.&U.................PE..d...X..c.........." ...".0...0............................................................`.............................................d"..................................x...........................................@...........................................UPX0....................................UPX1.....0.......(..................@....rsrc....0...........,..............@..............................................................................................................................................................................................................................................................................................................................................................3.96.UPX!.$..

                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI2802\unicodedata.pyd

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Roaming\empyrean\dat.txt
                                                                                                                                                                                                                                            File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):294784
                                                                                                                                                                                                                                            Entropy (8bit):7.987306847288753
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:6144:XudZUEjoXwDrGv4qJBd4R0u3FIp6O4LMHS+OsfW/+vzoFZ:MGEjyirGd+f3FIp7eMHS+CUUT
                                                                                                                                                                                                                                            MD5:CA3BAEBF8725C7D785710F1DFBB2736D
                                                                                                                                                                                                                                            SHA1:8F9AEC2732A252888F3873967D8CC0139FF7F4E5
                                                                                                                                                                                                                                            SHA-256:F2D03A39556491D1ACE63447B067B38055F32F5F1523C01249BA18052C599B4C
                                                                                                                                                                                                                                            SHA-512:5C2397E4DCB361A154CD3887C229BCF7EF980ACBB4B851A16294D5DF6245B2615CC4B42F6A95CF1D3C49B735C2F7025447247D887CCF4CD964F19F14E4533470
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Antivirus:
                                                                                                                                                                                                                                            • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......0...t..t..t..}...r..;...v..;...y..;...|..;...w.....w......v..t..%.....u.....u...y.u.....u..Richt..........PE..d...(..c.........." ...".P..........@V... ................................................`..........................................{..X....y.......p..........<............{......................................8b..@...........................................UPX0....................................UPX1.....P... ...D..................@....rsrc........p.......H..............@..............................................................................................................................................................................................................................................................................................................................................................3.96.UPX!.$..

                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI2802\win32api.pyd

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Roaming\empyrean\dat.txt
                                                                                                                                                                                                                                            File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):49664
                                                                                                                                                                                                                                            Entropy (8bit):7.834375167131465
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:768:lLHqNUpP9700eM3qeU4NWAXcnLim2sp94osOk7OPBBho8rzspYJP0Wgze:lLzrSeUGQLi+5sOt5Bbzs2Cze
                                                                                                                                                                                                                                            MD5:561F419A2B44158646EE13CD9AF44C60
                                                                                                                                                                                                                                            SHA1:93212788DE48E0A91E603D74F071A7C8F42FE39B
                                                                                                                                                                                                                                            SHA-256:631465DA2A1DAD0CB11CD86B14B4A0E4C7708D5B1E8D6F40AE9E794520C3AAF7
                                                                                                                                                                                                                                            SHA-512:D76AB089F6DC1BEFFD5247E81D267F826706E60604A157676E6CBC3B3447F5BCEE66A84BF35C21696C020362FADD814C3E0945942CDC5E0DFE44C0BCA169945C
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Antivirus:
                                                                                                                                                                                                                                            • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......X.uV....................N.......N.......N.......................N...................J...........................Rich............PE..d......d.........." ................@.....................................................`.........................................(.......`...........`...........................................................8...8.......................@...................UPX0....................................UPX1................................@....rsrc...............................@..............................................................................................................................................................................................................................................................................................................................................................3.96.UPX!.$..

                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI2802\win32com\shell\shell.pyd

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Roaming\empyrean\dat.txt
                                                                                                                                                                                                                                            File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):152576
                                                                                                                                                                                                                                            Entropy (8bit):7.9721137465367
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:3072:jA+IckcVeE911B9PROpB23W4Ukx0xluxTZ/7cpltdYwT7VbbDAH:k5cv91jtROLH4n0xluxIlTF
                                                                                                                                                                                                                                            MD5:63ED2B5247381E04868B2362AB6CA3F0
                                                                                                                                                                                                                                            SHA1:804963B6F433CCB298B5D0B284CDDE63B0DEC388
                                                                                                                                                                                                                                            SHA-256:353D17F47E6EB8691F5C431B2526B468B28D808CBEE83F8F0D4B5C809728325E
                                                                                                                                                                                                                                            SHA-512:8C9148C1ED8F1A6ECD51B8D1C6DC3B0B96DC6828EFC0C6B8652872D9D4FEEB5704CDCCD43FD23F71A9E995733CC3A8B352BCB4B8BB59F05F596CEBDAA5C29966
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Antivirus:
                                                                                                                                                                                                                                            • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                            Preview:MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$.......M................).....[......[......[......[...................................................O.................Rich............................PE..d...(..d.........." .....P...................................................0............`..........................................&..L...P#..t.... ..P.......xx...........'..........................................8...........................................UPX0....................................UPX1.....P.......H..................@....rsrc........ .......L..............@..............................................................................................................................................................................................................................................................................................................................3.96.UPX!.$..

                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI2802\win32crypt.pyd

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Roaming\empyrean\dat.txt
                                                                                                                                                                                                                                            File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):52736
                                                                                                                                                                                                                                            Entropy (8bit):7.733565165052535
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:1536:E9uTkXr2LgA+Q0/W25PVt9sjTQaFoJ7e3eDvfabM:YXXr2ga0BVtmFyJiuD3a
                                                                                                                                                                                                                                            MD5:B386EB9F697DE442C4D6E426D7973706
                                                                                                                                                                                                                                            SHA1:0CA2E62BCCC709092A5AC4284E4AB44339917805
                                                                                                                                                                                                                                            SHA-256:4377B52E95E1A82E77D3B0E6D19706D4C064F90EF3D05F4D05D5D8131F4EBABD
                                                                                                                                                                                                                                            SHA-512:25E91A0C1DAC2D7E7D9E2E0425B5A8AE0114B1F1D25558117864ED95F9A526435835EE58DFD50DE0C05A63519F19BFC538D09DDDE4E0B4672F8B08773B8F8F9B
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Antivirus:
                                                                                                                                                                                                                                            • Antivirus: ReversingLabs, Detection: 4%
                                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........................J.........................................`..............................................Rich............PE..d......d.........." .........0.......G....................................................`.........................................hf......hc.......`..h...................$........................................S..8...........................................UPX0....................................UPX1................................@....rsrc....0...`...$..................@..............................................................................................................................................................................................................................................................................................................................................................3.96.UPX!.$..

                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI2802\win32trace.pyd

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Roaming\empyrean\dat.txt
                                                                                                                                                                                                                                            File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):14848
                                                                                                                                                                                                                                            Entropy (8bit):7.082172460598222
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:384:46KwMJFoeBJ4qCKU7xe+16ufjIS0hnUxaVXALOI1B1r:47wMJFoenUk/uf8dWBN
                                                                                                                                                                                                                                            MD5:E37A3CD90CFCC9A7D8002EFEC8E44138
                                                                                                                                                                                                                                            SHA1:3EB7D0E10193E41215B0E5B7C94C1B660189162A
                                                                                                                                                                                                                                            SHA-256:8B03D36BB3DA3CEA74FBC1FE4749E3187B1F72839C211CE1A0256B42B4B9B8C1
                                                                                                                                                                                                                                            SHA-512:A3022230F1A89ED3C3B03B17CA12991E61C29E4AE22EACEA6D700A3B8A325DCF6C8D7CC7293D2FF11941E37C4DBE0B1B5DF1DDC006F72B4DA448170653B7DDCD
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Antivirus:
                                                                                                                                                                                                                                            • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........*U@qD.@qD.@qD.I...DqD...E.BqD...A.JqD...@.HqD...G.CqD...E.BqD...E.BqD.T.E.EqD.@qE..qD...M.AqD...D.AqD...F.AqD.Rich@qD.................PE..d......d.........." .....0..........`.....................................................`.............................................T...h...8.......h....p......................................................X...8...........................................UPX0....................................UPX1.....0..........................@....rsrc................2..............@......................................................................................................................................................................................................................................................................................................................................................3.96.UPX!.$..

                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI2802\win32ui.pyd

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Roaming\empyrean\dat.txt
                                                                                                                                                                                                                                            File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):279040
                                                                                                                                                                                                                                            Entropy (8bit):7.864533071557196
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:6144:iBjVLw7ShElYer9fB/YSYVye4ZgWJRi/tPUivxJSRYpnRlhG:iBpLwGalYU9fhYVd2gmi/tPUIWRsRlhG
                                                                                                                                                                                                                                            MD5:0EBD9CB6234A1C9D90F29E17A74A6E4C
                                                                                                                                                                                                                                            SHA1:2FB9488CACFB2625D7ED682559DAC5CAEB789F3A
                                                                                                                                                                                                                                            SHA-256:5BBA9608D364E79ED444666B8CF9E609C59D3BCC94AAB0435899E42CCCF9F566
                                                                                                                                                                                                                                            SHA-512:B7229699EAA1355A8BB533133905745C5D967020A8431824460D3D267DDDD9892B2CF1582856A048B2E4F331FA43A24408D3FA27A82098F642EB64F906C76FE6
                                                                                                                                                                                                                                            Malicious:true
                                                                                                                                                                                                                                            Antivirus:
                                                                                                                                                                                                                                            • Antivirus: ReversingLabs, Detection: 25%
                                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......aM.F%,r.%,r.%,r.,T../,r..Ys.',r..Es.',r.1Gs.+,r.wYv.-,r.wYq.!,r.wYw.3,r.%,s.-*r.wYs.",r..Y{..,r..Yr.$,r..Y..$,r..Yp.$,r.Rich%,r.........................PE..d......d.........." ................0}.......................................0............`..............................................T..<...........<8................... .. ...........................H...(...x...8...........................................UPX0....................................UPX1................................@....rsrc...............................@......................................................................................................................................................................................................................................................................................................................................3.96.UPX!.$..

                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI2802\yarl\_quoting_c.cp310-win_amd64.pyd

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Roaming\empyrean\dat.txt
                                                                                                                                                                                                                                            File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):41984
                                                                                                                                                                                                                                            Entropy (8bit):7.860945320611378
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:768:tzY7iGEvYJSIlYZEVifuxMiC863eHarUVbQc3Vxun838MrkOC4:m7TEvYRyZ0ifXZ8WeLVbQ4MMrDH
                                                                                                                                                                                                                                            MD5:10834C99A1000E83B5846B7B426481C0
                                                                                                                                                                                                                                            SHA1:231E46B8B5582C36E201C195E93D4AE00DFB7541
                                                                                                                                                                                                                                            SHA-256:617E9C9889E9510FA0CDB00CA20E959850CC4BF231AC440ED8E11E3962A04653
                                                                                                                                                                                                                                            SHA-512:8E9BF6A4C6F5DAD727AD1C172E7DFEA4F2A23184F0D85BFDFF4E4A8939996DC370EFCDDBDEB5E26757E5DBA6BB9766EEB723B789CC86A89C054B964734CAB0B5
                                                                                                                                                                                                                                            Malicious:true
                                                                                                                                                                                                                                            Antivirus:
                                                                                                                                                                                                                                            • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......b..]&..&..&../..."..6K..$..m...$..6K..%..6K.....6K..*....%..&.....mJ..'..mJ..'..mJj.'..mJ..'..Rich&..........PE..d..."."g.........." ...).........`..@....p................................... ............`.............................................d...........................................................................8...@...........................................UPX0.....`..............................UPX1.........p......................@....rsrc...............................@..............................................................................................................................................................................................................................................................................................................................................................3.96.UPX!.$..

                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI45442\Crypto\Cipher\_ARC4.pyd

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Roaming\empyrean\dat.txt
                                                                                                                                                                                                                                            File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):9728
                                                                                                                                                                                                                                            Entropy (8bit):6.791071822964766
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:192:d519kKsPOR3drvDtDvIqEk7KzmYMJHFKHkyUxaVXFaLuH2:d57kKsWR3RvDtDvIqFmdwQHnUxaVXALX
                                                                                                                                                                                                                                            MD5:D9F2264898AAAA9EF6152A1414883D0F
                                                                                                                                                                                                                                            SHA1:E0661549D6BF59FFDA98FCCC00756F44CAF02228
                                                                                                                                                                                                                                            SHA-256:836CBA3B83B00427430FE6E1C4E45790616BC85C57DBD6E6D5B6930A9745B715
                                                                                                                                                                                                                                            SHA-512:BA033BAF7C3B93BBF8FCE4F24BC37930D6CE419EE3F517D2BC9702417E821F5FDA5FB9334A08B37FED55B3B9535CD194A3B79DD70653D1F8C4C0DD906EBF1B04
                                                                                                                                                                                                                                            Malicious:true
                                                                                                                                                                                                                                            Antivirus:
                                                                                                                                                                                                                                            • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........&...H...H...H......H..I...H..I...H...I...H..M...H..L...H..K...H...@...H...H...H.......H...J...H.Rich..H.........................PE..d...ba.c.........." ...". .......p........................................................`.........................................L..........\............@........................................................@...........................................UPX0.....p..............................UPX1..... ..........................@....rsrc................"..............@......................................................................................................................................................................................................................................................................................................................................................3.96.UPX!.$..

                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI45442\Crypto\Cipher\_Salsa20.pyd

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Roaming\empyrean\dat.txt
                                                                                                                                                                                                                                            File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):10752
                                                                                                                                                                                                                                            Entropy (8bit):7.0813376258556
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:192:HPt6CkaiGEmxFlCFNbJqCBSkyUxaVXFaLon/F+:F6Ch3EmDlwbJqKSnUxaVXAL8k
                                                                                                                                                                                                                                            MD5:E3AE69E44C4C82D83082BBB8C25AA8DD
                                                                                                                                                                                                                                            SHA1:116D3B46E8DAA2AEFB2D58BE4B00BD3BFC09833F
                                                                                                                                                                                                                                            SHA-256:4229235814BBEE62311E3623C07898B03D3B22281CD4E5F1A87B86450B1B740F
                                                                                                                                                                                                                                            SHA-512:8A49128A79A9F9DE27AFE150402BD8DB224F8BAE6237D6C2D29C1F543E5A929E2FD15060BFD37B49B1C4A3190A70659AA041D36BDE09674A77171DC27415B2D4
                                                                                                                                                                                                                                            Malicious:true
                                                                                                                                                                                                                                            Antivirus:
                                                                                                                                                                                                                                            • Antivirus: ReversingLabs, Detection: 4%
                                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........EY.o+..o+..o+......o+...*..o+...*..o+..o*..o+......o+.../..o+...(..o+...#..o+...+..o+......o+...)..o+.Rich.o+.................PE..d...ca.c.........." ...".0.......p........................................................`.........................................L..........\............P..L.......................................................@...........................................UPX0.....p..............................UPX1.....0......."..................@....rsrc................&..............@..............................................................................................................................................................................................................................................................................................................................................................3.96.UPX!.$..

                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI45442\Crypto\Cipher\_chacha20.pyd

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Roaming\empyrean\dat.txt
                                                                                                                                                                                                                                            File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):10752
                                                                                                                                                                                                                                            Entropy (8bit):7.046269212433107
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:192:H7T6CkaiXcecnjMe0FXrdMIkCtOkyUxaVXFaL2nPVdX9lk:P6ChEcGeVWOnUxaVXALG/X9
                                                                                                                                                                                                                                            MD5:ED1BBDC7CC945DA2D1F5A914987EB885
                                                                                                                                                                                                                                            SHA1:C71F0A316E41C8AE5D21BE2E3A894E482D52774C
                                                                                                                                                                                                                                            SHA-256:1EECE2F714DC1F520D0608F9F71E692F5B269930603F8AFC330118EA38F16005
                                                                                                                                                                                                                                            SHA-512:1C26A0A0B223FD864BD01BCA8DE012DC385D116BE933C2479F25113983723DBBC2CEC147947F62C617BB7CCAD242518FECB653F008090BEEC0DEEEB5A1DFEAD4
                                                                                                                                                                                                                                            Malicious:true
                                                                                                                                                                                                                                            Antivirus:
                                                                                                                                                                                                                                            • Antivirus: ReversingLabs, Detection: 4%
                                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........EY.o+..o+..o+......o+...*..o+...*..o+..o*..o+......o+.../..o+...(..o+...#..o+...+..o+......o+...)..o+.Rich.o+.................PE..d...ca.c.........." ...".0.......p..p.....................................................`.........................................L..........\............P..d...................................................h...@...........................................UPX0.....p..............................UPX1.....0......."..................@....rsrc................&..............@..............................................................................................................................................................................................................................................................................................................................................................3.96.UPX!.$..

                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI45442\Crypto\Cipher\_pkcs1_decode.pyd

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Roaming\empyrean\dat.txt
                                                                                                                                                                                                                                            File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):10240
                                                                                                                                                                                                                                            Entropy (8bit):6.978550721417444
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:192:611+odumclYAItbK07UmzqMtJ9CE1r28kyUxaVXFaLf3BD:TH5Yy073zqU99DnUxaVXAL5
                                                                                                                                                                                                                                            MD5:3EFFD59CD95B6706C1F2DD661AA943FC
                                                                                                                                                                                                                                            SHA1:6D3C1B8899E38B31E7BE2670D87050921023C7F1
                                                                                                                                                                                                                                            SHA-256:4C29950A9EDEDBBC24A813F8178723F049A529605EF6D35F16C7955768AACE9E
                                                                                                                                                                                                                                            SHA-512:D6AF4A719694547DAE5E37C833DEF291CE3EAEA3703FAA360C6ADCC6B64BA36442E0D2783D44450E0F582BC6FA07F3496919FD6C70F88DD0FC29688956939412
                                                                                                                                                                                                                                            Malicious:true
                                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.............h...h...h......h..i...h..i...h...i...h..m...h..l...h..k...h...`...h...h...h.......h...j...h.Rich..h.........PE..d...aa.c.........." ...". .......p........................................................`.........................................L...p......\............P..........................................................@...........................................UPX0.....p..............................UPX1..... ....... ..................@....rsrc................$..............@......................................................................................................................................................................................................................................................................................................................................................................3.96.UPX!.$..

                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI45442\Crypto\Cipher\_raw_aes.pyd

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Roaming\empyrean\dat.txt
                                                                                                                                                                                                                                            File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):17920
                                                                                                                                                                                                                                            Entropy (8bit):7.483226756510774
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:384:NT0mEndi296LQpjT621uQ7nUxaVXALwcn:NQhvrpf6wuEvc
                                                                                                                                                                                                                                            MD5:671100B821EB357CEB5A4C5FF86BC31A
                                                                                                                                                                                                                                            SHA1:0604A7686029BECEBBEF102C14031CCF489854E9
                                                                                                                                                                                                                                            SHA-256:803E46354CDAB4AF6FF289E98DE9C56B5B08E3E9AD5F235D5A282005FA9F2D50
                                                                                                                                                                                                                                            SHA-512:2D916A41993EA1A5A0E72F0665A6D8C384C1541EE95A582EF5FBC59BE835720915046C7106ED2F9A1074EC0CDDFA7124E8079B2F837A442599C59479477960AF
                                                                                                                                                                                                                                            Malicious:true
                                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........&...H...H...H......H..I...H..I...H...I...H..M...H..L...H..K...H...@...H...H...H.......H...J...H.Rich..H.........................PE..d...^a.c.........." ...".@................................................... ............`.........................................L...........\.......................................................................@...........................................UPX0....................................UPX1.....@.......>..................@....rsrc................B..............@......................................................................................................................................................................................................................................................................................................................................................3.96.UPX!.$..

                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI45442\Crypto\Cipher\_raw_aesni.pyd

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Roaming\empyrean\dat.txt
                                                                                                                                                                                                                                            File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):11264
                                                                                                                                                                                                                                            Entropy (8bit):7.042646572293955
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:192:CZ1jziP8+lCPPQFUF/ylol0uBpDIkyUxaVXFaLmEnlA:kzulCPqUFCo5BpDInUxaVXALX
                                                                                                                                                                                                                                            MD5:DCD2F68680E2FB83E9FEFA18C7B4B3E0
                                                                                                                                                                                                                                            SHA1:8EC62148F1649477273607CDAA0DCE2331799741
                                                                                                                                                                                                                                            SHA-256:D63F63985356B7D2E0E61E7968720FB72DC6B57D73BED4F337E372918078F946
                                                                                                                                                                                                                                            SHA-512:BF311F048001C199F49B12B3B0893D132A139DD4B16D06ADB26DD9108F686B50C6FEDA2A73A59324473DB6EE9063FF13C72047A97E2FCB561C8F841EE3A8360C
                                                                                                                                                                                                                                            Malicious:true
                                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........eX.o...o...o.......o.......o.......o...o...o.......o.......o.......o.......o.......o.......o.......o..Rich.o..........................PE..d...^a.c.........." ...".0.......p.. .....................................................`.........................................L..........\............P.........................................................@...........................................UPX0.....p..............................UPX1.....0.......$..................@....rsrc................(..............@......................................................................................................................................................................................................................................................................................................................................................3.96.UPX!.$..

                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI45442\Crypto\Cipher\_raw_arc2.pyd

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Roaming\empyrean\dat.txt
                                                                                                                                                                                                                                            File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):12800
                                                                                                                                                                                                                                            Entropy (8bit):7.101710831645112
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:192:H68U1i2QelKEyhXjReC6SCeiJpHzoh7JfwoskyUxaVXFaLQHC:a8U8Dz1ESlinHzo5KosnUxaVXALV
                                                                                                                                                                                                                                            MD5:3F5FD606893B3DE6116D4A185E713CA3
                                                                                                                                                                                                                                            SHA1:5B0ABEB17AE2B3D59215FFFAE6688921B2A04EDA
                                                                                                                                                                                                                                            SHA-256:0898CDE5FCCFA86E2423CDF627A3745B1F59BB30DFEF0DD9423926D4167F9F82
                                                                                                                                                                                                                                            SHA-512:11580C06601D27755DF9D17DDFA8998E4E8E4FDEC55ECD1289963095BD752A69307B09606B06E5012CC73620D1B6D6CD41563C27A8218653DE7473F6E4BE1B2B
                                                                                                                                                                                                                                            Malicious:true
                                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........EY.o+..o+..o+......o+...*..o+...*..o+..o*..o+......o+.../..o+...(..o+...#..o+...+..o+......o+...)..o+.Rich.o+.................PE..d..._a.c.........." ...".0..........@.....................................................`.........................................L...........\............`......................................................8...@...........................................UPX0....................................UPX1.....0.......*..................@....rsrc...............................@..............................................................................................................................................................................................................................................................................................................................................................3.96.UPX!.$..

                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI45442\Crypto\Cipher\_raw_blowfish.pyd

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Roaming\empyrean\dat.txt
                                                                                                                                                                                                                                            File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):15360
                                                                                                                                                                                                                                            Entropy (8bit):7.390629788507205
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:384:gmM80nfSoKJZi3o0DYjHeja46nUxaVXALsD:gmMTf8Z4oiYj++T
                                                                                                                                                                                                                                            MD5:418CEC0CC45B20EE8165E86CAC35963C
                                                                                                                                                                                                                                            SHA1:51B8EE4C8663BE14E1EE5FA288F676ED180DA738
                                                                                                                                                                                                                                            SHA-256:694BF801227B26DADAF9DDFF373647AB551D7A0B9CFF6DE1B42747F04EFC510E
                                                                                                                                                                                                                                            SHA-512:7986BD0BB851DC87D983EAAEB438C6F6D406FE89526AF79CFCEE0F534177EFA70AA3175D3BC730745C5F344931132C235659E1CC7164C014520477633488A158
                                                                                                                                                                                                                                            Malicious:true
                                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........EY.o+..o+..o+......o+...*..o+...*..o+..o*..o+......o+.../..o+...(..o+...#..o+...+..o+......o+...)..o+.Rich.o+.................PE..d..._a.c.........." ...".@..........0.....................................................`.........................................L...........\............p......................................................(...@...........................................UPX0....................................UPX1.....@.......4..................@....rsrc................8..............@..............................................................................................................................................................................................................................................................................................................................................................3.96.UPX!.$..

                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI45442\Crypto\Cipher\_raw_cast.pyd

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Roaming\empyrean\dat.txt
                                                                                                                                                                                                                                            File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):20480
                                                                                                                                                                                                                                            Entropy (8bit):7.586579116038327
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:384:4VVgiBGs0qMuLjc5XzQk+JktIzZWFjoyXfHG1L4lcX22CnUxaVXALbUu:4VCicsfFL45KJk44NoyX/CucX8OUu
                                                                                                                                                                                                                                            MD5:243E336DEC71A28E7F61548A2425A2E1
                                                                                                                                                                                                                                            SHA1:66DCA0B999E704E9FB29861D3C5BCD065E2CB2C0
                                                                                                                                                                                                                                            SHA-256:BF53063304119CF151F22809356B5B4E44799131BBAB5319736D0321F3012238
                                                                                                                                                                                                                                            SHA-512:D0081025822FF86E7FC3E4442926988F95F91BFF3627C1952CE6B1AAEF69F8B3E42D5D3A9DD941C1A1526D6558CA6E3DAEF5AFCFB0431EEBC9B9920C7CA89101
                                                                                                                                                                                                                                            Malicious:true
                                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........EY.o+..o+..o+......o+...*..o+...*..o+..o*..o+......o+.../..o+...(..o+...#..o+...+..o+......o+...)..o+.Rich.o+.................PE..d...`a.c.........." ...".P................................................................`.........................................L...........\.......................................................................@...........................................UPX0....................................UPX1.....P.......H..................@....rsrc................L..............@..............................................................................................................................................................................................................................................................................................................................................................3.96.UPX!.$..

                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI45442\Crypto\Cipher\_raw_cbc.pyd

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Roaming\empyrean\dat.txt
                                                                                                                                                                                                                                            File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):10240
                                                                                                                                                                                                                                            Entropy (8bit):6.815145028259091
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:192:HG6CkaitEsE8Vm7wvukyUxaVXFaLy300:m6ChIV9unUxaVXALV
                                                                                                                                                                                                                                            MD5:FE44F698198190DE574DC193A0E1B967
                                                                                                                                                                                                                                            SHA1:5BAD88C7CC50E61487EC47734877B31F201C5668
                                                                                                                                                                                                                                            SHA-256:32FA416A29802EB0017A2C7360BF942EDB132D4671168DE26BD4C3E94D8DE919
                                                                                                                                                                                                                                            SHA-512:C841885DD7696F337635EF759E3F61EE7F4286B622A9FB8B695988D93219089E997B944321CA49CA3BD19D41440EE7C8E1D735BD3558052F67F762BF4D1F5FC3
                                                                                                                                                                                                                                            Malicious:true
                                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........EY.o+..o+..o+......o+...*..o+...*..o+..o*..o+......o+.../..o+...(..o+...#..o+...+..o+......o+...)..o+.Rich.o+.................PE..d...aa.c.........." ...". .......p..p.....................................................`.........................................L..........\............P..X...................................................h...@...........................................UPX0.....p..............................UPX1..... ....... ..................@....rsrc................$..............@..............................................................................................................................................................................................................................................................................................................................................................3.96.UPX!.$..

                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI45442\Crypto\Cipher\_raw_cfb.pyd

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Roaming\empyrean\dat.txt
                                                                                                                                                                                                                                            File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):10752
                                                                                                                                                                                                                                            Entropy (8bit):6.934741919099467
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:192:CaqmTnQIPnsvQPc6SltPZHloUYU9dOxLKFaEWakyUxaVXFaL2nC2:1DnQxvQPpSlNoUopKjWanUxaVXALj
                                                                                                                                                                                                                                            MD5:FF64FD41B794E0EF76A9EEAE1835863C
                                                                                                                                                                                                                                            SHA1:BF14E9D12B8187CA4CC9528D7331F126C3F5CA1E
                                                                                                                                                                                                                                            SHA-256:5D2D1A5F79B44F36AC87D9C6D886404D9BE35D1667C4B2EB8AAB59FB77BF8BAC
                                                                                                                                                                                                                                            SHA-512:03673F94525B63644A7DA45C652267077753F29888FB8966DA5B2B560578F961FDC67696B69A49D9577A8033FFCC7B4A6B98C051B4F53380227C392761562734
                                                                                                                                                                                                                                            Malicious:true
                                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......................;..................................................................W.............Rich............................PE..d...aa.c.........." ...".0.......p........................................................`.........................................L..........\............P..d.......................................................@...........................................UPX0.....p..............................UPX1.....0......."..................@....rsrc................&..............@......................................................................................................................................................................................................................................................................................................................................................3.96.UPX!.$..

                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI45442\Crypto\Cipher\_raw_ctr.pyd

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Roaming\empyrean\dat.txt
                                                                                                                                                                                                                                            File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):11264
                                                                                                                                                                                                                                            Entropy (8bit):6.939657038298525
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:192:Tkje/clVEmNVPjkTnA614twLFhS3YO7C6W1wQykyUxaVXFaL6nvYF:8L1Bjul19GjW1wBnUxaVXALx
                                                                                                                                                                                                                                            MD5:D67F83D1482D9600AC012868FB49D16E
                                                                                                                                                                                                                                            SHA1:55C34243CDD930D76155EDF2D723FAA60A3A6865
                                                                                                                                                                                                                                            SHA-256:AA463CD4D0B4BBD4159650D66C11A699B23775BF92455FB58A2206B932A65FEC
                                                                                                                                                                                                                                            SHA-512:94E9599723BF697EAEEB0401EF80A75E46208C1984DF63A315A3CDE1A7C97DB070353ACB0712CEC887C04CAD9755A2E4E357A10B2D40F23F0B44EE277D4F4BDB
                                                                                                                                                                                                                                            Malicious:true
                                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........F...(...(...(......(..)...(..)...(...)...(..-...(..,...(..+...(... ...(...(...(.......(...*...(.Rich..(.........PE..d...ba.c.........." ...".0.......p..@.....................................................`.........................................L..........\............P......................................................8...@...........................................UPX0.....p..............................UPX1.....0.......$..................@....rsrc................(..............@......................................................................................................................................................................................................................................................................................................................................................................3.96.UPX!.$..

                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI45442\Crypto\Cipher\_raw_des.pyd

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Roaming\empyrean\dat.txt
                                                                                                                                                                                                                                            File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):17408
                                                                                                                                                                                                                                            Entropy (8bit):7.508920120657843
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:384:/roOiYb00oHet1Y8z+r99tbr4FntSKVjoqDB+7XnUxaVXALP:/rpiDHm16B9RQSKCnrc
                                                                                                                                                                                                                                            MD5:B0EEF5CEAE8BA5E2A04C17B2B6AE87B5
                                                                                                                                                                                                                                            SHA1:6EA2736EE6F6955F0DBBD3A3ACC78CDD9121E468
                                                                                                                                                                                                                                            SHA-256:C9BBA124BE36ADA4549276D984BB3812EE2207C7DBF646EC6DF9A968E83205FB
                                                                                                                                                                                                                                            SHA-512:CE270FD23C2761D066D513B493C08A939CA29D94566EE39D0118BACB1619B5D860EBCFDCAE01F9A0B556DA95AFA8D34CF4E2234E302DE2408FFFA1972F643DEF
                                                                                                                                                                                                                                            Malicious:true
                                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........3.ANRg.NRg.NRg.G*..JRg...f.LRg..*f.MRg.NRf.hRg...b.BRg...c.FRg...d.JRg...o.ORg...g.ORg.....ORg...e.ORg.RichNRg.........PE..d...`a.c.........." ...".@..........`N... ...................................p............`.........................................Lb.......`..\....`..........l............b......................................XZ..@...........................................UPX0....................................UPX1.....@... ...<..................@....rsrc........`.......@..............@......................................................................................................................................................................................................................................................................................................................................................................3.96.UPX!.$..

                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI45442\Crypto\Cipher\_raw_des3.pyd

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Roaming\empyrean\dat.txt
                                                                                                                                                                                                                                            File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):17408
                                                                                                                                                                                                                                            Entropy (8bit):7.495463921230312
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:384:eroO1wQv0BMJr0DW6EeBrSBnUxaVXAL8:erp1w3eF0DxzrMX
                                                                                                                                                                                                                                            MD5:D892F9D789C22787D846E405D0240987
                                                                                                                                                                                                                                            SHA1:F3B728D04904E5FD3465C7665F7FDE2318E623C3
                                                                                                                                                                                                                                            SHA-256:100CD322EA2F8E3997432D6E292373F3A07F75818C7802D7386E9810BEE619B0
                                                                                                                                                                                                                                            SHA-512:00FFAC3215FFA3DFAB82A32B569BC632E704B134AF4E3418DFBC91CCE9FA09D7E10B471B24183DFA1AEFA292B345BDDC030547FCCE1162F6AC5E464DFA7CF0E9
                                                                                                                                                                                                                                            Malicious:true
                                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........3.ANRg.NRg.NRg.G*..JRg...f.LRg..*f.MRg.NRf.hRg...b.BRg...c.FRg...d.JRg...o.ORg...g.ORg.....ORg...e.ORg.RichNRg.........PE..d...`a.c.........." ...".@..........0N... ...................................p............`.........................................Lb.......`..\....`.......................b......................................(Z..@...........................................UPX0....................................UPX1.....@... ...<..................@....rsrc........`.......@..............@......................................................................................................................................................................................................................................................................................................................................................................3.96.UPX!.$..

                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI45442\Crypto\Cipher\_raw_ecb.pyd

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Roaming\empyrean\dat.txt
                                                                                                                                                                                                                                            File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):9216
                                                                                                                                                                                                                                            Entropy (8bit):6.822560284810641
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:192:h51aJh9fUQeV9tUhHQBYwkyUxaVXFaLuHB:h5k9s9tSHkYwnUxaVXALk
                                                                                                                                                                                                                                            MD5:F94726F6B584647142EA6D5818B0349D
                                                                                                                                                                                                                                            SHA1:4AA9931C0FF214BF520C5E82D8E73CEEB08AF27C
                                                                                                                                                                                                                                            SHA-256:B98297FD093E8AF7FCA2628C23A9916E767540C3C6FA8894394B5B97FFEC3174
                                                                                                                                                                                                                                            SHA-512:2B40A9B39F5D09EB8D7DDAD849C8A08AB2E73574EE0D5DB132FE8C8C3772E60298E0545516C9C26EE0B257EBDA59CFE1F56EF6C4357EF5BE9017C4DB4770D238
                                                                                                                                                                                                                                            Malicious:true
                                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......&6).bWG.bWG.bWG.k/..`WG.-+F.`WG.)/F.aWG.bWF.AWG.-+B.iWG.-+C.jWG.-+D.aWG.+O.cWG.+G.cWG.+..cWG.+E.cWG.RichbWG.........................PE..d...aa.c.........." ...". .......p........................................................`.................................................................@..........................................................@...........................................UPX0.....p..............................UPX1..... ..........................@....rsrc................ ..............@......................................................................................................................................................................................................................................................................................................................................................3.96.UPX!.$..

                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI45442\Crypto\Cipher\_raw_eksblowfish.pyd

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Roaming\empyrean\dat.txt
                                                                                                                                                                                                                                            File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):15872
                                                                                                                                                                                                                                            Entropy (8bit):7.411957303167114
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:384:emM80n0sH6HhpbHIQ5TsgOnLC9DS4pf12SnUxaVXALbOd:emMT0tzIQ5AgYmS4pf1DJ
                                                                                                                                                                                                                                            MD5:E5021B9925A53B20946C93B5BF686647
                                                                                                                                                                                                                                            SHA1:DEEA7DA72EE7D2511E68B9F3D28B20B3A4AD6676
                                                                                                                                                                                                                                            SHA-256:87922D0EE99AF46080AFD4BAA2F96219FA195731C0745FCB9C7789338ECC778F
                                                                                                                                                                                                                                            SHA-512:E8A6B382C17138D9B33AE6ED8C1DFE93166E304A987BF326D129AE31948F91429F73EBD204C772C9679B35AFEA0A8E9DF613BCEC7F46C6E1448B226EB2C2A507
                                                                                                                                                                                                                                            Malicious:true
                                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........EY.o+..o+..o+......o+...*..o+...*..o+..o*..o+......o+.../..o+...(..o+...#..o+...+..o+......o+...)..o+.Rich.o+.................PE..d..._a.c.........." ...".@................................................................`.........................................L...........\............p..........................................................@...........................................UPX0....................................UPX1.....@.......6..................@....rsrc................:..............@..............................................................................................................................................................................................................................................................................................................................................................3.96.UPX!.$..

                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI45442\Crypto\Cipher\_raw_ocb.pyd

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Roaming\empyrean\dat.txt
                                                                                                                                                                                                                                            File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):11776
                                                                                                                                                                                                                                            Entropy (8bit):7.033792220569869
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:192:Cm3adl/1JXscT11V9X8IdxqX+74RB6qT/lr5kyUxaVXFaLmHB:C6IXn11V9RrHkz6a5nUxaVXALs
                                                                                                                                                                                                                                            MD5:A76AEB47A31FD7F652C067AC1EA6D227
                                                                                                                                                                                                                                            SHA1:FF2D8E14E8A99F5C78C960C2AFD5BE2F9ED627AB
                                                                                                                                                                                                                                            SHA-256:C816F4A89CE6126DA70CB44062294A6A4AC0F73EC3A73EAD9269425B7B82288A
                                                                                                                                                                                                                                            SHA-512:C7CEC6A125904FCB42A6933520F88A6A1AA43FED9ECD40E20DDDDA9AC2DAC37E4D1D79951FF947A10AFB7C067C441DDF7DE9AF4E4BD56D73C1284962C085C1E9
                                                                                                                                                                                                                                            Malicious:true
                                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........%Y.oK..oK..oK......oK...J..oK...J..oK..oJ..oK...N..oK...O..oK...H..oK...C..oK...K..oK......oK...I..oK.Rich.oK.........................PE..d...ba.c.........." ...".0..........`.....................................................`.........................................L...........\............`..............H.......................................X...@...........................................UPX0....................................UPX1.....0.......&..................@....rsrc................*..............@......................................................................................................................................................................................................................................................................................................................................................3.96.UPX!.$..

                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI45442\Crypto\Cipher\_raw_ofb.pyd

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Roaming\empyrean\dat.txt
                                                                                                                                                                                                                                            File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):10240
                                                                                                                                                                                                                                            Entropy (8bit):6.750046576159352
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:192:HQE6Ckai65ePzhVTL8Q5xh9XkyUxaVXFaLy3MJ:Z6ChJstpDxh9XnUxaVXALl
                                                                                                                                                                                                                                            MD5:EEA83B9021675C8CA837DFE78B5A3A58
                                                                                                                                                                                                                                            SHA1:3660833FF743781E451342BB623FA59229AE614D
                                                                                                                                                                                                                                            SHA-256:45A4E35231E504B0D50A5FD5968AB6960CB27D197F86689477701D79D8B95B3B
                                                                                                                                                                                                                                            SHA-512:FCDCCEA603737364DBDBBCD5763FD85AEB0C175E6790128C93360AF43E2587D0FD173BEE4843C681F43FB63D57FCAEF1A58BE683625C905416E0C58AF5BF1D6C
                                                                                                                                                                                                                                            Malicious:true
                                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........EY.o+..o+..o+......o+...*..o+...*..o+..o*..o+......o+.../..o+...(..o+...#..o+...+..o+......o+...)..o+.Rich.o+.................PE..d...ba.c.........." ...". .......p........................................................`.........................................L..........\............P..X.......................................................@...........................................UPX0.....p..............................UPX1..... ....... ..................@....rsrc................$..............@..............................................................................................................................................................................................................................................................................................................................................................3.96.UPX!.$..

                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI45442\Crypto\Hash\_BLAKE2b.pyd

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Roaming\empyrean\dat.txt
                                                                                                                                                                                                                                            File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):11776
                                                                                                                                                                                                                                            Entropy (8bit):6.977802787830596
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:192:Hlqi6CkaiGp4OUdGyXOidiPFiV2ekyUxaVXFaL6n2fOG:FP6ChtCOesPDenUxaVXALDG
                                                                                                                                                                                                                                            MD5:1BF5CD751AED60DD92D0AB3CE6D773FA
                                                                                                                                                                                                                                            SHA1:897A5F74BBAC0B1BD7CB2DD598AA9B3B7BED326D
                                                                                                                                                                                                                                            SHA-256:CDA73AF34E4F542646952BBCB71559CCBDF3695AA74ED41D37A4A7D1F932A42D
                                                                                                                                                                                                                                            SHA-512:81113CFCEF2F434E9AC39B4B9CF08E67F1D84EAAA5A3CFFC5D088410E6E6480057DA1915AA22A8E01BE69418247C29D921D481D0577B810D99AC815D82D9F37E
                                                                                                                                                                                                                                            Malicious:true
                                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........EY.o+..o+..o+......o+...*..o+...*..o+..o*..o+......o+.../..o+...(..o+...#..o+...+..o+......o+...)..o+.Rich.o+.................PE..d...]a.c.........." ...".0.......p........................................................`.........................................L..........\............P..@.......................................................@...........................................UPX0.....p..............................UPX1.....0.......&..................@....rsrc................*..............@..............................................................................................................................................................................................................................................................................................................................................................3.96.UPX!.$..

                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI45442\Crypto\Hash\_BLAKE2s.pyd

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Roaming\empyrean\dat.txt
                                                                                                                                                                                                                                            File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):11264
                                                                                                                                                                                                                                            Entropy (8bit):7.1469700456721625
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:192:HbH1U5KE2S8oKi7hn8QEcJtFnlZlmJ6pcfUcqEQbxwl22wUF2MXkyUxaVXFaLtnj:iK1S8oh7h8BcJ5ZlmYcfUcqEQb2lzFNW
                                                                                                                                                                                                                                            MD5:821670341B5465047733CC460856A2F5
                                                                                                                                                                                                                                            SHA1:E0A1BBC859A1F502BA086DDD8BCED82AB6843399
                                                                                                                                                                                                                                            SHA-256:84780C05C9AD7B1E554211CD31BBCB02CBE587E4F08BD2D0B9561D104C4D125C
                                                                                                                                                                                                                                            SHA-512:5F617695EA9A5312DBBD13E379E124A96692CC228B0BC366B93CDCDAF3E23375602D9E81CF5A4286A5CEDEAAE635F11120C2C2390876BF3FD7398C59044BE82F
                                                                                                                                                                                                                                            Malicious:true
                                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........EY.o+..o+..o+......o+...*..o+...*..o+..o*..o+......o+.../..o+...(..o+...#..o+...+..o+......o+...)..o+.Rich.o+.................PE..d...]a.c.........." ...".0.......p........................................................`.........................................L..........\............P..@.......................................................@...........................................UPX0.....p..............................UPX1.....0.......$..................@....rsrc................(..............@..............................................................................................................................................................................................................................................................................................................................................................3.96.UPX!.$..

                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI45442\Crypto\Hash\_MD2.pyd

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Roaming\empyrean\dat.txt
                                                                                                                                                                                                                                            File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):10752
                                                                                                                                                                                                                                            Entropy (8bit):6.941977635771166
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:192:CR911+odumclYlXkeQ67WsVa6b0/XovtI2uLHkyUxaVXFaLtniW2B:COH5YmexVrblvl4HnUxaVXALg7B
                                                                                                                                                                                                                                            MD5:11A097C3DFDCFBB2ACB2EE0C92A9CB10
                                                                                                                                                                                                                                            SHA1:D15EF7DF71C8549B9B956DAC89E2542D1452ED08
                                                                                                                                                                                                                                            SHA-256:DAE038EB9D1CCDE31F9889818DB281AE70588FF5AB94A2AB7F33F8A1708F7325
                                                                                                                                                                                                                                            SHA-512:29149388B53FD85F7E77A0AE0ACFD172D73CC1443195A98B7392C494998998017EF11E16FAABBA479996FA2424D4C3CED2251FB5D8852A76FB2341F08AD08C01
                                                                                                                                                                                                                                            Malicious:true
                                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........%Y.oK..oK..oK......oK...J..oK...J..oK..oJ..oK...N..oK...O..oK...H..oK...C..oK...K..oK......oK...I..oK.Rich.oK.........................PE..d...Va.c.........." ...".0.......p........................................................`.........................................L..........\............P..(......................................................@...........................................UPX0.....p..............................UPX1.....0......."..................@....rsrc................&..............@......................................................................................................................................................................................................................................................................................................................................................3.96.UPX!.$..

                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI45442\Crypto\Hash\_MD4.pyd

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Roaming\empyrean\dat.txt
                                                                                                                                                                                                                                            File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):10752
                                                                                                                                                                                                                                            Entropy (8bit):7.05097021372971
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:192:CgwgkM1OqY2hQbIGcKqV31LGT63hjvYx4kyUxaVXFaLonXlFw:Cxw/hwI2q11LnO4nUxaVXALkXw
                                                                                                                                                                                                                                            MD5:D32A2064E2DA99B370F277026BB54747
                                                                                                                                                                                                                                            SHA1:1F12598490871A86B6E2B46527DD3F10B30B183D
                                                                                                                                                                                                                                            SHA-256:959EA4BB2F433F79CBC4AFD7E77CD256E3E67416E9E6AA0E3646BCAF686E40CD
                                                                                                                                                                                                                                            SHA-512:0A2ECE5075FF9212863D80AEFFAB356B314EED3CC806C599C7665F62C30CD726CE8EC00922DFDC2E8F5AE3E2A9D9B9F7B4BD1677A02623034332DFD0413D3E02
                                                                                                                                                                                                                                            Malicious:true
                                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........%Y.oK..oK..oK......oK...J..oK...J..oK..oJ..oK...N..oK...O..oK...H..oK...C..oK...K..oK......oK...I..oK.Rich.oK.........................PE..d...Va.c.........." ...".0.......p........................................................`.........................................L..........\............P..(.......................................................@...........................................UPX0.....p..............................UPX1.....0......."..................@....rsrc................&..............@......................................................................................................................................................................................................................................................................................................................................................3.96.UPX!.$..

                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI45442\Crypto\Hash\_MD5.pyd

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Roaming\empyrean\dat.txt
                                                                                                                                                                                                                                            File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):12288
                                                                                                                                                                                                                                            Entropy (8bit):7.136950075672147
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:192:C1sG1qextX4NJ9Lx8ZTZUaiQgp0AdXeST53lHA3WUkyUxaVXFaLHnU8:C2kX4NJOTmQg1dXeS1NAGUnUxaVXAL0
                                                                                                                                                                                                                                            MD5:EE11CB538BDAB49AA3499C394060F5CE
                                                                                                                                                                                                                                            SHA1:43B018D561A3201D3AA96951B8A1380D4AEB92B1
                                                                                                                                                                                                                                            SHA-256:23DDA5CE329198FE9471C7DCA31AF69144AB7A350D3E6F11D60E294C7996B1CA
                                                                                                                                                                                                                                            SHA-512:AFBDB4692AC186F62AE3B53803F8A7357E32EB40732D095A7086566B94592C3E056B48C6CA6C62742B8DE14C7F309496F83B664C42D55E679AFA60B4F1468832
                                                                                                                                                                                                                                            Malicious:true
                                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........%Y.oK..oK..oK......oK...J..oK...J..oK..oJ..oK...N..oK...O..oK...H..oK...C..oK...K..oK......oK...I..oK.Rich.oK.........................PE..d...Wa.c.........." ...".0.......p.......................................................`.........................................L..........\............P..X......................................................@...........................................UPX0.....p..............................UPX1.....0.......(..................@....rsrc................,..............@......................................................................................................................................................................................................................................................................................................................................................3.96.UPX!.$..

                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI45442\Crypto\Hash\_RIPEMD160.pyd

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Roaming\empyrean\dat.txt
                                                                                                                                                                                                                                            File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):11264
                                                                                                                                                                                                                                            Entropy (8bit):6.909373515854209
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:192:Hsi6CkaTs6Ac86kwsvQrehMrP+bekyUxaVXFaL2nPV7:p6ChT1AjzQa6P+benUxaVXALGp
                                                                                                                                                                                                                                            MD5:19CA6E706818CF08F91EBB82BF9911E9
                                                                                                                                                                                                                                            SHA1:AB53841686BD55FC58A7262A79568A714A6D870B
                                                                                                                                                                                                                                            SHA-256:11933E4F74368B334C1D2118D4E975533185517264CA45F3382274DD27540DEB
                                                                                                                                                                                                                                            SHA-512:658908AA5487DC398B58E9EA704E83A63146C7D87126FA275296263C981AF48D08AB3D20D541401EB0A22489AD23991E32E6238BCAF46DAFFFA971EC769FFE96
                                                                                                                                                                                                                                            Malicious:true
                                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........EY.o+..o+..o+......o+...*..o+...*..o+..o*..o+......o+.../..o+...(..o+...#..o+...+..o+......o+...)..o+.Rich.o+.................PE..d...\a.c.........." ...".0.......p.......................................................`.........................................L..........\............P..............$..........................................@...........................................UPX0.....p..............................UPX1.....0.......$..................@....rsrc................(..............@..............................................................................................................................................................................................................................................................................................................................................................3.96.UPX!.$..

                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI45442\Crypto\Hash\_SHA1.pyd

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Roaming\empyrean\dat.txt
                                                                                                                                                                                                                                            File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):13312
                                                                                                                                                                                                                                            Entropy (8bit):7.240942496482241
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:384:CDyIXn11ON21FUOyquRmMS17VCgHgmynUxaVXALana4:CDyQ11a21FYjRmMAVULZ
                                                                                                                                                                                                                                            MD5:D28807CB842B8A9F7611175CBBBC8867
                                                                                                                                                                                                                                            SHA1:FFB37BCC48B93D47EC6BA442E1BC7AA90A98246A
                                                                                                                                                                                                                                            SHA-256:C6870DB1D8518D0E594C7E7A0271636BCFCCAF58BE584A20E2A7EFCE1E3D4BB7
                                                                                                                                                                                                                                            SHA-512:0C9B1E751BDC8B995BF3BB8B90E884009F80D39E48AE679EB1551AD74D9A4987B80858EC180DCF81F25247571EB07B051E564F64594A4374E7BF5B07F68B90E8
                                                                                                                                                                                                                                            Malicious:true
                                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........%Y.oK..oK..oK......oK...J..oK...J..oK..oJ..oK...N..oK...O..oK...H..oK...C..oK...K..oK......oK...I..oK.Rich.oK.........................PE..d...Wa.c.........." ...".0................................................................`.........................................L...........\............`..X...........$...........................................@...........................................UPX0....................................UPX1.....0.......,..................@....rsrc................0..............@......................................................................................................................................................................................................................................................................................................................................................3.96.UPX!.$..

                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI45442\Crypto\Hash\_SHA224.pyd

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Roaming\empyrean\dat.txt
                                                                                                                                                                                                                                            File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):14848
                                                                                                                                                                                                                                            Entropy (8bit):7.292530574848384
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:384:C6PTNMvsMA5oqMs6C5JWBCZy6nUxaVXALe:C6pMvsbtqwvN
                                                                                                                                                                                                                                            MD5:3ADAFA903E2D2681181606C962A83E62
                                                                                                                                                                                                                                            SHA1:D9963B1A62DE6A0CD4E319BC24E1F6D86E5FB74C
                                                                                                                                                                                                                                            SHA-256:407318F348E50F68E9C0517467BD9FB9AB40823302A84CB56B4E015A76821D17
                                                                                                                                                                                                                                            SHA-512:F1B90E760878D8D3E8801C42CDA4F3651E95B0F12DF49458637D7BC4B87780B4E914345E5854EAC2EB34668E0A088F526BC6360B0DD0597A8B3CD38A1708D837
                                                                                                                                                                                                                                            Malicious:true
                                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........%Y.oK..oK..oK......oK...J..oK...J..oK..oJ..oK...N..oK...O..oK...H..oK...C..oK...K..oK......oK...I..oK.Rich.oK.........................PE..d...Ya.c.........." ...".@..........P.....................................................`.........................................L...........\............p..............4...$...................................H...@...........................................UPX0....................................UPX1.....@.......2..................@....rsrc................6..............@......................................................................................................................................................................................................................................................................................................................................................3.96.UPX!.$..

                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI45442\Crypto\Hash\_SHA256.pyd

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Roaming\empyrean\dat.txt
                                                                                                                                                                                                                                            File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):14848
                                                                                                                                                                                                                                            Entropy (8bit):7.305090410676597
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:384:C/PTNMvsMA5oqPFQrVLOhFsCpem+EnUxaVXALe:C/pMvspFQRihFsCppN
                                                                                                                                                                                                                                            MD5:FDA96B4CA2499DE84F3F982B536911DF
                                                                                                                                                                                                                                            SHA1:898E6DA58A9F99C2E97B7B968C7BB905CD1B8E3F
                                                                                                                                                                                                                                            SHA-256:DDAF1B7C30CC0BAC0A30845C8279D9DE3E3165149FBA5BCBF5FE9C06849E97CB
                                                                                                                                                                                                                                            SHA-512:91DE91D99D9E1AB1DECE569031B4C94EB31438235CC54FD5D9DB1C6C6588E99B5A12C8731ED02D89ADB635AE32A6217336D4EA212A28F318B8D2FA5D157674F1
                                                                                                                                                                                                                                            Malicious:true
                                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........%Y.oK..oK..oK......oK...J..oK...J..oK..oJ..oK...N..oK...O..oK...H..oK...C..oK...K..oK......oK...I..oK.Rich.oK.........................PE..d...Xa.c.........." ...".@..........P.....................................................`.........................................L...........\............p..............4...$...................................H...@...........................................UPX0....................................UPX1.....@.......2..................@....rsrc................6..............@......................................................................................................................................................................................................................................................................................................................................................3.96.UPX!.$..

                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI45442\Crypto\Hash\_SHA384.pyd

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Roaming\empyrean\dat.txt
                                                                                                                                                                                                                                            File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):15360
                                                                                                                                                                                                                                            Entropy (8bit):7.387902805722102
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:384:CZKaj0o+l4vgQDD7pvJhEkgEo9nUxaVXALQ6:C8MDWoFDnpvWbX
                                                                                                                                                                                                                                            MD5:961ED0A2E355E9D15D98918438E75F2C
                                                                                                                                                                                                                                            SHA1:044210C4B576E85333ACC7911D6B65AAA7D2AE6D
                                                                                                                                                                                                                                            SHA-256:F3526F51E53E2DC1251893DD345AD59F519F9C3C69860AE8320E029241676D59
                                                                                                                                                                                                                                            SHA-512:DD7E9352E0C132C9FCE841D0C9A40D27C99E99661F5452760E67A09CACC701081FCAE46BD90E1D81EBD7F1C641C271767BE5D1D76A72E8FD0728AA069B330606
                                                                                                                                                                                                                                            Malicious:true
                                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........%Y.oK..oK..oK......oK...J..oK...J..oK..oJ..oK...N..oK...O..oK...H..oK...C..oK...K..oK......oK...I..oK.Rich.oK.........................PE..d...Za.c.........." ...".@................................................................`.........................................L...........\...........................4...........................................@...........................................UPX0....................................UPX1.....@.......4..................@....rsrc................8..............@......................................................................................................................................................................................................................................................................................................................................................3.96.UPX!.$..

                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI45442\Crypto\Hash\_SHA512.pyd

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Roaming\empyrean\dat.txt
                                                                                                                                                                                                                                            File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):15360
                                                                                                                                                                                                                                            Entropy (8bit):7.456796403229419
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:384:CWKaj0t9/BuZh2MulpDvqyGxTvnUxaVXALF:CTMw9/BMhruKyGxDO
                                                                                                                                                                                                                                            MD5:17BDD9F18FC0BA23BCF7A2F0DBE6C34D
                                                                                                                                                                                                                                            SHA1:09D42AE8EC33CA02B9889132A4957D0FE4274BB5
                                                                                                                                                                                                                                            SHA-256:820C8E6E5C7480A709B3665848884BA9D852163C79560A651131DE89ACE0261A
                                                                                                                                                                                                                                            SHA-512:91DBCD8654F7404A8CD9A40912B995F45FE5A405AF78737B6DFB113DB6DAE12D9D36BF773CC702E2696BF79AB21F2EC505FFA87F74575DFD45C449A03C40A7F2
                                                                                                                                                                                                                                            Malicious:true
                                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........%Y.oK..oK..oK......oK...J..oK...J..oK..oJ..oK...N..oK...O..oK...H..oK...C..oK...K..oK......oK...I..oK.Rich.oK.........................PE..d...\a.c.........." ...".@................................................................`.........................................L...........\...........................4...........................................@...........................................UPX0....................................UPX1.....@.......4..................@....rsrc................8..............@......................................................................................................................................................................................................................................................................................................................................................3.96.UPX!.$..

                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI45442\Crypto\Hash\_ghash_clmul.pyd

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Roaming\empyrean\dat.txt
                                                                                                                                                                                                                                            File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):10752
                                                                                                                                                                                                                                            Entropy (8bit):6.789317389612839
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:192:p1U5KEc/Y4ELhbko1JQdwXBSkyUxaVXFaLZnxzm:EKX/shnQduSnUxaVXALr
                                                                                                                                                                                                                                            MD5:461EFFE91D16420811D0ADB865654DE7
                                                                                                                                                                                                                                            SHA1:863AD8549892CB921DFFC35559FC7385598BF0A9
                                                                                                                                                                                                                                            SHA-256:0F322BFB8F6C26DF329D6254B2FE8A25C1AB4AB51F9404F6EAE943E0A253F469
                                                                                                                                                                                                                                            SHA-512:CC05A3D9A6F48AFD8E70BFABC870156E50D2CE6509E4E46C0F5567EAF1C2CC1AB52B8CA1990861E46AF569DE9717219BB205860D48177241D44BF573C0F50CDF
                                                                                                                                                                                                                                            Malicious:true
                                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........&...H...H...H......H..I...H..I...H...I...H..M...H..L...H..K...H...@...H...H...H.......H...J...H.Rich..H.........................PE..d...]a.c.........." ...".0.......p.......................................................`.........................................T..........d............P..................$......................................@...........................................UPX0.....p..............................UPX1.....0......."..................@....rsrc................&..............@......................................................................................................................................................................................................................................................................................................................................................3.96.UPX!.$..

                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI45442\Crypto\Hash\_ghash_portable.pyd

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Roaming\empyrean\dat.txt
                                                                                                                                                                                                                                            File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):10752
                                                                                                                                                                                                                                            Entropy (8bit):6.817402405280982
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:192:Hje1U5KEc/Y4EL94AxD9JFkyUxaVXFaLfnpT:RKX/s9D9JFnUxaVXALh
                                                                                                                                                                                                                                            MD5:3057B01EC05D6ABD5CEE82EC2E4CFB06
                                                                                                                                                                                                                                            SHA1:A82D7D2183AD2C4D5B68B805DEA6487B9FDD3E43
                                                                                                                                                                                                                                            SHA-256:2DB1135EC696600AB7D53634BACAD4BBCB8DC25B09E6BD2C2633E8DF75736082
                                                                                                                                                                                                                                            SHA-512:1548894E039DFB33C17EB9CDB05C6C31F8D993C285898522E0776A063D2240F9F48F8717F9598A4957B5673B3256652E7FD2260D1E9DB34FA86D144925C06A52
                                                                                                                                                                                                                                            Malicious:true
                                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........EY.o+..o+..o+......o+...*..o+...*..o+..o*..o+......o+.../..o+...(..o+...#..o+...+..o+......o+...)..o+.Rich.o+.................PE..d...]a.c.........." ...".0.......p.......................................................`.........................................L..........\............P..X...............$......................................@...........................................UPX0.....p..............................UPX1.....0......."..................@....rsrc................&..............@..............................................................................................................................................................................................................................................................................................................................................................3.96.UPX!.$..

                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI45442\Crypto\Hash\_keccak.pyd

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Roaming\empyrean\dat.txt
                                                                                                                                                                                                                                            File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):12288
                                                                                                                                                                                                                                            Entropy (8bit):7.060617294398413
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:192:CVj1ole1gwA1QapW0MEGqvjtv7ovK+u8NsS1mZKQ6kkyUxaVXFaLHncx:CSe1rwtph4q7JoSb8N5cKHknUxaVXAL8
                                                                                                                                                                                                                                            MD5:EB197359306DAA1DF7E19DC1E85D046F
                                                                                                                                                                                                                                            SHA1:B0D013525C512F887BEB025F855E439D654877E3
                                                                                                                                                                                                                                            SHA-256:8BB9B9E91287E12F867A53E0D6C8067FB9344FFB46CE6D874E44A6E89C8FE14D
                                                                                                                                                                                                                                            SHA-512:EBD339879E0DA163008DF5195316C086035BB980878A61E031E34FDC74253BF7AD495EC97FE1057BD5FA3D322C6C707ADF405709DD44834238F705435E02CC1B
                                                                                                                                                                                                                                            Malicious:true
                                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........%Y.oK..oK..oK......oK...J..oK...J..oK..oJ..oK...N..oK...O..oK...H..oK...C..oK...K..oK......oK...I..oK.Rich.oK.........................PE..d...\a.c.........." ...".0.......p........................................................`.........................................L..........\............P..p...........@...........................................@...........................................UPX0.....p..............................UPX1.....0.......(..................@....rsrc................,..............@......................................................................................................................................................................................................................................................................................................................................................3.96.UPX!.$..

                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI45442\Crypto\Hash\_poly1305.pyd

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Roaming\empyrean\dat.txt
                                                                                                                                                                                                                                            File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):11776
                                                                                                                                                                                                                                            Entropy (8bit):7.021267811320247
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:192:CV011I5c1918YWN+ZnOsrjHDSyPrmnbNnYyDgIkyUxaVXFaLKnBC:CwYcfWYWJsrTDSKrmbYInUxaVXALY
                                                                                                                                                                                                                                            MD5:B18D6148260D3F01B4CFB38EE35F76BB
                                                                                                                                                                                                                                            SHA1:87064360D9A06D9B8507AA6CB3C9C49FACB2D159
                                                                                                                                                                                                                                            SHA-256:E82A778AB0A50807F9E895761E4BCDE2AB1F194B0BEA29BB1242F782388C3322
                                                                                                                                                                                                                                            SHA-512:6C2DB42605B6B8125860EB666149C186BB02ACD2CD769FE0D494E7566D30824663DC9C4A19A654FD6CB0DC62E9EC13B105FB6C67B288E8B8BEC65EC5DDF2CD9A
                                                                                                                                                                                                                                            Malicious:true
                                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........%Y.oK..oK..oK......oK...J..oK...J..oK..oJ..oK...N..oK...O..oK...H..oK...C..oK...K..oK......oK...I..oK.Rich.oK.........................PE..d...^a.c.........." ...".0.......p..`.....................................................`.........................................L..........\............P..|...................................................X...@...........................................UPX0.....p..............................UPX1.....0.......&..................@....rsrc................*..............@......................................................................................................................................................................................................................................................................................................................................................3.96.UPX!.$..

                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI45442\Crypto\Math\_modexp.pyd

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Roaming\empyrean\dat.txt
                                                                                                                                                                                                                                            File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):20480
                                                                                                                                                                                                                                            Entropy (8bit):7.522268054098919
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:384:jVIehK2iflZpwNAFvzReHErimGpOqQ8lxiFviBaDOA5/cnUxaVXALaY:jVruHdRecEJlw58A5EBY
                                                                                                                                                                                                                                            MD5:22720D896AFDBCDCBD949F5D5492C82B
                                                                                                                                                                                                                                            SHA1:86A9A1DC7F6B0BFB37977824DF983943BE3141CE
                                                                                                                                                                                                                                            SHA-256:6F355BF63DD20593F44DB12EAB941096EFD70F62D778BDEA546B48F0D055E881
                                                                                                                                                                                                                                            SHA-512:8F1840A9DAAC58AC18A13D2B810BA410FAEE133D12DF49BE76699073E96B766AA21C2116BEE9D45555E12CE0E2E516BCD3A561DF3528E9FA57980F1EA72C68EC
                                                                                                                                                                                                                                            Malicious:true
                                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......L..|.../.../.../..Q/.../G....../C....../.../#../G....../G....../G....../....../....../.=/.../....../Rich.../................PE..d...la.c.........." ...".P.......... ........................................ ............`.........................................L...d.......\...............$.......................................................@...........................................UPX0....................................UPX1.....P.......H..................@....rsrc................L..............@..............................................................................................................................................................................................................................................................................................................................................................3.96.UPX!.$..

                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI45442\Crypto\Protocol\_scrypt.pyd

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Roaming\empyrean\dat.txt
                                                                                                                                                                                                                                            File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):10240
                                                                                                                                                                                                                                            Entropy (8bit):6.826599062620208
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:192:z1Qxmkp6kBsHaEDzSbbc6PpnXJoBQ5hkyUxaVXFaLr3sUK:mbsHaEabcSJ5hnUxaVXALo
                                                                                                                                                                                                                                            MD5:FF7E401961C18D07C055B796A70E7D9F
                                                                                                                                                                                                                                            SHA1:71FEA35BE66E71445B22B957C9DE52CB72C42DAA
                                                                                                                                                                                                                                            SHA-256:0B23AC14EB398813E04F9116B66F77E93DEB2F9473C6534AAEEE0742128E219F
                                                                                                                                                                                                                                            SHA-512:3885E7579CA4953167CA8F171A239355E3A0B128620CD4919FD8336DDB7877BBAEA07B0EC987D3A3F00BE495778CA003EC2D694373CFA6450644A82F090CFE5D
                                                                                                                                                                                                                                            Malicious:true
                                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......................;..................................................................W.............Rich............................PE..d...ca.c.........." ...". .......p.......................................................`.........................................L...d......\............P..4......................................................@...........................................UPX0.....p..............................UPX1..... ....... ..................@....rsrc................$..............@......................................................................................................................................................................................................................................................................................................................................................3.96.UPX!.$..

                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI45442\Crypto\PublicKey\_ec_ws.pyd

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Roaming\empyrean\dat.txt
                                                                                                                                                                                                                                            File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):638976
                                                                                                                                                                                                                                            Entropy (8bit):7.998469740064385
                                                                                                                                                                                                                                            Encrypted:true
                                                                                                                                                                                                                                            SSDEEP:12288:3utRJVHFtuPQ5Yi66r+uWMkf51I6NqAvPBTd74LlSSgdd:+tRfltQiFrhWMkf53tvUhk
                                                                                                                                                                                                                                            MD5:9977AF4D41DBD25919E57275A3B6A60C
                                                                                                                                                                                                                                            SHA1:81BF50D93CB871B40F8E1C95A06BA7E1E5C77141
                                                                                                                                                                                                                                            SHA-256:7A467F18E2DFB9276F5CC6709102B70D004D8EEB55E3E53270419D3F3960EDFE
                                                                                                                                                                                                                                            SHA-512:C8021B01E0C7CFE3DA8006D1529DFEFE851B6ED9ECA104FACB17B3BDA2A6B6062143FA9A9B3462E4A0BE58E6579FC34B6520B9E267E1C9B27B9950AA0807C7C8
                                                                                                                                                                                                                                            Malicious:true
                                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......`...$..L$..L$..L-.#L"..Lk.M&..Lo.M'..L$..L...Lk.M(..Lk.M,..Lk.M'..L..M!..L..M%..L..OL%..L..M%..LRich$..L................PE..d...ha.c.........." ..."......... .......0................................................`.........................................L...d.......\...............l.......................................................@...........................................UPX0..... ..............................UPX1.........0......................@....rsrc...............................@..............................................................................................................................................................................................................................................................................................................................................................3.96.UPX!.$..

                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI45442\Crypto\PublicKey\_ed25519.pyd

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Roaming\empyrean\dat.txt
                                                                                                                                                                                                                                            File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):15872
                                                                                                                                                                                                                                            Entropy (8bit):7.446672321911902
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:384:N/6Y6GuC70NwWjL95yqC0AG1kOnUxaVXALR:J6UB7ewWOk1J6
                                                                                                                                                                                                                                            MD5:03AB1F87202DBBB7A0B911283F9628F6
                                                                                                                                                                                                                                            SHA1:968DCB59BFFFECD767160356449B2E6397CEB819
                                                                                                                                                                                                                                            SHA-256:7C6131D04BA4EBB0C4A5434ADD080A33A30E6DB7542A54BFE6EBE4CA3F13FAFF
                                                                                                                                                                                                                                            SHA-512:0170A3AE72141DABC95ACF21D3F9602F0BB0A47E1AA834E0FC01F7E75E727ACF9A6BEB66484327639EFEE12E0106A030E56121E604DEDA0DF3C44B3EA1C58706
                                                                                                                                                                                                                                            Malicious:true
                                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........Y.o...o...o.......o.......o.......o...o...o.......o.......o.......o.......o.......o....t..o.......o..Rich.o..................PE..d...ja.c.........." ...".@.......... .....................................................`.........................................L...0.......\...........................|...........................................@...........................................UPX0....................................UPX1.....@.......6..................@....rsrc................:..............@..............................................................................................................................................................................................................................................................................................................................................................3.96.UPX!.$..

                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI45442\Crypto\PublicKey\_ed448.pyd

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Roaming\empyrean\dat.txt
                                                                                                                                                                                                                                            File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):27136
                                                                                                                                                                                                                                            Entropy (8bit):7.716235505829019
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:384:N+U1/EIha4hI63riOlt0IVQNv3sdIHaOyyFOHBjXuwtd1INmDwvrFDh1nUxaVXAV:N+U1/jhVhd3riwKMTFJluwRE9fp0
                                                                                                                                                                                                                                            MD5:999485C3306CE844545D6FF32B1778F7
                                                                                                                                                                                                                                            SHA1:F6E146C47AA1992D91A46BDF1727BD752C9608A5
                                                                                                                                                                                                                                            SHA-256:933F66840E793D4897594E934B78D5513C5A4C6B28A930F2B3E89E5A0AA203AD
                                                                                                                                                                                                                                            SHA-512:315ED2B1CDDB0A5476DB91B6ABE041D772437E5C72E7F9D9A67B747E61E5DA2E5F4C035FE67487BB31E55B560F9846A908D927FBEF9CC791D36E578247B1CA6A
                                                                                                                                                                                                                                            Malicious:true
                                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......L..|.../.../.../..Q/.../G....../C....../.../#../G....../G....../G....../....../....../.=/.../....../Rich.../................PE..d...ka.c.........." ...".p...........s... ................................................`.........................................L...h......\............0..$...............$.......................................@...........................................UPX0....................................UPX1.....p... ...b..................@....rsrc................f..............@..............................................................................................................................................................................................................................................................................................................................................................3.96.UPX!.$..

                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI45442\Crypto\PublicKey\_x25519.pyd

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Roaming\empyrean\dat.txt
                                                                                                                                                                                                                                            File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):9216
                                                                                                                                                                                                                                            Entropy (8bit):6.731328673523401
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:192:O51aJh9fUQmKaF3wB0S57R2kyUxaVXFaLuHhE:O5k9C3a02R2nUxaVXALkE
                                                                                                                                                                                                                                            MD5:959E90A606763B4193A624D012974BB2
                                                                                                                                                                                                                                            SHA1:FC80DE8F6CFFFA0BA034948BCFFF8D8CDEBA29E5
                                                                                                                                                                                                                                            SHA-256:6D63F30609F05450906E8EBD8C90E47827BBBF9EA92906E984223FD51E4908A7
                                                                                                                                                                                                                                            SHA-512:78161B7FC028B90AC40477D1181A00294D4D96378BB88980B8D1A8B7C65814F50BACFDF389540EF3D8BAA3822282FC97981811C5685BD8123E59A614593B0EFB
                                                                                                                                                                                                                                            Malicious:true
                                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......&6!.bWO.bWO.bWO.k/..`WO.-+N.`WO.)/N.aWO.bWN.FWO.-+J.iWO.-+K.jWO.-+L.aWO.+G.cWO.+O.cWO.+..cWO.+M.cWO.RichbWO.........PE..d...ia.c.........." ...". .......p........................................................`.............................................P...................@..............P.......................................x...@...........................................UPX0.....p..............................UPX1..... ..........................@....rsrc................ ..............@......................................................................................................................................................................................................................................................................................................................................................................3.96.UPX!.$..

                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI45442\Crypto\Util\_cpuid_c.pyd

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Roaming\empyrean\dat.txt
                                                                                                                                                                                                                                            File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):9216
                                                                                                                                                                                                                                            Entropy (8bit):6.773387048001548
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:192:C51aJh9fUQeQT3VmqRDFkyUxaVXFaLuHxJ5:C5k9xrVmqBFnUxaVXAL0J5
                                                                                                                                                                                                                                            MD5:6499087EBA82E487F21D40A769C686B6
                                                                                                                                                                                                                                            SHA1:4C5E8759FB35C47221BDA61B6226499D75CBE7E4
                                                                                                                                                                                                                                            SHA-256:2F4B5EB8397D620FA37F794BCA32A95077F764B05DB51DBA9AD34C2E2946FF60
                                                                                                                                                                                                                                            SHA-512:CE183276F0FDCCAF8BE5C34F789F2C47BAB68DFB168E0C181DD0FCF8B4A8C99527CD83C59891DCD98BBEB160DBCE884C4ECEA5EE684DEEDFF845C6B3F8205518
                                                                                                                                                                                                                                            Malicious:true
                                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......&6).bWG.bWG.bWG.k/..`WG.-+F.`WG.)/F.aWG.bWF.AWG.-+B.iWG.-+C.jWG.-+D.aWG.+O.cWG.+G.cWG.+..cWG.+E.cWG.RichbWG.........................PE..d...aa.c.........." ...". .......p........................................................`.............................................|...................@..............|...........................................@...........................................UPX0.....p..............................UPX1..... ..........................@....rsrc................ ..............@......................................................................................................................................................................................................................................................................................................................................................3.96.UPX!.$..

                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI45442\Crypto\Util\_strxor.pyd

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Roaming\empyrean\dat.txt
                                                                                                                                                                                                                                            File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):9216
                                                                                                                                                                                                                                            Entropy (8bit):6.768064843872946
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:96:kbaMhzoscluM6bSM3cVhqj0rrp2C0DCLkyUx7P2EbfOlDhS+dY64At7S1TBIa+tm:zPWbS6Uhrl2hCLkyUxaVXFaLXHB
                                                                                                                                                                                                                                            MD5:9C34D1EC0B1C10FE8F53B9CAA572856A
                                                                                                                                                                                                                                            SHA1:141CDB91EC3C8135A4AC1FE879D82A9E078AB3CB
                                                                                                                                                                                                                                            SHA-256:4AB62B514BAE327476ADD45F5804895578E9F1658D8CF40AC5E7C4FB227469FA
                                                                                                                                                                                                                                            SHA-512:6447889FFE049579F3E09D5828393F7DC5268B2061895ED424F3C83B8C1929D6FECC6F8C9823C483F451C31458736D27D83EB3979A5C91703DAD913957717D09
                                                                                                                                                                                                                                            Malicious:true
                                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......&6).bWG.bWG.bWG.k/..`WG.-+F.`WG.)/F.aWG.bWF.AWG.-+B.iWG.-+C.jWG.-+D.aWG.+O.cWG.+G.cWG.+..cWG.+E.cWG.RichbWG.........................PE..d...ca.c.........." ...". .......p........................................................`.............................................t...................@..............t...........................................@...........................................UPX0.....p..............................UPX1..... ..........................@....rsrc................ ..............@......................................................................................................................................................................................................................................................................................................................................................3.96.UPX!.$..

                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI45442\PIL\_imaging.cp310-win_amd64.pyd

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Roaming\empyrean\dat.txt
                                                                                                                                                                                                                                            File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):750080
                                                                                                                                                                                                                                            Entropy (8bit):7.998268583758689
                                                                                                                                                                                                                                            Encrypted:true
                                                                                                                                                                                                                                            SSDEEP:12288:TcOlugK0Q4OCDzXvegFEiBqhzD/Yup9B2pMUHcNrIEvpyobII6QnKDzsrM/w+tR6:TcrCDD9bBqhzLhpvO3cNrDBnwQKDAMPp
                                                                                                                                                                                                                                            MD5:24B9ED7A68752B1FBFF8D6E4DEB3CCF2
                                                                                                                                                                                                                                            SHA1:B5F02F742F3E7DECA22B01AF2CDFE5049D187A86
                                                                                                                                                                                                                                            SHA-256:EA70560B18994EEC4C1E1856EDA5FD2108CC22F602F3721C1BEEDD1679996B12
                                                                                                                                                                                                                                            SHA-512:DB1373943986ED0B44DCA7FFAC7C96F955A648BE88B837805400CA774B5B70341D5A5F8AF2A6C59222B6BE2002737A40E74B1458344AA88417458699F928D978
                                                                                                                                                                                                                                            Malicious:true
                                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......#d.5g..fg..fg..fn}.fw..f(y.ge..f(yufc..f(y.gi..f(y.go..f(y.gc..f.p.ge..f,}.g`..fg..fc..f.y.g...fg..f|..f.y.g-..f.y.gf..f.ywff..f.y.gf..fRichg..f........PE..d.....'d.........." ...".p.......... .$...................................... %...........`...........................................%.`.....%.......%.......#............. .%. ...........................8.%.(...l.%.@...........................................UPX0....................................UPX1.....p.......h..................@....rsrc.........%......l..............@......................................................................................................................................................................................................................................................................................................................................3.96.UPX!.$..

                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI45442\PIL\_imagingcms.cp310-win_amd64.pyd

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Roaming\empyrean\dat.txt
                                                                                                                                                                                                                                            File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):96768
                                                                                                                                                                                                                                            Entropy (8bit):7.954287656970143
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:1536:8vaKG5Of6QM511dQ5FBvrlxRcqu0UrXQSYiEd+SU6+fRoPJH4NbrJ/Q/3aM6Q9/V:8SKy5dQ5XhxRDUrgbhdPF+fmBYN6OJf
                                                                                                                                                                                                                                            MD5:6733DB0C6AF1962358A2B0E819A23448
                                                                                                                                                                                                                                            SHA1:A7A095C71A3809DD1558CF5BEA17F7C16CBC5625
                                                                                                                                                                                                                                            SHA-256:3BCF5AD133FDD648C22B67D2819C923771D4586514D5E9D0051E088BA10BCBFC
                                                                                                                                                                                                                                            SHA-512:7FCC307ADD30ECDFEF1F2D7446CC6F202785195673A2ACE8F9C5250A2A64319FE7D7B9218847E9F93A1545CD65887D5D4A0B32EBB08EC012CD7D5AAA9306E099
                                                                                                                                                                                                                                            Malicious:true
                                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........rx..+..+..+...+..+...*..+...*..+...*..+...*..+!..*..+...*..+..+...+$..*...+$..*..+$..+..+$..*..+Rich..+........................PE..d.....'d.........." ...".p...........2.......................................P............`.........................................|D..h....@.......@..........\............D.......................................>..@...........................................UPX0....................................UPX1.....p.......p..................@....rsrc........@.......t..............@..............................................................................................................................................................................................................................................................................................................................................3.96.UPX!.$..

                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI45442\PIL\_imagingft.cp310-win_amd64.pyd

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Roaming\empyrean\dat.txt
                                                                                                                                                                                                                                            File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):692224
                                                                                                                                                                                                                                            Entropy (8bit):7.998379316295987
                                                                                                                                                                                                                                            Encrypted:true
                                                                                                                                                                                                                                            SSDEEP:12288:zj7kGcwm1BQ16D7fWH6uIcFVt19qDpBHlv+h9DBW7:zjIGcwmQKWH6SFTrqDpBx+LDa
                                                                                                                                                                                                                                            MD5:F63DA7EEDFC08FE144D3BF4E9556BF2D
                                                                                                                                                                                                                                            SHA1:727C28A211A6EB168FC4F1114D437530D0472C82
                                                                                                                                                                                                                                            SHA-256:78BAFB6ED313F0F5CC0115558FED81C46BA5055AADB5117B85373722C8DCCA16
                                                                                                                                                                                                                                            SHA-512:6A2A590CE32EA5581FAEB6B55DAE0D6156831267EC2B347E4B5C9602EE74A1EF58F182D56B25DCCF4E2C655ABFC2CD9240EC530536A1DBD0086B34EB37B793E3
                                                                                                                                                                                                                                            Malicious:true
                                                                                                                                                                                                                                            Preview:MZ......................@...................................(...........!..L.!This program cannot be run in DOS mode....$......................<................R............................X........................P.........Rich...........................PE..d.....'d.........." ..."................. ................................................`.........................................X...d......h............`..@.......................................................@...........................................UPX0....................................UPX1......... ......................@....rsrc...............................@......................................................................................................................................................................................................................................................................................................................3.96.UPX!.$..

                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI45442\PIL\_imagingtk.cp310-win_amd64.pyd

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Roaming\empyrean\dat.txt
                                                                                                                                                                                                                                            File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):12288
                                                                                                                                                                                                                                            Entropy (8bit):6.8574100581789965
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:192:DCK+UCIU7Aj+u54CJTiSVCWbFHj79+gCkyUxaVXFaL2HpAKdrye:D5CRt0iSVCWbZj78gCnUxaVXAL0AKdry
                                                                                                                                                                                                                                            MD5:94C237E6ACDBF6EE7F060D109C47B58B
                                                                                                                                                                                                                                            SHA1:ED5305A5CA7C5CA1E2246444A20C9EDC82F495C9
                                                                                                                                                                                                                                            SHA-256:78ACC538AB16006B8B1162704924979FC4F3EA32C96C3D7F419E45B5805251CF
                                                                                                                                                                                                                                            SHA-512:4632BFC70ACFED1F7915A1E4DF68DC48DA432A8D644D59849332AFDC82CFAAD4FC705E11B8B2BFBF56AA36C0878658BCD928BCB0A5B75A1EB1C928ED350127A6
                                                                                                                                                                                                                                            Malicious:true
                                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......bJ.?&+.l&+.l&+.l/S}l,+.liW.m$+.liW.m*+.liW.m.+.liW.m%+.l.^.m$+.lmS.m#+.l&+.l.+.l.W.m$+.l.W.m'+.l.W.l'+.l.W.m'+.lRich&+.l........................PE..d.....'d.........." ...".0..........0.....................................................`.............................................d....................`..............,.......................................(...@...........................................UPX0....................................UPX1.....0.......&..................@....rsrc................*..............@..............................................................................................................................................................................................................................................................................................................................................3.96.UPX!.$..

                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI45442\PIL\_webp.cp310-win_amd64.pyd

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Roaming\empyrean\dat.txt
                                                                                                                                                                                                                                            File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):216064
                                                                                                                                                                                                                                            Entropy (8bit):7.98646204031228
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:6144:nA5Pjci7Q5avbYeaWBn5wWD1YKrfyjCKXBVjtmbX:ePjcPgZPhnrfyOKXA
                                                                                                                                                                                                                                            MD5:96BF2F1EC99EDE91E4C85C1C55E88825
                                                                                                                                                                                                                                            SHA1:15CA18D5C4620E9BF1BDF46902FE238410A29B6D
                                                                                                                                                                                                                                            SHA-256:84498379B48C4FA2955688910F3409944BF4FC819C0F7C7FE07A5D1ED7D25EFA
                                                                                                                                                                                                                                            SHA-512:1A7229CA7AEB1F1B8A525BBCB9952D741AD43BBC597ADA0A423586F2A65C3C6045716313EBB073CAC03D2E8802ACE2A49C9350E95953E288B8D1AC5F4F07F8E5
                                                                                                                                                                                                                                            Malicious:true
                                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......O.4...Z...Z...Z.......Z.D.[...Z.@.[...Z.D._...Z.D.^...Z.D.Y...Z..[...Z...[.X.Z..^.].Z..R...Z..Z...Z......Z..X...Z.Rich..Z.........................PE..d.....'d.........." ...".P.......`.......p................................................`.........................................x...\.................... ...L..................................................x...@...........................................UPX0.....`..............................UPX1.....P...p...B..................@....rsrc................F..............@......................................................................................................................................................................................................................................................................................................................................3.96.UPX!.$..

                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI45442\VCRUNTIME140.dll

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Roaming\empyrean\dat.txt
                                                                                                                                                                                                                                            File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):109392
                                                                                                                                                                                                                                            Entropy (8bit):6.643764685776923
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:1536:DcghbEGyzXJZDWnEzWG9q4lVOiVgXjO5/Auecbq8qZU34zW/K0zD:DV3iC0h9q4v6XjKAuecbq8qGISb/
                                                                                                                                                                                                                                            MD5:870FEA4E961E2FBD00110D3783E529BE
                                                                                                                                                                                                                                            SHA1:A948E65C6F73D7DA4FFDE4E8533C098A00CC7311
                                                                                                                                                                                                                                            SHA-256:76FDB83FDE238226B5BEBAF3392EE562E2CB7CA8D3EF75983BF5F9D6C7119644
                                                                                                                                                                                                                                            SHA-512:0B636A3CDEFA343EB4CB228B391BB657B5B4C20DF62889CD1BE44C7BEE94FFAD6EC82DC4DB79949EDEF576BFF57867E0D084E0A597BF7BF5C8E4ED1268477E88
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........u...u...u.E.t...u.....u...t...u..v...u..q...u..p...u..u...u......u..w...u.Rich..u.........PE..d.....y..........." ...".....`.......................................................5....`A........................................`C..4....K...............p.......\..PO...........-..p............................,..@............................................text............................... ..`.rdata...A.......B..................@..@.data...0....`.......D..............@....pdata.......p.......H..............@..@_RDATA..\............T..............@..@.rsrc................V..............@..@.reloc...............Z..............@..B................................................................................................................................................................................................................................

                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI45442\VCRUNTIME140_1.dll

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Roaming\empyrean\dat.txt
                                                                                                                                                                                                                                            File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):49488
                                                                                                                                                                                                                                            Entropy (8bit):6.652691609629867
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:768:8EgYXUcHJcUJSDW/tfxL1qBS3hO6nb/TEHEXi9zufUKQXi9zug:8vGS8fZ1eUpreA+zuTc+zug
                                                                                                                                                                                                                                            MD5:BBA9680BC310D8D25E97B12463196C92
                                                                                                                                                                                                                                            SHA1:9A480C0CF9D377A4CAEDD4EA60E90FA79001F03A
                                                                                                                                                                                                                                            SHA-256:E0B66601CC28ECB171C3D4B7AC690C667F47DA6B6183BFF80604C84C00D265AB
                                                                                                                                                                                                                                            SHA-512:1575C786AC3324B17057255488DA5F0BC13AD943AC9383656BAF98DB64D4EC6E453230DE4CD26B535CE7E8B7D41A9F2D3F569A0EFF5A84AEB1C2F9D6E3429739
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..............L...L...L...M...L...M...L.FL...L...L...L...M...L...M...L...M...L...M...L..*L...L...M...LRich...L........................PE..d...%CU..........." ...".<...8.......A...............................................@....`A........................................0m.......m..x....................r..PO......D....c..p...........................pb..@............P..h............................text...0:.......<.................. ..`.rdata..."...P...$...@..............@..@.data................d..............@....pdata...............f..............@..@.rsrc................l..............@..@.reloc..D............p..............@..B................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI45442\_asyncio.pyd

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Roaming\empyrean\dat.txt
                                                                                                                                                                                                                                            File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):35712
                                                                                                                                                                                                                                            Entropy (8bit):7.649102416316352
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:768:+2sbZA5n1we/lPgOb1koYpu53VnJ2gl+NfOlQI75n2VYiSyvPRPxWED:+2RhZtXxkoYiTTENKQI75n2V7SynRPx
                                                                                                                                                                                                                                            MD5:CD9D22812520B671EED3964DA7E5CDB9
                                                                                                                                                                                                                                            SHA1:ADE6CC31B7610CFAE8EE8D2BA61C2C3D123AC5C1
                                                                                                                                                                                                                                            SHA-256:00275ADF6FFE251CA6C46864D44B6F2F29341B76CE5C9E26EB11721CB8B134AB
                                                                                                                                                                                                                                            SHA-512:A07E008D39B1044D89151A871FFFB18EA82814BF12574D6D959EF28CD590F2A09242D739FD9ABC4F6A4E32D1EB8CBD813BCEDCCA524551EAC1E1D92E2E245491
                                                                                                                                                                                                                                            Malicious:true
                                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........TF.q.F.q.F.q.O...D.q...p.D.q...t.J.q...u.N.q...r.E.q...p.E.q...p.D.q.F.p...q...|.G.q...q.G.q....G.q...s.G.q.RichF.q.................PE..d...$..c.........." ...".`.......... #.......................................P............`..........................................J..P....I..P....@......................DK..$..................................../..@...........................................UPX0....................................UPX1.....`.......R..................@....rsrc........@.......V..............@......................................................................................................................................................................................................................................................................................................................................................3.96.UPX!.$..

                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI45442\_bz2.pyd

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Roaming\empyrean\dat.txt
                                                                                                                                                                                                                                            File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):48504
                                                                                                                                                                                                                                            Entropy (8bit):7.773461990395197
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:768:7iQxyc/3D2HGItfsKbsonbgiHUoYVcW5I7tVbenYiSyv5PxWEDX:75xdEsKbtnbgqUoYt5I7tVb07SyxPx9
                                                                                                                                                                                                                                            MD5:758FFF1D194A7AC7A1E3D98BCF143A44
                                                                                                                                                                                                                                            SHA1:DE1C61A8E1FB90666340F8B0A34E4D8BFC56DA07
                                                                                                                                                                                                                                            SHA-256:F5E913A9F2ADF7D599EA9BB105E144BA11699BBCB1514E73EDCF7E062354E708
                                                                                                                                                                                                                                            SHA-512:468D7C52F14812D5BDE1E505C95CB630E22D71282BDA05BF66324F31560BFA06095CF60FC0D34877F8B361CCD65A1B61D0FD1F91D52FACB0BAF8E74F3FED31CC
                                                                                                                                                                                                                                            Malicious:true
                                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$....................a.........................................t.........................................Rich....................PE..d...2..c.........." ..."............pd....................................................`.............................................H.................... .. ..................................................hp..@...........................................UPX0....................................UPX1................................@....rsrc...............................@..............................................................................................................................................................................................................................................................................................................................................3.96.UPX!.$..

                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI45442\_ctypes.pyd

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Roaming\empyrean\dat.txt
                                                                                                                                                                                                                                            File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):58232
                                                                                                                                                                                                                                            Entropy (8bit):7.821424155463504
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:1536:JUP3/jolpinLX2rRaWMzhB8yLI7QP7U7SykPxiM:u3/jolwXuRaW6SOI7QP7U2xB
                                                                                                                                                                                                                                            MD5:6CA9A99C75A0B7B6A22681AA8E5AD77B
                                                                                                                                                                                                                                            SHA1:DD1118B7D77BE6BB33B81DA65F6B5DC153A4B1E8
                                                                                                                                                                                                                                            SHA-256:D39390552C55D8FD4940864905CD4437BC3F8EFE7FF3CA220543B2C0EFAB04F8
                                                                                                                                                                                                                                            SHA-512:B0B5F2979747D2F6796D415DD300848F32B4E79EDE59827AC447AF0F4EA8709B60D6935D09E579299B3BC54B6C0F10972F17F6C0D1759C5388AD5B14689A23FE
                                                                                                                                                                                                                                            Malicious:true
                                                                                                                                                                                                                                            Preview:MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$.......NC..."..."..."...Z..."..E^..."..E^..."..E^..."..E^..."...^..."...P..."...P..."...K..."..."..."...^..."...^..."...^x.."...^..."..Rich."..........................PE..d.../..c.........." ...".........p..P........................................@............`.........................................H<.......9.......0..........,............<......................................X%..@...........................................UPX0.....p..............................UPX1................................@....rsrc........0......................@..............................................................................................................................................................................................................................................................................................................................3.96.UPX!.$..

                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI45442\_decimal.pyd

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Roaming\empyrean\dat.txt
                                                                                                                                                                                                                                            File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):106368
                                                                                                                                                                                                                                            Entropy (8bit):7.935447983813077
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:3072:ggCMV2Mz94bMgxECS8kePpTn8XI75qNp8mx:g1MV2Mz94og2tJePpwFp
                                                                                                                                                                                                                                            MD5:EB45EA265A48348CE0AC4124CB72DF22
                                                                                                                                                                                                                                            SHA1:ECDC1D76A205F482D1ED9C25445FA6D8F73A1422
                                                                                                                                                                                                                                            SHA-256:3881F00DBC4AADF9E87B44C316D93425A8F6BA73D72790987226238DEFBC7279
                                                                                                                                                                                                                                            SHA-512:F7367BF2A2D221A7508D767AD754B61B2B02CDD7AE36AE25B306F3443D4800D50404AC7E503F589450ED023FF79A2FB1DE89A30A49AA1DD32746C3E041494013
                                                                                                                                                                                                                                            Malicious:true
                                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........|RTy..Ty..Ty..]...Zy......Vy......Yy......\y......Py......Wy......Vy..Ty...y......Uy......[y......Uy......Uy......Uy..RichTy..........PE..d...)..c.........." ...".p................................................... ............`.............................................P........................'......................................................@...........................................UPX0....................................UPX1.....p.......d..................@....rsrc................h..............@......................................................................................................................................................................................................................................................................................................................................................3.96.UPX!.$..

                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI45442\_hashlib.pyd

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Roaming\empyrean\dat.txt
                                                                                                                                                                                                                                            File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):34688
                                                                                                                                                                                                                                            Entropy (8bit):7.615342100631813
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:768:aU3dM1TMhvg8KNML5TOuzSsI/RYdI75ImtYiSyvfPxWEabVV/:aedM1TMho8iMLPmv/KdI75Imt7SyXPxA
                                                                                                                                                                                                                                            MD5:0D723BC34592D5BB2B32CF259858D80E
                                                                                                                                                                                                                                            SHA1:EACFABD037BA5890885656F2485C2D7226A19D17
                                                                                                                                                                                                                                            SHA-256:F2B927AAA856D23F628B01380D5A19BFE9233DB39C9078C0E0585D376948C13F
                                                                                                                                                                                                                                            SHA-512:3E79455554D527D380ADCA39AC10DBF3914CA4980D8EE009B7DAF30AEB4E9359D9D890403DA9CC2B69327C695C57374C390FA780A8FD6148BBEA3136138EAD33
                                                                                                                                                                                                                                            Malicious:true
                                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........_.A.>...>...>...F2..>...B...>...B...>...B...>...B...>..iB...>...L...>...D...>...>..Q>..iB...>..iB...>..iB^..>..iB...>..Rich.>..........................PE..d.../..c.........." ...".P..........p........................................@............`..........................................;..P....9.......0.......................;......................................h*..@...........................................UPX0....................................UPX1.....P.......L..................@....rsrc........0.......P..............@......................................................................................................................................................................................................................................................................................................................................3.96.UPX!.$..

                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI45442\_lzma.pyd

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Roaming\empyrean\dat.txt
                                                                                                                                                                                                                                            File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):86392
                                                                                                                                                                                                                                            Entropy (8bit):7.918616838915833
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:1536:I1KvmqFMCNL6eKmtYs76LBlBqLBxcZiV6IHxdc/k4Ncs7I7e1gT7SyJPxs:aqdLCOz76LBl4VxYcdc/19I7e1gTvxs
                                                                                                                                                                                                                                            MD5:ABCEECEAEFF3798B5B0DE412AF610F58
                                                                                                                                                                                                                                            SHA1:C3C94C120B5BED8BCCF8104D933E96AC6E42CA90
                                                                                                                                                                                                                                            SHA-256:216AA4BB6F62DD250FD6D2DCDE14709AA82E320B946A21EDEEC7344ED6C2C62E
                                                                                                                                                                                                                                            SHA-512:3E1A2EB86605AA851A0C5153F7BE399F6259ECAAD86DBCBF12EEAE5F985DC2EA2AB25683285E02B787A5B75F7DF70B4182AE8F1567946F99AD2EC7B27D4C7955
                                                                                                                                                                                                                                            Malicious:true
                                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......b.J[&.$.&.$.&.$./..".$.i.%.$.$.i.!.*.$.i. ...$.i.'.%.$...%.%.$...%.$.$.&.%.C.$...)...$...$.'.$.....'.$...&.'.$.Rich&.$.........PE..d...B..c.........." ...". ................................................................`.........................................4...L....................P..........................................................@...........................................UPX0....................................UPX1..... ..........................@....rsrc...............................@..............................................................................................................................................................................................................................................................................................................................................................3.96.UPX!.$..

                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI45442\_multiprocessing.pyd

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Roaming\empyrean\dat.txt
                                                                                                                                                                                                                                            File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):25984
                                                                                                                                                                                                                                            Entropy (8bit):7.493810835339704
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:768:Gmy6HNbpr+8C6LSf93tePBI7Rt2lYiSyvPPxWEa5Z:d9+8FKR0PBI7Rt2l7SynPxeZ
                                                                                                                                                                                                                                            MD5:0D48797F8115161D1F4F607862C894F8
                                                                                                                                                                                                                                            SHA1:377E116CE713CEF85764A722D83A6E43BDAB30A7
                                                                                                                                                                                                                                            SHA-256:5D5C7C93157A6C483D03FEA46AAD60D91A53D87707D744FA7810134A0E6D2CD9
                                                                                                                                                                                                                                            SHA-512:A61119FDD99A2900AF4CC738BA4BB9ACD7171906F15DDDBCF27CD2D4830EA155BBB590C2B4E9459EA70A17285CCF5649EFACDA81F05B9EF15CE4E4BFA77CD73A
                                                                                                                                                                                                                                            Malicious:true
                                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........$Z*.E4y.E4y.E4y.=.y.E4y.95x.E4y.91x.E4y.90x.E4y.97x.E4yS95x.E4y.E5y.E4y?75x.E4yS99x.E4yS94x.E4yS9.y.E4yS96x.E4yRich.E4y........................PE..d...+..c.........." ...".0..........p.....................................................`.........................................4...`....................`......................................................x...@...........................................UPX0....................................UPX1.....0.......,..................@....rsrc................0..............@..............................................................................................................................................................................................................................................................................................................................................3.96.UPX!.$..

                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI45442\_overlapped.pyd

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Roaming\empyrean\dat.txt
                                                                                                                                                                                                                                            File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):31616
                                                                                                                                                                                                                                            Entropy (8bit):7.5665023159396565
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:768:5k8GDYwKGtevarixdxu3dI7st2bYiSyvxPxWEa:2ETi93dI7st2b7SypPx
                                                                                                                                                                                                                                            MD5:D22D51B9F7E5273373A380B832905832
                                                                                                                                                                                                                                            SHA1:5B96CBD365101AFF5F9FEA55065A015ECFCD9725
                                                                                                                                                                                                                                            SHA-256:A56E339E622E613E0664705988A2166168873CFC9507385BB6F7AC17E0546701
                                                                                                                                                                                                                                            SHA-512:93B3C5031A67F2EC68BF6F12A795CE7DCA87D04D470E7097B47E8C1C2FB246C4D8D56FF4C6EC61D271815EB79FEFAE311A05D135B0B69CEC012D319DBBB4C40B
                                                                                                                                                                                                                                            Malicious:true
                                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........({..F(..F(..F(...(..F(..G)..F(..C)..F(..B)..F(..E)..F(..G)..F(..G(..F(c.G)..F(c.B)..F(..K)..F(..F)..F(...(..F(..D)..F(Rich..F(................PE..d...-..c.........." ...".@................................................................`.........................................x...X...............................................................................@...........................................UPX0....................................UPX1.....@.......@..................@....rsrc................D..............@..............................................................................................................................................................................................................................................................................................................................................3.96.UPX!.$..

                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI45442\_queue.pyd

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Roaming\empyrean\dat.txt
                                                                                                                                                                                                                                            File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):24960
                                                                                                                                                                                                                                            Entropy (8bit):7.453287262532455
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:384:rQpaT/6xXedjhX9CYLxhfcggnUxaVXALAZI77U2NuIYiSy1pCQAqfUvPxh8E9VFX:DSxw19p9uzZI77U2xYiSyvlfUvPxWEl
                                                                                                                                                                                                                                            MD5:0D267BB65918B55839A9400B0FB11AA2
                                                                                                                                                                                                                                            SHA1:54E66A14BEA8AE551AB6F8F48D81560B2ADD1AFC
                                                                                                                                                                                                                                            SHA-256:13EE41980B7D0FB9CE07F8E41EE6A309E69A30BBF5B801942F41CBC357D59E9C
                                                                                                                                                                                                                                            SHA-512:C2375F46A98E44F54E2DD0A5CC5F016098500090BB78DE520DC5E05AEF8E6F11405D8F6964850A03060CAED3628D0A6303091CBA1F28A0AA9B3B814217D71E56
                                                                                                                                                                                                                                            Malicious:true
                                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........._ZF.1.F.1.F.1.O..D.1...0.D.1...4.J.1...5.N.1...2.E.1...0.E.1...0.D.1.F.0...1...<.G.1...1.G.1.....G.1...3.G.1.RichF.1.........PE..d...&..c.........." ...".0..........`.....................................................`.............................................L.......P............`..............<.......................................X...@...........................................UPX0....................................UPX1.....0.......(..................@....rsrc................,..............@..............................................................................................................................................................................................................................................................................................................................................................3.96.UPX!.$..

                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI45442\_socket.pyd

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Roaming\empyrean\dat.txt
                                                                                                                                                                                                                                            File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):42880
                                                                                                                                                                                                                                            Entropy (8bit):7.6996745691481285
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:768:GL7Syo5lzOt+ufVwPVXahccu0D+gFiPnmJsSK0I7QwbmAYiSyvb9ZPxWEl:mkbzcKNGu0yXwbK0I7QwbmA7Syj/Px
                                                                                                                                                                                                                                            MD5:AFD296823375E106C4B1AC8B39927F8B
                                                                                                                                                                                                                                            SHA1:B05D811E5A5921D5B5CC90B9E4763FD63783587B
                                                                                                                                                                                                                                            SHA-256:E423A7C2CE5825DFDD41CFC99C049FF92ABFB2AA394C85D0A9A11DE7F8673007
                                                                                                                                                                                                                                            SHA-512:95E98A24BE9E603B2870B787349E2AA7734014AC088C691063E4078E11A04898C9C547D6998224B1B171FC4802039C3078A28C7E81D59F6497F2F9230D8C9369
                                                                                                                                                                                                                                            Malicious:true
                                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........Z..{4..{4..{4......{4...5..{4...1..{4...0..{4...7..{4.U.5..{4..{5.\{4.9.5..{4.U.9..{4.U.4..{4.U....{4.U.6..{4.Rich.{4.........................PE..d...0..c.........." ...".p..........0m....................................................`.............................................P.......h............ ..l...........X.......................................8y..@...........................................UPX0....................................UPX1.....p.......l..................@....rsrc................p..............@..............................................................................................................................................................................................................................................................................................................................................3.96.UPX!.$..

                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI45442\_sqlite3.pyd

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Roaming\empyrean\dat.txt
                                                                                                                                                                                                                                            File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):50048
                                                                                                                                                                                                                                            Entropy (8bit):7.763546199450955
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:1536:u8Mdv1OCWk0z+q3QCjbouAfI75QrA7SyDPx:hQO00zrrvbgI75QrANx
                                                                                                                                                                                                                                            MD5:7B45AFC909647C373749EF946C67D7CF
                                                                                                                                                                                                                                            SHA1:81F813C1D8C4B6497C01615DCB6AA40B92A7BD20
                                                                                                                                                                                                                                            SHA-256:A5F39BFD2B43799922E303A3490164C882F6E630777A3A0998E89235DC513B5E
                                                                                                                                                                                                                                            SHA-512:FE67E58F30A2C95D7D42A102ED818F4D57BAA524C5C2D781C933DE201028C75084C3E836FF4237E066F3C7DD6A5492933C3DA3FEE76EB2C50A6915996EF6D7FB
                                                                                                                                                                                                                                            Malicious:true
                                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......8..|...|...|...u...z...3...~...3.~.}...3...q...3...t...3..........y.......~...|..........u......}....|.}......}...Rich|...........PE..d...[..c.........." ...".........@..0....P................................................`.............................................P.......4............`..............(.......................................(...@...........................................UPX0.....@..............................UPX1.........P......................@....rsrc...............................@......................................................................................................................................................................................................................................................................................................................................................3.96.UPX!.$..

                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI45442\_ssl.pyd

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Roaming\empyrean\dat.txt
                                                                                                                                                                                                                                            File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):62328
                                                                                                                                                                                                                                            Entropy (8bit):7.850362561913567
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:1536:CedJItp3BP6kGsJMthwMtbyG68sj8I7t7QOC7SycPxu:P8tVBPpGsUt+usYI7t7QT+xu
                                                                                                                                                                                                                                            MD5:1E643C629F993A63045B0FF70D6CF7C6
                                                                                                                                                                                                                                            SHA1:9AF2D22226E57DC16C199CAD002E3BEB6A0A0058
                                                                                                                                                                                                                                            SHA-256:4A50B4B77BF9E5D6F62C7850589B80B4CAA775C81856B0D84CB1A73D397EB38A
                                                                                                                                                                                                                                            SHA-512:9D8CD6E9C03880CC015E87059DB28FF588881679F8E3F5A26A90F13E2C34A5BD03FB7329D9A4E33C4A01209C85A36FC999E77D9ECE42CEBDB738C2F1FD6775AF
                                                                                                                                                                                                                                            Malicious:true
                                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......,z..h.gLh.gLh.gLac.Ln.gL'gfMj.gL'gbMe.gL'gcM`.gL'gdMk.gL.gfMj.gL.afMl.gLh.fL..gL.ifMo.gL.gjMj.gL.ggMi.gL.g.Li.gL.geMi.gLRichh.gL................PE..d...3..c.........." ..."............ .....................................................`.........................................p...d....................P......................................................(...@...........................................UPX0....................................UPX1................................@....rsrc...............................@..............................................................................................................................................................................................................................................................................................................................................3.96.UPX!.$..

                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI45442\_uuid.pyd

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Roaming\empyrean\dat.txt
                                                                                                                                                                                                                                            File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):22400
                                                                                                                                                                                                                                            Entropy (8bit):7.361536802022009
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:384:YbjUslT24o0uNnUxaVXALkpiI7ewWYcIYiSy1pCQDMaPxh8E9VF0Nyvzo:6j3lKNfpiI7ewWQYiSyvfPxWEx
                                                                                                                                                                                                                                            MD5:81DFA68CA3CB20CED73316DBC78423F6
                                                                                                                                                                                                                                            SHA1:8841CF22938AA6EE373FF770716BB9C6D9BC3E26
                                                                                                                                                                                                                                            SHA-256:D0CB6DD98A2C9D4134C6EC74E521BAD734BC722D6A3B4722428BF79E7B66F190
                                                                                                                                                                                                                                            SHA-512:E24288AE627488251682CD47C1884F2DC5F4CD834D7959B9881E5739C42D91FD0A30E75F0DE77F5B5A0D63D9BAEBCAFA56851E7E40812DF367FD433421C0CCDB
                                                                                                                                                                                                                                            Malicious:true
                                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........;$p^ZJ#^ZJ#^ZJ#W".#\ZJ#.&K"\ZJ#.&O"RZJ#.&N"VZJ#.&I"]ZJ#.&K"\ZJ#.(K"[ZJ#^ZK#tZJ#.&B"_ZJ#.&J"_ZJ#.&.#_ZJ#.&H"_ZJ#Rich^ZJ#................PE..d...+..c.........." ...". .......`.......p................................................`.........................................8...L....................@......................................................x...@...........................................UPX0.....`..............................UPX1..... ...p......................@....rsrc................"..............@......................................................................................................................................................................................................................................................................................................................................................3.96.UPX!.$..

                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI45442\_win32sysloader.pyd

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Roaming\empyrean\dat.txt
                                                                                                                                                                                                                                            File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):11776
                                                                                                                                                                                                                                            Entropy (8bit):6.772611075994812
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:192:lpadimkU6KnFt4Zdcpbd8m5OonxCe4W7Oj5aLRkyUxaVXFaL2cxa/UQ0D:C4KFtycpbd8EOonxCeZOFaLRnUxaVXAt
                                                                                                                                                                                                                                            MD5:CA5D703BECCFFFB4CEF13729E56DE725
                                                                                                                                                                                                                                            SHA1:F5AEB8D98D4FEDE04F3EF76A8C2E3A6AC5CE1C64
                                                                                                                                                                                                                                            SHA-256:3113117C0B67CD9532053ADEE0D87A83B32E9EEC4101BEA437EE3AB3F6D1D6A2
                                                                                                                                                                                                                                            SHA-512:BED0F5490DA5593C7C94C9F292B5FB2698A6040A8F4FB1151709BED3E450D55E8D74F9B558EEB0893EA89BF01B05A5DF714B67CFC2B419A52E0C2C00BB2A16AA
                                                                                                                                                                                                                                            Malicious:true
                                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......tSf.02..02..02..9J..22..bG..22..$Y..22..bG..;2..bG..82..bG..32..[..32..02...2...G..12...G..12...G..12..Rich02..................PE..d......d.........." .....0.......... .....................................................`.............................................`...x...P.......x....`..............(...........................................8...........................................UPX0....................................UPX1.....0.......$..................@....rsrc................(..............@..............................................................................................................................................................................................................................................................................................................................................................3.96.UPX!.$..

                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI45442\aiohttp\_helpers.cp310-win_amd64.pyd

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Roaming\empyrean\dat.txt
                                                                                                                                                                                                                                            File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):26112
                                                                                                                                                                                                                                            Entropy (8bit):7.670706649814581
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:768:HAgts4wZXjNKzfSpVzDaDywUIHruBnZ356:HxtJijNppVdIL6X6
                                                                                                                                                                                                                                            MD5:D76A7F9B8481AEE6DB8555A88F3EEE13
                                                                                                                                                                                                                                            SHA1:A50C77A84B8FCBC393F91244CBC8FE98D7FDE74C
                                                                                                                                                                                                                                            SHA-256:1EF0FDCB5EFE630D7674AE83D9BF82DAEE980BA5F3C6ACB76F148FFE2148C008
                                                                                                                                                                                                                                            SHA-512:502C6AC9DB73C852ABFFA59B74243D646AD005F94DEF2B7DCA2E441C74FBA3D1F3955EF0C11D2FC19A47B2D705128AC0F84D68C725129C53F72D5C3CCF5287E3
                                                                                                                                                                                                                                            Malicious:true
                                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........oB[..,...,...,..v....,...-...,..v-...,.../...,...(...,...)...,.f{-...,...-...,..$...,..,...,......,......,.Rich..,.........................PE..d....A.g.........." ...).`..........0?.......................................`............`.........................................@R..`....P..P....P.......................R......................................(K..@...........................................UPX0....................................UPX1.....`.......^..................@....rsrc........P.......b..............@..............................................................................................................................................................................................................................................................................................................................................3.96.UPX!.$..

                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI45442\aiohttp\_http_parser.cp310-win_amd64.pyd

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Roaming\empyrean\dat.txt
                                                                                                                                                                                                                                            File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):82944
                                                                                                                                                                                                                                            Entropy (8bit):7.949991955133753
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:1536:7DJzqoj6kwZ0YWPXwlnsYUdjecK7UBopf3YcjRNt3WMdaNvalbgEM9xI:7DYoj6k/YKgtsYuw7UB4YQRpa
                                                                                                                                                                                                                                            MD5:858F1D3F9D32C1E6A35C8C5C81E5A5E8
                                                                                                                                                                                                                                            SHA1:4A2AF60C0DB12ADB12AFE781F9FC9675D11D1B9E
                                                                                                                                                                                                                                            SHA-256:8A26BCFBD4797E6713BE6F5E5ABDA60747BBD6C9CF58B983CD79AB86A990275C
                                                                                                                                                                                                                                            SHA-512:EC5EE5A38A2240913673535A95E1CB329BE1E835B1F1C7F68B153513DB152F70029204E118397D7A215F05025D851137EF971C83E3D7BE093C9D682311DCF03F
                                                                                                                                                                                                                                            Malicious:true
                                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........9...WR..WR..WR...R..WR.kVS..WR.VS..WRj.VS..WR..VRF.WR.kTS..WR.kSS..WR.kRS..WR.j_S..WR.jWS..WR.j.R..WR.jUS..WRRich..WR........................PE..d....A.g.........." ...).@.......p.. .....................................................`..................................................................@..............\...........................................@...........................................UPX0.....p..............................UPX1.....@.......8..................@....rsrc................<..............@..............................................................................................................................................................................................................................................................................................................................................3.96.UPX!.$..

                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI45442\aiohttp\_http_writer.cp310-win_amd64.pyd

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Roaming\empyrean\dat.txt
                                                                                                                                                                                                                                            File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):25088
                                                                                                                                                                                                                                            Entropy (8bit):7.716205811403458
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:768:agf7VnuWhwjmpHKTjQ6j0+l123fPA/f9:agf7VnWUHKTjjmvI/V
                                                                                                                                                                                                                                            MD5:305F44C62CF1E39AD97CEFE02D16E52D
                                                                                                                                                                                                                                            SHA1:77F2FD9A86702DDF56813EEDCC7D26E014AA7E28
                                                                                                                                                                                                                                            SHA-256:9A156861ED877D905D4CF1F1BCC45BA0C4B33AE961138B75B817018454C8BBF7
                                                                                                                                                                                                                                            SHA-512:30E485D6802F572F8D7F5E49DA17059E041850B2B9CF3FDAB99F4B097A2A15F99EFF5113C60CDAAC0338C8C56EBCBAFB5A309293786CD9085BAB8E526FAFC73B
                                                                                                                                                                                                                                            Malicious:true
                                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........o.T.............v?..............v..............................b{..........4................S...........Rich....................PE..d....A.g.........." ...).`...........l... ................................................`.........................................@...h.......P............ ..0....................................................x..@...........................................UPX0....................................UPX1.....`... ...Z..................@....rsrc................^..............@......................................................................................................................................................................................................................................................................................................................................................3.96.UPX!.$..

                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI45442\aiohttp\_websocket.cp310-win_amd64.pyd

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Roaming\empyrean\dat.txt
                                                                                                                                                                                                                                            File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):20480
                                                                                                                                                                                                                                            Entropy (8bit):7.543311887865824
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:384:alZn4Hp1CV3K/CqTERpJz08tWrPPBE0nUxaVXALeD:alF0X/CqTCJzGV
                                                                                                                                                                                                                                            MD5:3EE2A9C44E8E057107B6DA68572451E9
                                                                                                                                                                                                                                            SHA1:BE80779B8BB447F40E80A526DAEFA1028738422A
                                                                                                                                                                                                                                            SHA-256:95ADAEC9FE8FE1EAD0B7199298D813FC8A01052D9868D5633BAA89E6F59A5E61
                                                                                                                                                                                                                                            SHA-512:249CB0F40307968055994AE49776DACCF38B0E42955F2DE4F0E14F788A96C69115F25AF05549D9E27F99632592E4C8E39CA44DA9F49A9BBDA6ADFC246320AC53
                                                                                                                                                                                                                                            Malicious:true
                                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........oB[..,...,...,..v....,...-...,..v-...,.../...,...(...,...)...,.f{-...,...-.%.,..$...,..,...,......,......,.Rich..,.........................PE..d....A.g.........." ...).P..........p.....................................................`.........................................@...d.......P...............4...................................................h...@...........................................UPX0....................................UPX1.....P.......H..................@....rsrc................L..............@..............................................................................................................................................................................................................................................................................................................................................3.96.UPX!.$..

                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI45442\altgraph-0.17.4.dist-info\INSTALLER

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Roaming\empyrean\dat.txt
                                                                                                                                                                                                                                            File Type:ASCII text
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):4
                                                                                                                                                                                                                                            Entropy (8bit):1.5
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:3:Mn:M
                                                                                                                                                                                                                                            MD5:365C9BFEB7D89244F2CE01C1DE44CB85
                                                                                                                                                                                                                                            SHA1:D7A03141D5D6B1E88B6B59EF08B6681DF212C599
                                                                                                                                                                                                                                            SHA-256:CEEBAE7B8927A3227E5303CF5E0F1F7B34BB542AD7250AC03FBCDE36EC2F1508
                                                                                                                                                                                                                                            SHA-512:D220D322A4053D84130567D626A9F7BB2FB8F0B854DA1621F001826DC61B0ED6D3F91793627E6F0AC2AC27AEA2B986B6A7A63427F05FE004D8A2ADFBDADC13C1
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:pip.

                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI45442\altgraph-0.17.4.dist-info\LICENSE

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Roaming\empyrean\dat.txt
                                                                                                                                                                                                                                            File Type:ASCII text
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):1002
                                                                                                                                                                                                                                            Entropy (8bit):5.178870450986544
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:24:wy+rmJHcwH0MP3gt99QHOsUv4eOk4/+/m3oqMSFJ:9+aJ8YHvEnQHOs5exm3oEFJ
                                                                                                                                                                                                                                            MD5:3590EB8D695BDCEA3BA57E74ADF8A4ED
                                                                                                                                                                                                                                            SHA1:5B3C3863D521CF35E75E36A22E5EC4A80C93C528
                                                                                                                                                                                                                                            SHA-256:6C194D6DB0C64D45535D10C95142B9B0CDA7B7DCC7F1DDEE302B3D536F3DBE46
                                                                                                                                                                                                                                            SHA-512:405E4F136E282352DF9FC60C2CE126E26A344DD63F92AAB0E77DE60694BD155A13CF41C13E88C00FB95032A90526AD32C9E4B7D53CA352E03C3882ED648821F0
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:Copyright (c) 2004 Istvan Albert unless otherwise noted..Copyright (c) 2006-2010 Bob Ippolito.Copyright (2) 2010-2020 Ronald Oussoren, et. al...Permission is hereby granted, free of charge, to any person obtaining a copy.of this software and associated documentation files (the "Software"), to.deal in the Software without restriction, including without limitation the.rights to use, copy, modify, merge, publish, distribute, sublicense,.and/or sell copies of the Software, and to permit persons to whom the.Software is furnished to do so...THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR.IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,.FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE.AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER.LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING.FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS.IN THE SOFTWARE

                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI45442\altgraph-0.17.4.dist-info\METADATA

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Roaming\empyrean\dat.txt
                                                                                                                                                                                                                                            File Type:ASCII text
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):7264
                                                                                                                                                                                                                                            Entropy (8bit):4.9335139350342505
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:96:D4lWAqZjaaYxmPktjas13ieOGZND9REZ4y+KezAYx09zB5KENViyh5YZXc9Me6WW:QqW8GZNjiui9KUQHDyKtZx
                                                                                                                                                                                                                                            MD5:22177E21CADF554A961F1EB13DA4CEAF
                                                                                                                                                                                                                                            SHA1:35610F8C8AE735AC6A03C7556B55170248748D6B
                                                                                                                                                                                                                                            SHA-256:691116CB60E4B1DD5554077804932FD0290357120FC9921F03D27664526B1295
                                                                                                                                                                                                                                            SHA-512:A213C826D1B84BD7207BB6FA652B2F618D27B05ABC9F308086D704FD6A5D4A26BE75522786EC77C650AB52D35D2B34A6096BCBD9553D8C7AC1372EE4B59F72B3
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:Metadata-Version: 2.1.Name: altgraph.Version: 0.17.4.Summary: Python graph (network) package.Home-page: https://altgraph.readthedocs.io.Download-URL: http://pypi.python.org/pypi/altgraph.Author: Ronald Oussoren.Author-email: ronaldoussoren@mac.com.Maintainer: Ronald Oussoren.Maintainer-email: ronaldoussoren@mac.com.License: MIT.Keywords: graph.Platform: any.Classifier: Intended Audience :: Developers.Classifier: License :: OSI Approved :: MIT License.Classifier: Programming Language :: Python.Classifier: Programming Language :: Python :: 2.Classifier: Programming Language :: Python :: 2.7.Classifier: Programming Language :: Python :: 3.Classifier: Programming Language :: Python :: 3.4.Classifier: Programming Language :: Python :: 3.5.Classifier: Programming Language :: Python :: 3.6.Classifier: Programming Language :: Python :: 3.7.Classifier: Programming Language :: Python :: 3.8.Classifier: Programming Language :: Python :: 3.9.Classifier: Programming Language :: Python :: 3.10.Class

                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI45442\altgraph-0.17.4.dist-info\RECORD

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Roaming\empyrean\dat.txt
                                                                                                                                                                                                                                            File Type:CSV text
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):1466
                                                                                                                                                                                                                                            Entropy (8bit):5.80543063460573
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:24:Hzn/2zDiTzv5MIzZOTzHz4BsXWzlrIhikTz39+SWUz4EUbR4w1+4V1LkzcRG2lkx:HznuXiTzyIzYTzHz4TzlriHTz39+7I4a
                                                                                                                                                                                                                                            MD5:8F6CAAF90B4C653279EFD81CCFFFF5E3
                                                                                                                                                                                                                                            SHA1:A95049B0512A670C609D9FF2AD68CBDC62712BCA
                                                                                                                                                                                                                                            SHA-256:2D8DCE3D5542EC6ABA57299511AE6BD61EBD4789C52AE67715E219B616CC356C
                                                                                                                                                                                                                                            SHA-512:304185EE1A09C94D73C1D2D98FA5694F7BE2E5475111EE03C491FAC79F3C888D4E63C2D564B7611C339A9589A7B26E4D67E8638A887257EDB61864E20958E2B3
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:altgraph-0.17.4.dist-info/INSTALLER,sha256=zuuue4knoyJ-UwPPXg8fezS7VCrXJQrAP7zeNuwvFQg,4..altgraph-0.17.4.dist-info/LICENSE,sha256=bBlNbbDGTUVTXRDJUUK5sM2nt9zH8d3uMCs9U289vkY,1002..altgraph-0.17.4.dist-info/METADATA,sha256=aREWy2Dksd1VVAd4BJMv0CkDVxIPyZIfA9J2ZFJrEpU,7264..altgraph-0.17.4.dist-info/RECORD,,..altgraph-0.17.4.dist-info/WHEEL,sha256=a-zpFRIJzOq5QfuhBzbhiA1eHTzNCJn8OdRvhdNX0Rk,110..altgraph-0.17.4.dist-info/top_level.txt,sha256=HEBeRWf5ItVPc7Y9hW7hGlrLXZjPoL4by6CAhBV_BwA,9..altgraph-0.17.4.dist-info/zip-safe,sha256=AbpHGcgLb-kRsJGnwFEktk7uzpZOCcBY74-YBdrKVGs,1..altgraph/Dot.py,sha256=gKEp6Su_CoOWQYt5HIVs_7MBYK1BEOhKX0RLAAA-vQs,9929..altgraph/Graph.py,sha256=6b6fSHLA5QSqMDnSHIO7_WJnBYIdq3K5Bt8VipRODwg,20788..altgraph/GraphAlgo.py,sha256=Uu9aTjSKWi38iQ_e9ZrwCnzQaI1WWFDhJ6kfmu0jxAA,5645..altgraph/GraphStat.py,sha256=LKya4BKXJ5GZi5-sNYU17aOBTLxqn_tVgbiw4sWGYIU,1888..altgraph/GraphUtil.py,sha256=1T4DJc2bJn6EIU_Ct4m0oiKlXWkXvqcXE8CGL2K9en8,3990..altgraph/ObjectGraph.py,sha256=o7f

                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI45442\altgraph-0.17.4.dist-info\WHEEL

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Roaming\empyrean\dat.txt
                                                                                                                                                                                                                                            File Type:ASCII text
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):110
                                                                                                                                                                                                                                            Entropy (8bit):4.798786725303218
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:3:RtEeX7MWcSlVlhVMSgP+tPCCf7irO5S:RtBMwlVSZWBBwt
                                                                                                                                                                                                                                            MD5:F1EFFD0B429F462BD08132474A8B4FA6
                                                                                                                                                                                                                                            SHA1:A9D3050AF622BDA1BD73C00DC377625FF44D2559
                                                                                                                                                                                                                                            SHA-256:6BECE9151209CCEAB941FBA10736E1880D5E1D3CCD0899FC39D46F85D357D119
                                                                                                                                                                                                                                            SHA-512:EF7D53063CFCB54155F4C700C9E99ADBA9BF6085296B8CF1E3AB86767B7C96D1A4EBF4F6B19D4942DA7F6CBC0AC25DFEA8EAE4CE461B1701CB1ACF9B2B68BB6D
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:Wheel-Version: 1.0.Generator: bdist_wheel (0.40.0).Root-Is-Purelib: true.Tag: py2-none-any.Tag: py3-none-any..

                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI45442\altgraph-0.17.4.dist-info\top_level.txt

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Roaming\empyrean\dat.txt
                                                                                                                                                                                                                                            File Type:ASCII text
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):9
                                                                                                                                                                                                                                            Entropy (8bit):2.94770277922009
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:3:gRUEv:gee
                                                                                                                                                                                                                                            MD5:BEB0CA64AA7DD6722F65930793F447D5
                                                                                                                                                                                                                                            SHA1:9BBA1BCE17FB25BDC9E6AA7AD8077999422EFD86
                                                                                                                                                                                                                                            SHA-256:1C405E4567F922D54F73B63D856EE11A5ACB5D98CFA0BE1BCBA08084157F0700
                                                                                                                                                                                                                                            SHA-512:BC4C40BCC527A9E40A934B6B594278A89625C9142795582C223E227A2D6ECCEB3233F10AA790E87D44171207AC0FEAC09581BD63C71937F97BB8F07E8CC88F30
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:altgraph.

                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI45442\altgraph-0.17.4.dist-info\zip-safe

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Roaming\empyrean\dat.txt
                                                                                                                                                                                                                                            File Type:very short file (no magic)
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):1
                                                                                                                                                                                                                                            Entropy (8bit):0.0
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:3:v:v
                                                                                                                                                                                                                                            MD5:68B329DA9893E34099C7D8AD5CB9C940
                                                                                                                                                                                                                                            SHA1:ADC83B19E793491B1C6EA0FD8B46CD9F32E592FC
                                                                                                                                                                                                                                            SHA-256:01BA4719C80B6FE911B091A7C05124B64EEECE964E09C058EF8F9805DACA546B
                                                                                                                                                                                                                                            SHA-512:BE688838CA8686E5C90689BF2AB585CEF1137C999B48C70B92F67A5C34DC15697B5D11C982ED6D71BE1E1E7F7B4E0733884AA97C3F7A339A8ED03577CF74BE09
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:.

                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI45442\attrs-23.1.0.dist-info\INSTALLER

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Roaming\empyrean\dat.txt
                                                                                                                                                                                                                                            File Type:ASCII text
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):4
                                                                                                                                                                                                                                            Entropy (8bit):1.5
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:3:Mn:M
                                                                                                                                                                                                                                            MD5:365C9BFEB7D89244F2CE01C1DE44CB85
                                                                                                                                                                                                                                            SHA1:D7A03141D5D6B1E88B6B59EF08B6681DF212C599
                                                                                                                                                                                                                                            SHA-256:CEEBAE7B8927A3227E5303CF5E0F1F7B34BB542AD7250AC03FBCDE36EC2F1508
                                                                                                                                                                                                                                            SHA-512:D220D322A4053D84130567D626A9F7BB2FB8F0B854DA1621F001826DC61B0ED6D3F91793627E6F0AC2AC27AEA2B986B6A7A63427F05FE004D8A2ADFBDADC13C1
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:pip.

                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI45442\attrs-23.1.0.dist-info\METADATA

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Roaming\empyrean\dat.txt
                                                                                                                                                                                                                                            File Type:HTML document, Unicode text, UTF-8 text
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):11348
                                                                                                                                                                                                                                            Entropy (8bit):5.155260943272538
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:192:j/sUYExPRtXLt5Yy9EqOmoKTioEJdQ/0GmlWEx+VqAI6OfmEIPSo9t+kwLaH:j/sW6y9EqHoKvgAml9rqOnQLy8
                                                                                                                                                                                                                                            MD5:7774D77D730C0C295CB6E3E46817DAD6
                                                                                                                                                                                                                                            SHA1:406B5C84945B8DC1035BD53EB33F289B9AE699FC
                                                                                                                                                                                                                                            SHA-256:CA0970517928EF943E209E8B98F550E18F7D2894B708F2B4356F28BD7158B038
                                                                                                                                                                                                                                            SHA-512:6E991F3144CCA536E906A180DA7FAF3198521C81EFF4143FB943ECC6C6FAA558D0B1F2AA1379A7294BAA039D67202C671027D12C821D95B859EC25E0F78C2C21
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:Metadata-Version: 2.1.Name: attrs.Version: 23.1.0.Summary: Classes Without Boilerplate.Project-URL: Documentation, https://www.attrs.org/.Project-URL: Changelog, https://www.attrs.org/en/stable/changelog.html.Project-URL: Bug Tracker, https://github.com/python-attrs/attrs/issues.Project-URL: Source Code, https://github.com/python-attrs/attrs.Project-URL: Funding, https://github.com/sponsors/hynek.Project-URL: Tidelift, https://tidelift.com/subscription/pkg/pypi-attrs?utm_source=pypi-attrs&utm_medium=pypi.Author-email: Hynek Schlawack <hs@ox.cx>.License-Expression: MIT.License-File: LICENSE.Keywords: attribute,boilerplate,class.Classifier: Development Status :: 5 - Production/Stable.Classifier: Intended Audience :: Developers.Classifier: License :: OSI Approved :: MIT License.Classifier: Programming Language :: Python :: 3.7.Classifier: Programming Language :: Python :: 3.8.Classifier: Programming Language :: Python :: 3.9.Classifier: Programming Language :: Python :: 3.10.Classifier: P

                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI45442\attrs-23.1.0.dist-info\RECORD

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Roaming\empyrean\dat.txt
                                                                                                                                                                                                                                            File Type:CSV text
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):3642
                                                                                                                                                                                                                                            Entropy (8bit):5.807416853955938
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:96:QalxI0guUoqipQEqdwBxTGNmmUuAqG2PX2rUXjiFcoqL/+Q:zaUoUTGwnuA2XE9Q
                                                                                                                                                                                                                                            MD5:A3AD7B8CDA8539786366BBBEC93D29AD
                                                                                                                                                                                                                                            SHA1:D79FE6C3773C0E56AB64F6288B2CEF36BACC10A6
                                                                                                                                                                                                                                            SHA-256:0C4D6F02B4FECD5A3A81D45A6D684D38998F2A8DAB51490548A27D85A5377299
                                                                                                                                                                                                                                            SHA-512:03A7FBF8AE5FB6C4BAD790EDC6C3479BB604FB7E3F8CCCCB96FE7A8EF45DCEB1BCF12415D51437C5048AA01183A3CD0E55D5A64FA1E7B22D7DAB8031822ED77B
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:attr/__init__.py,sha256=dSRUBxRVTh-dXMrMR_oQ3ZISu2QSfhSZlik03Mjbu30,3241..attr/__init__.pyi,sha256=rIK-2IakIoehVtqXK5l5rs9_fJNCbnYtKTS3cOAVJD8,17609..attr/__pycache__/__init__.cpython-310.pyc,,..attr/__pycache__/_cmp.cpython-310.pyc,,..attr/__pycache__/_compat.cpython-310.pyc,,..attr/__pycache__/_config.cpython-310.pyc,,..attr/__pycache__/_funcs.cpython-310.pyc,,..attr/__pycache__/_make.cpython-310.pyc,,..attr/__pycache__/_next_gen.cpython-310.pyc,,..attr/__pycache__/_version_info.cpython-310.pyc,,..attr/__pycache__/converters.cpython-310.pyc,,..attr/__pycache__/exceptions.cpython-310.pyc,,..attr/__pycache__/filters.cpython-310.pyc,,..attr/__pycache__/setters.cpython-310.pyc,,..attr/__pycache__/validators.cpython-310.pyc,,..attr/_cmp.py,sha256=diMUQV-BIg7IjIb6-o1hswtnjrR4qdAUz_tE8gxS96w,4098..attr/_cmp.pyi,sha256=sGQmOM0w3_K4-X8cTXR7g0Hqr290E8PTObA9JQxWQqc,399..attr/_compat.py,sha256=d3cpIu60IbKrLywPni17RUEQY7MvkqqKifyzJ5H3zRU,5803..attr/_config.py,sha256=5W8lgRePuIOWu1ZuqF1899e2CmXGc9

                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI45442\attrs-23.1.0.dist-info\WHEEL

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Roaming\empyrean\dat.txt
                                                                                                                                                                                                                                            File Type:ASCII text
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):87
                                                                                                                                                                                                                                            Entropy (8bit):4.699003560068366
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:3:RtEeXAaCQnvxP+tPCCfA5I:Rt2PQZWBB3
                                                                                                                                                                                                                                            MD5:14CCD3CE79ED5ED7DAD2420CD7C0D412
                                                                                                                                                                                                                                            SHA1:388B959646735E0095900E61F3AF8A90F594F0A3
                                                                                                                                                                                                                                            SHA-256:108D89B06C9DC142F918FF6DEA4CD9BFB1B71C33E2EC5B990C37FD227E9A9913
                                                                                                                                                                                                                                            SHA-512:6EA1321D7F62E8284C3C5B29A3D7940890A4488503832457BF6580108351C0B2A0EE871928561DFF7F71C9BA9D1B89B2D93C1C5839EEC4815032E89E670934B4
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:Wheel-Version: 1.0.Generator: hatchling 1.14.0.Root-Is-Purelib: true.Tag: py3-none-any.

                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI45442\attrs-23.1.0.dist-info\licenses\LICENSE

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Roaming\empyrean\dat.txt
                                                                                                                                                                                                                                            File Type:ASCII text
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):1109
                                                                                                                                                                                                                                            Entropy (8bit):5.104415762129373
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:24:bGf8rUrmJHHH0yN3gtsHw1hC09QHOsUv4eOk4/+/m3oqLFh:bW8rUaJHlxE3dQHOs5exm3ogFh
                                                                                                                                                                                                                                            MD5:5E55731824CF9205CFABEAB9A0600887
                                                                                                                                                                                                                                            SHA1:243E9DD038D3D68C67D42C0C4BA80622C2A56246
                                                                                                                                                                                                                                            SHA-256:882115C95DFC2AF1EEB6714F8EC6D5CBCABF667CAFF8729F42420DA63F714E9F
                                                                                                                                                                                                                                            SHA-512:21B242BF6DCBAFA16336D77A40E69685D7E64A43CC30E13E484C72A93CD4496A7276E18137DC601B6A8C3C193CB775DB89853ECC6D6EB2956DEEE36826D5EBFE
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:The MIT License (MIT)..Copyright (c) 2015 Hynek Schlawack and the attrs contributors..Permission is hereby granted, free of charge, to any person obtaining a copy.of this software and associated documentation files (the "Software"), to deal.in the Software without restriction, including without limitation the rights.to use, copy, modify, merge, publish, distribute, sublicense, and/or sell.copies of the Software, and to permit persons to whom the Software is.furnished to do so, subject to the following conditions:..The above copyright notice and this permission notice shall be included in all.copies or substantial portions of the Software...THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR.IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,.FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE.AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER.LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHE

                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI45442\base_library.zip

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Roaming\empyrean\dat.txt
                                                                                                                                                                                                                                            File Type:Zip archive data, at least v2.0 to extract, compression method=store
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):831920
                                                                                                                                                                                                                                            Entropy (8bit):5.700113193168901
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:12288:9gYJuVvEWSxVqF8MgFA4a2YCdXVwxjfpEreiSRMN7:9gYJz1x3La2xVwxjfpErefMN7
                                                                                                                                                                                                                                            MD5:524A85217DC9EDC8C9EFC73159CA955D
                                                                                                                                                                                                                                            SHA1:A4238CBDE50443262D00A843FFE814435FB0F4E2
                                                                                                                                                                                                                                            SHA-256:808549964ADB09AFAFB410CDC030DF4813C5C2A7276A94E7F116103AF5DE7621
                                                                                                                                                                                                                                            SHA-512:F5A929B35A63F073BDC7600155BA2F0F262E6F60CF67EFB38FA44E8B3BE085CF1D5741D66D25A1ECAAF3F94ABFE9BBE97D135F8A47C11F2B811D2AAC6876F46C
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:PK..........!...`.5...5......._collections_abc.pyco........%.A........................@.......d.Z.d.d.l.m.Z.m.Z...d.d.l.Z.e.e.e.....Z.e.d...Z.d.d...Z.e.e...Z.[.g.d...Z.d.Z.e.e.d.....Z.e.e.e.......Z.e.e.i.........Z.e.e.i.........Z.e.e.i.........Z.e.e.g.....Z.e.e.e.g.......Z.e.e.e.d.......Z.e.e.e.d.d.>.......Z.e.e.e.......Z.e.e.d.....Z e.e.d.....Z!e.e.e"......Z#e.i.......Z$e.i.......Z%e.i.......Z&e.e.j'..Z(e.d.d.......Z)d.d...Z*e*..Z*e.e*..Z+e*.,....[*d.d...Z-e-..Z-e.e-..Z.[-d.d...Z/G.d.d...d.e.d...Z0G.d.d...d.e.d...Z1G.d.d...d.e1..Z2e2.3e+....G.d.d...d.e.d...Z4G.d.d ..d e4..Z5G.d!d"..d"e5..Z6e6.3e.....G.d#d$..d$e.d...Z7G.d%d&..d&e7..Z8e8.3e.....e8.3e.....e8.3e.....e8.3e.....e8.3e.....e8.3e.....e8.3e.....e8.3e.....e8.3e.....e8.3e.....e8.3e ....e8.3e!....e8.3e#....G.d'd(..d(e7..Z9G.d)d*..d*e8..Z:e:.3e)....G.d+d,..d,e.d...Z;G.d-d...d.e.d...Z<G.d/d0..d0e;e7e<..Z=G.d1d2..d2e...Z>d3d4..Z?d5d6..Z@d7d8..ZAG.d9d:..d:e.d...ZBG.d;d<..d<e=..ZCeC.3eD....G.d=d>..d>eC..ZEeE.3e.....G.d?d@..d@e=..ZFeF

                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI45442\certifi\cacert.pem

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Roaming\empyrean\dat.txt
                                                                                                                                                                                                                                            File Type:ASCII text
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):299427
                                                                                                                                                                                                                                            Entropy (8bit):6.047872935262006
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:6144:QW1x/M8fRR1jplkXURrVADwYCuCigT/QRSRqNb7d8iu5Nahx:QWb/TRJLWURrI5RWavdF08/
                                                                                                                                                                                                                                            MD5:50EA156B773E8803F6C1FE712F746CBA
                                                                                                                                                                                                                                            SHA1:2C68212E96605210EDDF740291862BDF59398AEF
                                                                                                                                                                                                                                            SHA-256:94EDEB66E91774FCAE93A05650914E29096259A5C7E871A1F65D461AB5201B47
                                                                                                                                                                                                                                            SHA-512:01ED2E7177A99E6CB3FBEF815321B6FA036AD14A3F93499F2CB5B0DAE5B713FD2E6955AA05F6BDA11D80E9E0275040005E5B7D616959B28EFC62ABB43A3238F0
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:.# Issuer: CN=GlobalSign Root CA O=GlobalSign nv-sa OU=Root CA.# Subject: CN=GlobalSign Root CA O=GlobalSign nv-sa OU=Root CA.# Label: "GlobalSign Root CA".# Serial: 4835703278459707669005204.# MD5 Fingerprint: 3e:45:52:15:09:51:92:e1:b7:5d:37:9f:b1:87:29:8a.# SHA1 Fingerprint: b1:bc:96:8b:d4:f4:9d:62:2a:a8:9a:81:f2:15:01:52:a4:1d:82:9c.# SHA256 Fingerprint: eb:d4:10:40:e4:bb:3e:c7:42:c9:e3:81:d3:1e:f2:a4:1a:48:b6:68:5c:96:e7:ce:f3:c1:df:6c:d4:33:1c:99.-----BEGIN CERTIFICATE-----.MIIDdTCCAl2gAwIBAgILBAAAAAABFUtaw5QwDQYJKoZIhvcNAQEFBQAwVzELMAkG.A1UEBhMCQkUxGTAXBgNVBAoTEEdsb2JhbFNpZ24gbnYtc2ExEDAOBgNVBAsTB1Jv.b3QgQ0ExGzAZBgNVBAMTEkdsb2JhbFNpZ24gUm9vdCBDQTAeFw05ODA5MDExMjAw.MDBaFw0yODAxMjgxMjAwMDBaMFcxCzAJBgNVBAYTAkJFMRkwFwYDVQQKExBHbG9i.YWxTaWduIG52LXNhMRAwDgYDVQQLEwdSb290IENBMRswGQYDVQQDExJHbG9iYWxT.aWduIFJvb3QgQ0EwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDaDuaZ.jc6j40+Kfvvxi4Mla+pIH/EqsLmVEQS98GPR4mdmzxzdzxtIK+6NiY6arymAZavp.xy0Sy6scTHAHoT0KMM0VjU/43dSMUBUc71DuxC73/OlS8pF94G3VNTCOXkNz

                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI45442\charset_normalizer\md.cp310-win_amd64.pyd

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Roaming\empyrean\dat.txt
                                                                                                                                                                                                                                            File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):9728
                                                                                                                                                                                                                                            Entropy (8bit):6.7152932063633255
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:192:vf0YFowZibj4wNg2ne15sZ7aaucmkyUxaVXFaLuH2iX:vN+wZiPg2eQoXcmnUxaVXALXi
                                                                                                                                                                                                                                            MD5:AC03714161DA507E824756742A877DA9
                                                                                                                                                                                                                                            SHA1:702DBD2296CA50F6502BC5AAC5B826B63CF9E200
                                                                                                                                                                                                                                            SHA-256:CAFC9C2BEFC85AF6CC0F9CF0FA7681BAE89C9ACF511CADC39A0CEE77D174B2C2
                                                                                                                                                                                                                                            SHA-512:6B773B2F31512211A0944391733B77F25EF720D07A4057AB8432941950403FACED50C8BC3166B36F648E6394BDF0D9943CCD81E689622558719DFE782C59BB2C
                                                                                                                                                                                                                                            Malicious:true
                                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$....................X...................................^............................4...........Rich....................PE..d...c#.g.........." ...). .......p........................................................`.........................................@...p......P............@..........................................................@...........................................UPX0.....p..............................UPX1..... ..........................@....rsrc................"..............@......................................................................................................................................................................................................................................................................................................................................................3.96.UPX!.$..

                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI45442\charset_normalizer\md__mypyc.cp310-win_amd64.pyd

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Roaming\empyrean\dat.txt
                                                                                                                                                                                                                                            File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):40448
                                                                                                                                                                                                                                            Entropy (8bit):7.852971014132377
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:768:lwMuNrL6Rm1CUja3BN0ep4U0Kv8WCpg1gkkX+vv5uwgSz:lJuNrLoeab3OW62XwPk
                                                                                                                                                                                                                                            MD5:150731368D678F5B2F9EA8CB1A966B8A
                                                                                                                                                                                                                                            SHA1:8263055AEE278B6724E30AFF7BD4BD471BB1C904
                                                                                                                                                                                                                                            SHA-256:08BBCCF9BE3982BBB356E5DF1E6FDDAA94BB5F12B765BCA7BD5701C86141F814
                                                                                                                                                                                                                                            SHA-512:A5E984F9995E13FEFD8A1750B8FEF7670CFEF11FF019880AF06D4DFF453416B43E077084F529E37FC24F4A70C1951CFC101F2611D7C860924BBF2922A98027A8
                                                                                                                                                                                                                                            Malicious:true
                                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........VyR.7...7...7...O...7.......7...O...7.......7.......7.......7..JB...7...7..b7......7......7......7......7..Rich.7..........PE..d...b#.g.........." ...).............H.......................................p............`..........................................b..d....`.......`......................<c.......................................T..@...........................................UPX0....................................UPX1................................@....rsrc........`......................@..............................................................................................................................................................................................................................................................................................................................................................3.96.UPX!.$..

                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI45442\frozenlist\_frozenlist.cp310-win_amd64.pyd

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Roaming\empyrean\dat.txt
                                                                                                                                                                                                                                            File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):37376
                                                                                                                                                                                                                                            Entropy (8bit):7.8223066199355635
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:768:DX5NQnY+H236BVyqRLjqutCwYUw/8WM+6OxWFfT0:lNQRWKBcIqgpw/2+NgR
                                                                                                                                                                                                                                            MD5:E115982EE531ACD056BF254EC6C7EE81
                                                                                                                                                                                                                                            SHA1:E8BF6292B21E93A9CD308561726899526F92B14F
                                                                                                                                                                                                                                            SHA-256:85C4106E07C01945F8A26D105E53F9E149635B7B976EBEFD6B2211CAA1E001D7
                                                                                                                                                                                                                                            SHA-512:10831AD85CD53277F30C13653958509909183003C2CDCBCD866EE3FBFE40A6D147EBB0EE3EE8AC6EF3272D814F320D02C827037E0FE6551465BB091D785A2C45
                                                                                                                                                                                                                                            Malicious:true
                                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......r.56..f6..f6..f?.Ef2..f&5.g4..f}..g4..f&5.g5..f&5.g>..f&5.g;..f...g5..f6..f...f}4.g7..f}4.g7..f}4)f7..f}4.g7..fRich6..f........PE..d...V..g.........." ...).........0.......@................................................`.............................................h....................p..|.......................................................@...........................................UPX0.....0..............................UPX1.........@......................@....rsrc...............................@..............................................................................................................................................................................................................................................................................................................................................................3.96.UPX!.$..

                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI45442\libcrypto-1_1.dll

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Roaming\empyrean\dat.txt
                                                                                                                                                                                                                                            File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):1189728
                                                                                                                                                                                                                                            Entropy (8bit):7.9451398145343335
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:24576:xffQrZJIe6/4gho5HE1F03fkOyUU/BtSIgA0ft+rBFOWRIQ6sCYB1CPwDv3uFfJp:pf8JWwgho5HL3fknPSIKorCo1CPwDv3Q
                                                                                                                                                                                                                                            MD5:DA5FE6E5CFC41381025994F261DF7148
                                                                                                                                                                                                                                            SHA1:13998E241464952D2D34EB6E8ECFCD2EB1F19A64
                                                                                                                                                                                                                                            SHA-256:DE045C36AE437A5B40FC90A8A7CC037FACD5B7E307CFCF9A9087C5F1A6A2CF18
                                                                                                                                                                                                                                            SHA-512:A0D7EBF83204065236439D495EB3C97BE093C41DAAC2E6CFBBB1AA8FFEAC049402A3DEA7139B1770D2E1A45E08623A56A94D64C8F0C5BE74C5BAE039A2BC6CA9
                                                                                                                                                                                                                                            Malicious:true
                                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........a...2...2...2...2...2..3...2..3...2..3...2..3...2...2...2L.3...2..3...2..3.2..3...2..p2...2..3...2Rich...2........................PE..d...m..b.........." ... .........@%.025..P%..................................P7...........`......................................... H5......C5.h....@5......`2.............H7......................................=5.@...........................................UPX0.....@%.............................UPX1.........P%.....................@....rsrc........@5.....................@..............................................................................................................................................................................................................................................................................................................................................3.96.UPX!.$..

                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI45442\libffi-7.dll

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Roaming\empyrean\dat.txt
                                                                                                                                                                                                                                            File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):24088
                                                                                                                                                                                                                                            Entropy (8bit):7.529671673324906
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:384:TRZBxuj5W4IBzuU2CUvOEvbY4nUxaVXALNxZRCXTpnYPLxDG4y80uzFLhHj:lwlGuUm2EvbrmWpWDG4yKRF
                                                                                                                                                                                                                                            MD5:B5150B41CA910F212A1DD236832EB472
                                                                                                                                                                                                                                            SHA1:A17809732C562524B185953FFE60DFA91BA3CE7D
                                                                                                                                                                                                                                            SHA-256:1A106569AC0AD3152F3816FF361AA227371D0D85425B357632776AC48D92EA8A
                                                                                                                                                                                                                                            SHA-512:9E82B0CAA3D72BB4A7AD7D66EBFB10EDB778749E89280BCA67C766E72DC794E99AAB2BC2980D64282A384699929CE6CC996462A73584898D2DF67A57BFF2A9C6
                                                                                                                                                                                                                                            Malicious:true
                                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......6.3.r}]Ar}]Ar}]A{..Ap}]A .\@p}]A..\@q}]Ar}\AU}]A .X@~}]A .Y@z}]A .^@q}]A..Y@t}]A..^@s}]A..]@s}]A.._@s}]ARichr}]A........................PE..d......].........." .....@................................................................`.........................................................................................................................................................................UPX0....................................UPX1.....@.......:..................@...UPX2.................>..............@......................................................................................................................................................................................................................................................................................................................................................3.96.UPX!.$..

                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI45442\libssl-1_1.dll

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Roaming\empyrean\dat.txt
                                                                                                                                                                                                                                            File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):208224
                                                                                                                                                                                                                                            Entropy (8bit):7.921732676851239
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:3072:XSI3oPlWLlPVVc5MpJa1pOjJnnioIZW8/Qf6bRXGKrs8qJjueW1LR/oSBZLetz:CIek5VC0FiHof6Z1rgJ63R/oSi
                                                                                                                                                                                                                                            MD5:48D792202922FFFE8EA12798F03D94DE
                                                                                                                                                                                                                                            SHA1:F8818BE47BECB8CCF2907399F62019C3BE0EFEB5
                                                                                                                                                                                                                                            SHA-256:8221A76831A103B2B2AE01C3702D0BBA4F82F2AFD4390A3727056E60B28650CC
                                                                                                                                                                                                                                            SHA-512:69F3A8B556DD517AE89084623F499EF89BD0F97031E3006677CEED330ED13FCC56BF3CDE5C9ED0FC6C440487D13899FFDA775E6A967966294CADFD70069B2833
                                                                                                                                                                                                                                            Malicious:true
                                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........D.p*..p*..p*......p*...+..p*.\.+..p*.../..p*......p*...)..p*...+..p*..p+.iq*......p*...*..p*.....p*...(..p*.Rich.p*.........PE..d......b.........." ... .....P...`..@....p................................................`..........................................6..4@...3.......0...........M...........v......................................8%..@...........................................UPX0.....`..............................UPX1.........p......................@....rsrc....P...0...H..................@..............................................................................................................................................................................................................................................................................................................................................................3.96.UPX!.$..

                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI45442\mfc140u.dll

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Roaming\empyrean\dat.txt
                                                                                                                                                                                                                                            File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):5653424
                                                                                                                                                                                                                                            Entropy (8bit):6.729277267882055
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:49152:EuEsNcEc8/CK4b11P5ViH8gw0+NVQD5stWIlE7lva8iposS9j5fzSQzs7ID+AVuS:EnL8+5fiEnQFLOAkGkzdnEVomFHKnPS
                                                                                                                                                                                                                                            MD5:03A161718F1D5E41897236D48C91AE3C
                                                                                                                                                                                                                                            SHA1:32B10EB46BAFB9F81A402CB7EFF4767418956BD4
                                                                                                                                                                                                                                            SHA-256:E06C4BD078F4690AA8874A3DEB38E802B2A16CCB602A7EDC2E077E98C05B5807
                                                                                                                                                                                                                                            SHA-512:7ABCC90E845B43D264EE18C9565C7D0CBB383BFD72B9CEBB198BA60C4A46F56DA5480DA51C90FF82957AD4C84A4799FA3EB0CEDFFAA6195F1315B3FF3DA1BE47
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......Q.cu...&...&...&...'...&...'...&...'...&..&...&G..'...&G..'...&...'...&...&..&G..'...&G..'...&G..'...&G..'...&G..&...&G..'...&Rich...&................PE..d....~.a.........." .....(-..X)......X,.......................................V......YV...`A..........................................:.....h.;.......?......`=..8....V..'...PU.0p..p.5.T...........................`...8............@-.P...0.:......................text....&-......(-................. ..`.rdata.......@-......,-.............@..@.data....6... <.......<.............@....pdata...8...`=..:....<.............@..@.didat..H.....?.......?.............@....rsrc.........?.......?.............@..@.reloc..0p...PU..r....T.............@..B................................................................................................................................................................................

                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI45442\multidict\_multidict.cp310-win_amd64.pyd

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Roaming\empyrean\dat.txt
                                                                                                                                                                                                                                            File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):20480
                                                                                                                                                                                                                                            Entropy (8bit):7.620137621014922
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:384:3j0inCNIw61COjZ0FbIj/jvIUrn+HHRCkmJeZMF50aEB1lZ9nUxaVXALeqg8:3w1D6vjZd1SxCjeZM0TBX1q
                                                                                                                                                                                                                                            MD5:0A9B975CEE2760BFF77865A34F7028F0
                                                                                                                                                                                                                                            SHA1:55FCC33419E41A43FB5B52EF81A9A150C480F98E
                                                                                                                                                                                                                                            SHA-256:20424D01666FC6C53F2DE690C68DD4E0755BD40BF26D983C0E986DDDC7995615
                                                                                                                                                                                                                                            SHA-512:86C8B09FDC5355614E831AB869D02EC5423F6943DE158F51896422CDFC3F4BD8CFD9664F47AB2EE87DB0BE2BB48CF10DD42CF877542DE0593FE6FEACB69731D7
                                                                                                                                                                                                                                            Malicious:true
                                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........o.T.............v?............v........................&{................................S.............Rich............PE..d....|.f.........." ...).P...................................................@............`.........................................@2..d....0..P....0.......................2.......................................&..@...........................................UPX0....................................UPX1.....P.......H..................@....rsrc........0.......L..............@..............................................................................................................................................................................................................................................................................................................................................................3.96.UPX!.$..

                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI45442\propcache\_helpers_c.cp310-win_amd64.pyd

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Roaming\empyrean\dat.txt
                                                                                                                                                                                                                                            File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):32768
                                                                                                                                                                                                                                            Entropy (8bit):7.777596001077688
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:768:saXim60eBsX5cAR0NOhDEuU8dP0LAZ2dP97MTT5:saXi0eB45cAASDEuNd8LAZ2p97Mn
                                                                                                                                                                                                                                            MD5:1E8E455DAB1C155FA2ADC89C244971BA
                                                                                                                                                                                                                                            SHA1:8347F3A0888D4389749D4401044318651698F0E2
                                                                                                                                                                                                                                            SHA-256:960CFB8E43176D3F11309A9A6FB646F5349E5F323A41082DC9745D2430180887
                                                                                                                                                                                                                                            SHA-512:BA3E3F0E8D7CCF0A368D2DCD67B80F73A3364287460427079BA45489F0F257A4E515775A5F8980352C1F971054DBB3941FA17E09F305E74921834C50E7C33611
                                                                                                                                                                                                                                            Malicious:true
                                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........o.T.............v?..............v..............................b{...........................S...........Rich....................PE..d......g.........." ...)................. ................................................`.........................................@...d......P............@..l.......................................................@...........................................UPX0....................................UPX1......... ...x..................@....rsrc................|..............@......................................................................................................................................................................................................................................................................................................................................................3.96.UPX!.$..

                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI45442\psutil\_psutil_windows.pyd

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Roaming\empyrean\dat.txt
                                                                                                                                                                                                                                            File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):34816
                                                                                                                                                                                                                                            Entropy (8bit):7.787702936942791
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:768:l5HOA2w0JLJLH+AKL7/d2gt6UDsPioZLxivYG7HWFynfcwRVG:LHOE0T+AKL70g/oZ9sY22Ef9V
                                                                                                                                                                                                                                            MD5:FB17B2F2F09725C3FFCA6345ACD7F0A8
                                                                                                                                                                                                                                            SHA1:B8D747CC0CB9F7646181536D9451D91D83B9FC61
                                                                                                                                                                                                                                            SHA-256:9C7D401418DB14353DB85B54FF8C7773EE5D17CBF9A20085FDE4AF652BD24FC4
                                                                                                                                                                                                                                            SHA-512:B4ACB60045DA8639779B6BB01175B13344C3705C92EA55F9C2942F06C89E5F43CEDAE8C691836D63183CACF2D0A98AA3BCB0354528F1707956B252206991BF63
                                                                                                                                                                                                                                            Malicious:true
                                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............O..O..O...O..O..N..O..N..O..N..O..N..O...N..O..N..O..O,.OY..N..OY..N..OY.pO..OY..N..ORich..O........PE..d.....=d.........." ............. ......0................................................`.........................................8...`......H............P..X......................................................8...........................................UPX0..... ..............................UPX1.........0...~..................@....rsrc...............................@..............................................................................................................................................................................................................................................................................................................................................................3.96.UPX!.$..

                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI45442\pyexpat.pyd

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Roaming\empyrean\dat.txt
                                                                                                                                                                                                                                            File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):88440
                                                                                                                                                                                                                                            Entropy (8bit):7.917287109292123
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:1536:HqOsxiaMRf0wQhTR0lJrTMQLFrwAx0qHMKVqhgjOE+hpeWpUM2MkNpho8aI7Qhgk:K8kmJfMQLFD+XWq+aDBplFk+I7Qhge0g
                                                                                                                                                                                                                                            MD5:5A328B011FA748939264318A433297E2
                                                                                                                                                                                                                                            SHA1:D46DD2BE7C452E5B6525E88A2D29179F4C07DE65
                                                                                                                                                                                                                                            SHA-256:E8A81B47029E8500E0F4E04CCF81F8BDF23A599A2B5CD627095678CDF2FABC14
                                                                                                                                                                                                                                            SHA-512:06FA8262378634A42F5AB8C1E5F6716202544C8B304DE327A08AA20C8F888114746F69B725ED3088D975D09094DF7C3A37338A93983B957723AA2B7FDA597F87
                                                                                                                                                                                                                                            Malicious:true
                                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......9h..}..}..}..tqu.q..2u....2u.p..2u.u..2u.~...u....{.~..}......u.y...u.|...u..|...u.|..Rich}..................PE..d...+..c.........." ...". ........... .......................................@............`..........................................<..P....9.......0.......................<.......................................,..@...........................................UPX0....................................UPX1..... ..........................@....rsrc........0......."..............@......................................................................................................................................................................................................................................................................................................................................................3.96.UPX!.$..

                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI45442\pyinstaller-5.1.dist-info\COPYING.txt

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Roaming\empyrean\dat.txt
                                                                                                                                                                                                                                            File Type:ASCII text
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):30634
                                                                                                                                                                                                                                            Entropy (8bit):4.687948422038189
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:384:8+ztint/HdxEUwi5rDL676yV12rPd34ZomzM2FR+qWi9vlKM1zJlFvmNz5VrlkTv:rzolHv7FgixMFzMqd9TzJlFvAfxk1rt
                                                                                                                                                                                                                                            MD5:371FE7FDEE041250F12B3A4658A14278
                                                                                                                                                                                                                                            SHA1:A4AAA06709FF77945CA1A42ECCC06C9C99182A27
                                                                                                                                                                                                                                            SHA-256:DD7315735D0C3CBB0CC861A3EA4D9CEE497568B98CACEA64AF3EA51F4E4B5386
                                                                                                                                                                                                                                            SHA-512:77FBA931238B59A44357996EC3A39D5E8CDD8E8CBED963927A814B30AADA1F0FF88FB2D62D2DCD9955DBA9458C4A310252B72E52963FEBD0E80639ABA53A9D19
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:================================. The PyInstaller licensing terms.================================. ..Copyright (c) 2010-2022, PyInstaller Development Team.Copyright (c) 2005-2009, Giovanni Bajo.Based on previous work under copyright (c) 2002 McMillan Enterprises, Inc....PyInstaller is licensed under the terms of the GNU General Public License.as published by the Free Software Foundation; either version 2 of the License,.or (at your option) any later version....Bootloader Exception.--------------------..In addition to the permissions in the GNU General Public License, the.authors give you unlimited permission to link or embed compiled bootloader.and related files into combinations with other programs, and to distribute.those combinations without any restriction coming from the use of those.files. (The General Public License restrictions do apply in other respects;.for example, they cover modification of the files, and distribution when.not linked into a combined executable.). . .Bootlo

                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI45442\pyinstaller-5.1.dist-info\INSTALLER

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Roaming\empyrean\dat.txt
                                                                                                                                                                                                                                            File Type:ASCII text
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):4
                                                                                                                                                                                                                                            Entropy (8bit):1.5
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:3:Mn:M
                                                                                                                                                                                                                                            MD5:365C9BFEB7D89244F2CE01C1DE44CB85
                                                                                                                                                                                                                                            SHA1:D7A03141D5D6B1E88B6B59EF08B6681DF212C599
                                                                                                                                                                                                                                            SHA-256:CEEBAE7B8927A3227E5303CF5E0F1F7B34BB542AD7250AC03FBCDE36EC2F1508
                                                                                                                                                                                                                                            SHA-512:D220D322A4053D84130567D626A9F7BB2FB8F0B854DA1621F001826DC61B0ED6D3F91793627E6F0AC2AC27AEA2B986B6A7A63427F05FE004D8A2ADFBDADC13C1
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:pip.

                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI45442\pyinstaller-5.1.dist-info\METADATA

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Roaming\empyrean\dat.txt
                                                                                                                                                                                                                                            File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):7292
                                                                                                                                                                                                                                            Entropy (8bit):5.0285832056593485
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:192:VZBasM/s4VN2ZKMWNOXMdUUmUqhpVqhkHv:K72ZRCOXmUU8hpukHv
                                                                                                                                                                                                                                            MD5:E7753706452DF740FDC082E289749E18
                                                                                                                                                                                                                                            SHA1:EDC4321CB411C97514854D84230FE513596B798F
                                                                                                                                                                                                                                            SHA-256:B7F3A310E76406C2DFF20B84BF92BC7507E9612ED063C010291F1A93FA28C73C
                                                                                                                                                                                                                                            SHA-512:D5BC6F1146DB79A73F2435823A21F579FED659AD8FC36563C4C833160E2E829687AE7C086C309F2487E9551E2EFB65494CCEA21474E8AFC340F163766371DF0F
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:Metadata-Version: 2.1..Name: pyinstaller..Version: 5.1..Summary: PyInstaller bundles a Python application and all its dependencies into a single package...Home-page: https://www.pyinstaller.org/..Author: Hartmut Goebel, Giovanni Bajo, David Vierra, David Cortesi, Martin Zibricky..License: GPLv2-or-later with a special exception which allows to use PyInstaller to build and distribute non-free programs (including commercial ones)..Project-URL: Source, https://github.com/pyinstaller/pyinstaller..Keywords: packaging, app, apps, bundle, convert, standalone, executable,pyinstaller, cxfreeze, freeze, py2exe, py2app, bbfreeze..Classifier: Development Status :: 6 - Mature..Classifier: Environment :: Console..Classifier: Intended Audience :: Developers..Classifier: Intended Audience :: Other Audience..Classifier: Intended Audience :: System Administrators..Classifier: License :: OSI Approved :: GNU General Public License v2 (GPLv2)..Classifier: Natural Language :: English..Classifier: Operating

                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI45442\pyinstaller-5.1.dist-info\RECORD

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Roaming\empyrean\dat.txt
                                                                                                                                                                                                                                            File Type:CSV text
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):61650
                                                                                                                                                                                                                                            Entropy (8bit):5.605684014075479
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:1536:HqEIJtsSWQJQq4WPY1y0yvtZY6W3+j73wt5a14bXPA+Yla1U9MZhGO5oLZlu:CU/ZiL7u
                                                                                                                                                                                                                                            MD5:FB69230F6D30CF6906AD4EC3BD4964E4
                                                                                                                                                                                                                                            SHA1:51EDDAD0A01A5393084943BD928AFB8D00CDB36A
                                                                                                                                                                                                                                            SHA-256:AAA4F7B839D22619D352A1E644E3F625DFD04B70052C337898D192C85B5E3227
                                                                                                                                                                                                                                            SHA-512:0032D514C6957C68C2A77AA6ED6136F81D54216B25006E1A1DF9F031C48BBAE72BE7E9AC7EE3043AD46C3FB9D445C754D0567259FF14F5ECADC4B97C3E728496
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:../../Scripts/pyi-archive_viewer.exe,sha256=zeUWRldhfNTI8CFN69VnOZ4InP-GQYR5AlTOz7hI7ZU,108441..../../Scripts/pyi-bindepend.exe,sha256=zJH--FKRys5R8kVEf73Gcl2sEaFuEbmvDaZPY1xfREo,108436..../../Scripts/pyi-grab_version.exe,sha256=BCM902Q4Utj6Bb-VQYMVNHdnJAR6u6H88j_4FKARIZ4,108439..../../Scripts/pyi-makespec.exe,sha256=LCvrmmuKraQ0Wsh1HqXoGZO5k13qWk_t80W3U8UGgU4,108435..../../Scripts/pyi-set_version.exe,sha256=7LDhhmmiEm9WkWCJ75QC2EIWB7NBiYgAQGIgKkh8c6E,108438..../../Scripts/pyinstaller.exe,sha256=-kiDALlfa3e3PjBy0wMqRd_-gR0qLShqogOn9qtzK1c,108420..PyInstaller/__init__.py,sha256=yxwRT03ZzCOJlfU8-OxhCCUTqjifnWlXnZQtpEOzjoo,2995..PyInstaller/__main__.py,sha256=2KLwhQRzVi24ICVDCEe-QQOXvk5q1eoPa6HMMnAyD0g,6688..PyInstaller/__pycache__/__init__.cpython-310.pyc,,..PyInstaller/__pycache__/__main__.cpython-310.pyc,,..PyInstaller/__pycache__/_recursion_to_deep_message.cpython-310.pyc,,..PyInstaller/__pycache__/_shared_with_waf.cpython-310.pyc,,..PyInstaller/__pycache__/compat.cpython-310.pyc,,..P

                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI45442\pyinstaller-5.1.dist-info\WHEEL

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Roaming\empyrean\dat.txt
                                                                                                                                                                                                                                            File Type:ASCII text
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):91
                                                                                                                                                                                                                                            Entropy (8bit):4.718144065224423
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:3:RtEeXMRYFAQb6gP+tPCCfA5S:RtC1cxWBBf
                                                                                                                                                                                                                                            MD5:F8DE0AF416CFA64B783E891E98B23FB2
                                                                                                                                                                                                                                            SHA1:49C79C79C440ED3BC40387054075670F05445FCF
                                                                                                                                                                                                                                            SHA-256:474E8F0375156074E1C07BF1B9158CA9A19CAFE3EE9E25DA8708E641114C1246
                                                                                                                                                                                                                                            SHA-512:04FDA440B27B7A1B701EE33731253FAF850B5ACE046F0CF3B7A02FF66EB268975177589430ABF049D1D1DD9CB58C73019A763BE06DDCEACB0348E4089B60B6FF
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:Wheel-Version: 1.0.Generator: setuptools (75.5.0).Root-Is-Purelib: true.Tag: py3-none-any..

                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI45442\pyinstaller-5.1.dist-info\direct_url.json

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Roaming\empyrean\dat.txt
                                                                                                                                                                                                                                            File Type:JSON data
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):109
                                                                                                                                                                                                                                            Entropy (8bit):4.639181519626878
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:3:YBM7W/RzQXjHxi6KjAXWKVVtgK3rIlw3rIldrDJOXIeUHY:Ym6RzKRihjFGPbIKbIrVOX5U4
                                                                                                                                                                                                                                            MD5:4E1763FA942DDBF4753FE8C21D7BD31C
                                                                                                                                                                                                                                            SHA1:3DDDF2939F1488DE229B8C4B9FBB3DA9D4CDEF13
                                                                                                                                                                                                                                            SHA-256:D006A8C986B233A281FDDB267AFDAC05E79B1CDF2A79E8B0B3A761EDFDACC781
                                                                                                                                                                                                                                            SHA-512:700B0AAF9E9B17DA82853D74C2725D1B054658D2552102E0E634FE61B71E574BF2C978E251BA830B61BA57DDCC1FB8383C31DD11D52C4C723987DDAC0946C0E9
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:{"dir_info": {}, "url": "file:///C:/Users/poops/Downloads/empyrean-main/empyrean-main/build/pyinstaller-5.1"}

                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI45442\pyinstaller-5.1.dist-info\entry_points.txt

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Roaming\empyrean\dat.txt
                                                                                                                                                                                                                                            File Type:ASCII text
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):360
                                                                                                                                                                                                                                            Entropy (8bit):4.529432579272841
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:6:1VkKXL0DjyXLfUynXLEB85AQFXLHHVtAcRNnXLAX2OXFnXLLMi:1qKXIyXLpXg4hX7VtdFXsX2OXFnXMi
                                                                                                                                                                                                                                            MD5:E15B5909D49DAB451BEB91C31B9732BF
                                                                                                                                                                                                                                            SHA1:83A5F4EFEF9C91101FA2E7AC0CBED17FE9282145
                                                                                                                                                                                                                                            SHA-256:933880B425B47C933547830B21387BA2144517BCA3638B213A88F4E3441DBD02
                                                                                                                                                                                                                                            SHA-512:AE280B4B217AA95D7275B58DC73E7586C1999DC363A0B83E7CA350207541F13B18F30B2BB634EB4BA2F4C191940B5CCC7FC201024000E4FD28431AE6C4A69617
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:[console_scripts].pyi-archive_viewer = PyInstaller.utils.cliutils.archive_viewer:run.pyi-bindepend = PyInstaller.utils.cliutils.bindepend:run.pyi-grab_version = PyInstaller.utils.cliutils.grab_version:run.pyi-makespec = PyInstaller.utils.cliutils.makespec:run.pyi-set_version = PyInstaller.utils.cliutils.set_version:run.pyinstaller = PyInstaller.__main__:run.

                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI45442\pyinstaller-5.1.dist-info\top_level.txt

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Roaming\empyrean\dat.txt
                                                                                                                                                                                                                                            File Type:ASCII text
                                                                                                                                                                                                                                            Category:modified
                                                                                                                                                                                                                                            Size (bytes):12
                                                                                                                                                                                                                                            Entropy (8bit):3.418295834054489
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:3:rLWTXvn:f8Xvn
                                                                                                                                                                                                                                            MD5:0A28E8E758F80C4B73AFD9DBEF9F96DD
                                                                                                                                                                                                                                            SHA1:10072E4EC58C0E15D5A62FD256AC9D7BC6A28BCB
                                                                                                                                                                                                                                            SHA-256:1AE466BD65C64D124D6262B989618E82536FE0BDDBCBB60A68488AC9C359E174
                                                                                                                                                                                                                                            SHA-512:38D7A1B6198701708F90750C9D82390A150972FB898FC91C825FF6F6FE2A560B3BCC381A388BB7FE5DFAE63550BEC2A6A7CFED1390E620A5B2A559726C1439E5
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:PyInstaller.

                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI45442\python3.dll

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Roaming\empyrean\dat.txt
                                                                                                                                                                                                                                            File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):64896
                                                                                                                                                                                                                                            Entropy (8bit):6.101810529421494
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:768:Y88LeBLeeFtp5V1BfO2yvSk70QZF1nEyjnskQkr/RFB1qucwdBeCw0myou6ZwJq9:Y8wewnvtjnsfwERI7Q0L7SyCPx
                                                                                                                                                                                                                                            MD5:C17B7A4B853827F538576F4C3521C653
                                                                                                                                                                                                                                            SHA1:6115047D02FBBAD4FF32AFB4EBD439F5D529485A
                                                                                                                                                                                                                                            SHA-256:D21E60F3DFBF2BAB0CC8A06656721FA3347F026DF10297674FC635EBF9559A68
                                                                                                                                                                                                                                            SHA-512:8E08E702D69DF6840781D174C4565E14A28022B40F650FDA88D60172BE2D4FFD96A3E9426D20718C54072CA0DA27E0455CC0394C098B75E062A27559234A3DF7
                                                                                                                                                                                                                                            Malicious:true
                                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......]{....e...e...e..fm...e..fe...e..f....e..fg...e.Rich..e.........................PE..d......c.........." ..."..................................................................`.........................................`...`................................)..............T............................................................................rdata..............................@..@.rsrc...............................@..@................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI45442\python310.dll

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Roaming\empyrean\dat.txt
                                                                                                                                                                                                                                            File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):1513336
                                                                                                                                                                                                                                            Entropy (8bit):7.992007410704943
                                                                                                                                                                                                                                            Encrypted:true
                                                                                                                                                                                                                                            SSDEEP:24576:3mhx0O5yMVUEV51zVZ/7KqaI0jVSn/OCNYLfUehwHqDdt9OJzoCr2TAY/f+TNX56:3mT0OjUK51xZ/7s6GDwKDD9OJEwsAE2C
                                                                                                                                                                                                                                            MD5:69D4F13FBAEEE9B551C2D9A4A94D4458
                                                                                                                                                                                                                                            SHA1:69540D8DFC0EE299A7FF6585018C7DB0662AA629
                                                                                                                                                                                                                                            SHA-256:801317463BD116E603878C7C106093BA7DB2BECE11E691793E93065223FC7046
                                                                                                                                                                                                                                            SHA-512:8E632F141DAF44BC470F8EE677C6F0FDCBCACBFCE1472D928576BF7B9F91D6B76639D18E386D5E1C97E538A8FE19DD2D22EA47AE1ACF138A0925E3C6DD156378
                                                                                                                                                                                                                                            Malicious:true
                                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........<...R..R..R...S..R......R...W..R...V..R...Q..R.....R.K.S..R..S..R.'._.X.R.'.R..R.'....R.'.P..R.Rich..R.........PE..d......c.........." ...". ......../...E.../...................................F...........`...........................................F.......F.d.....F.......B...............F.......................................E.@...........................................UPX0....../.............................UPX1..... ..../.....................@....rsrc.........F.....................@..............................................................................................................................................................................................................................................................................................................................................................3.96.UPX!.$..

                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI45442\pythoncom310.dll

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Roaming\empyrean\dat.txt
                                                                                                                                                                                                                                            File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):198144
                                                                                                                                                                                                                                            Entropy (8bit):7.899184952490433
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:6144:irs7d9ovn0ICgOdewE9SJy9sZQ3KfmPpd:b59ovn0IC1yl3xPpd
                                                                                                                                                                                                                                            MD5:9051ABAE01A41EA13FEBDEA7D93470C0
                                                                                                                                                                                                                                            SHA1:B06BD4CD4FD453EB827A108E137320D5DC3A002F
                                                                                                                                                                                                                                            SHA-256:F12C8141D4795719035C89FF459823ED6174564136020739C106F08A6257B399
                                                                                                                                                                                                                                            SHA-512:58D8277EC4101AD468DD8C4B4A9353AB684ECC391E5F9DB37DE44D5C3316C17D4C7A5FFD547CE9B9A08C56E3DD6D3C87428EAE12144DFB72FC448B0F2CFC47DA
                                                                                                                                                                                                                                            Malicious:true
                                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......B..x...+...+...+..P+...+T..*...+T..*...+T..*...+T..*...+..*...+...*...+...*...+...*...+...+U..+..*W..+..*...+..*...+Rich...+................PE..d...k..d.........." .........p.......7....................................................`.........................................0W...c..pS.......P..p....@...z..................................................C..8...........................................UPX0....................................UPX1................................@....rsrc....p...P...l..................@..............................................................................................................................................................................................................................................................................................................................................3.96.UPX!.$..

                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI45442\pywintypes310.dll

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Roaming\empyrean\dat.txt
                                                                                                                                                                                                                                            File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):64000
                                                                                                                                                                                                                                            Entropy (8bit):7.542185527581843
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:1536:k2xBKwcTFzoNwouLGtUHhYrn/irawXffuJm8ei:kaBKwGOwoKGtUHhsnalvfuTe
                                                                                                                                                                                                                                            MD5:6F2AA8FA02F59671F99083F9CEF12CDA
                                                                                                                                                                                                                                            SHA1:9FD0716BCDE6AC01CD916BE28AA4297C5D4791CD
                                                                                                                                                                                                                                            SHA-256:1A15D98D4F9622FA81B60876A5F359707A88FBBBAE3AE4E0C799192C378EF8C6
                                                                                                                                                                                                                                            SHA-512:F5D5112E63307068CDB1D0670FE24B65A9F4942A39416F537BDBC17DEDFD99963861BF0F4E94299CDCE874816F27B3D86C4BEBB889C3162C666D5EE92229C211
                                                                                                                                                                                                                                            Malicious:true
                                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........9.$.X.w.X.w.X.w. [w.X.w.-.v.X.w.75w.X.w.-.v.X.w.-.v.X.w.-.v.X.w.3.v.X.wJ1.v.X.w.3.v.X.w.X.w.X.w,-.v.X.w,-.v.X.w,-.v.X.wRich.X.w........................PE..d......d.........." .........P.......z....................................................`.........................................p...dB..p...........p.......L......................................................8...........................................UPX0....................................UPX1................................@....rsrc....P.......J..................@......................................................................................................................................................................................................................................................................................................................................3.96.UPX!.$..

                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI45442\select.pyd

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Roaming\empyrean\dat.txt
                                                                                                                                                                                                                                            File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):24952
                                                                                                                                                                                                                                            Entropy (8bit):7.398475586533855
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:384:wm71gl6dfHKsz8nUxaVXALcTwI77G26hMWIYiSy1pCQ0AA7Pxh8E9VF0Nym5ty:/1gl65HKXzTwI77G2BYiSyv87PxWEgC
                                                                                                                                                                                                                                            MD5:72009CDE5945DE0673A11EFB521C8CCD
                                                                                                                                                                                                                                            SHA1:BDDB47AC13C6302A871A53BA303001837939F837
                                                                                                                                                                                                                                            SHA-256:5AAA15868421A46461156E7817A69EEEB10B29C1E826A9155B5F8854FACF3DCA
                                                                                                                                                                                                                                            SHA-512:D00A42700C9201F23A44FD9407FEA7EA9DF1014C976133F33FF711150727BF160941373D53F3A973F7DD6CA7B5502E178C2B88EA1815CA8BCE1A239ED5D8256D
                                                                                                                                                                                                                                            Malicious:true
                                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........].t.<r'.<r'.<r'.D.'.<r'.@s&.<r'.@w&.<r'.@v&.<r'.@q&.<r'i@s&.<r'.<s'.<r'.Ns&.<r'i@.&.<r'i@r&.<r'i@.'.<r'i@p&.<r'Rich.<r'........PE..d...&..c.........." ...".0..........@.....................................................`......................................... ...L....................`..............l.......................................H...@...........................................UPX0....................................UPX1.....0.......(..................@....rsrc................,..............@..............................................................................................................................................................................................................................................................................................................................................................3.96.UPX!.$..

                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI45442\sqlite3.dll

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Roaming\empyrean\dat.txt
                                                                                                                                                                                                                                            File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):623480
                                                                                                                                                                                                                                            Entropy (8bit):7.993548202681751
                                                                                                                                                                                                                                            Encrypted:true
                                                                                                                                                                                                                                            SSDEEP:12288:qZNIrMyJHzTarSwdWd5Xhm/27cz5hQYuHDiL1IcUq4P8ryHn5+8yjz:2NPsHzTaWwdS5xV70QYMDiCc34e8nI8+
                                                                                                                                                                                                                                            MD5:B70D218798C0FEC39DE1199C796EBCE8
                                                                                                                                                                                                                                            SHA1:73B9F8389706790A0FEC3C7662C997D0A238A4A0
                                                                                                                                                                                                                                            SHA-256:4830E8D4AE005A73834371FE7BB5B91CA8A4C4C3A4B9A838939F18920F10FAFF
                                                                                                                                                                                                                                            SHA-512:2EDE15CC8A229BFC599980CE7180A7A3C37C0264415470801CF098EF4DAC7BCF857821F647614490C1B0865882619A24E3AC0848B5AEA1796FAD054C0DD6F718
                                                                                                                                                                                                                                            Malicious:true
                                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......CG;..&U..&U..&U..^..&U.HZT..&U.HZP..&U.HZQ..&U.HZV..&U..TT..&U..&T..&U..Z]..&U..ZU..&U..Z...&U..ZW..&U.Rich.&U.................PE..d...X..c.........." ...".0...0............................................................`.............................................d"..................................x...........................................@...........................................UPX0....................................UPX1.....0.......(..................@....rsrc....0...........,..............@..............................................................................................................................................................................................................................................................................................................................................................3.96.UPX!.$..

                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI45442\unicodedata.pyd

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Roaming\empyrean\dat.txt
                                                                                                                                                                                                                                            File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):294784
                                                                                                                                                                                                                                            Entropy (8bit):7.987306847288753
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:6144:XudZUEjoXwDrGv4qJBd4R0u3FIp6O4LMHS+OsfW/+vzoFZ:MGEjyirGd+f3FIp7eMHS+CUUT
                                                                                                                                                                                                                                            MD5:CA3BAEBF8725C7D785710F1DFBB2736D
                                                                                                                                                                                                                                            SHA1:8F9AEC2732A252888F3873967D8CC0139FF7F4E5
                                                                                                                                                                                                                                            SHA-256:F2D03A39556491D1ACE63447B067B38055F32F5F1523C01249BA18052C599B4C
                                                                                                                                                                                                                                            SHA-512:5C2397E4DCB361A154CD3887C229BCF7EF980ACBB4B851A16294D5DF6245B2615CC4B42F6A95CF1D3C49B735C2F7025447247D887CCF4CD964F19F14E4533470
                                                                                                                                                                                                                                            Malicious:true
                                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......0...t..t..t..}...r..;...v..;...y..;...|..;...w.....w......v..t..%.....u.....u...y.u.....u..Richt..........PE..d...(..c.........." ...".P..........@V... ................................................`..........................................{..X....y.......p..........<............{......................................8b..@...........................................UPX0....................................UPX1.....P... ...D..................@....rsrc........p.......H..............@..............................................................................................................................................................................................................................................................................................................................................................3.96.UPX!.$..

                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI45442\win32api.pyd

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Roaming\empyrean\dat.txt
                                                                                                                                                                                                                                            File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):49664
                                                                                                                                                                                                                                            Entropy (8bit):7.834375167131465
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:768:lLHqNUpP9700eM3qeU4NWAXcnLim2sp94osOk7OPBBho8rzspYJP0Wgze:lLzrSeUGQLi+5sOt5Bbzs2Cze
                                                                                                                                                                                                                                            MD5:561F419A2B44158646EE13CD9AF44C60
                                                                                                                                                                                                                                            SHA1:93212788DE48E0A91E603D74F071A7C8F42FE39B
                                                                                                                                                                                                                                            SHA-256:631465DA2A1DAD0CB11CD86B14B4A0E4C7708D5B1E8D6F40AE9E794520C3AAF7
                                                                                                                                                                                                                                            SHA-512:D76AB089F6DC1BEFFD5247E81D267F826706E60604A157676E6CBC3B3447F5BCEE66A84BF35C21696C020362FADD814C3E0945942CDC5E0DFE44C0BCA169945C
                                                                                                                                                                                                                                            Malicious:true
                                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......X.uV....................N.......N.......N.......................N...................J...........................Rich............PE..d......d.........." ................@.....................................................`.........................................(.......`...........`...........................................................8...8.......................@...................UPX0....................................UPX1................................@....rsrc...............................@..............................................................................................................................................................................................................................................................................................................................................................3.96.UPX!.$..

                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI45442\win32com\shell\shell.pyd

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Roaming\empyrean\dat.txt
                                                                                                                                                                                                                                            File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):152576
                                                                                                                                                                                                                                            Entropy (8bit):7.9721137465367
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:3072:jA+IckcVeE911B9PROpB23W4Ukx0xluxTZ/7cpltdYwT7VbbDAH:k5cv91jtROLH4n0xluxIlTF
                                                                                                                                                                                                                                            MD5:63ED2B5247381E04868B2362AB6CA3F0
                                                                                                                                                                                                                                            SHA1:804963B6F433CCB298B5D0B284CDDE63B0DEC388
                                                                                                                                                                                                                                            SHA-256:353D17F47E6EB8691F5C431B2526B468B28D808CBEE83F8F0D4B5C809728325E
                                                                                                                                                                                                                                            SHA-512:8C9148C1ED8F1A6ECD51B8D1C6DC3B0B96DC6828EFC0C6B8652872D9D4FEEB5704CDCCD43FD23F71A9E995733CC3A8B352BCB4B8BB59F05F596CEBDAA5C29966
                                                                                                                                                                                                                                            Malicious:true
                                                                                                                                                                                                                                            Preview:MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$.......M................).....[......[......[......[...................................................O.................Rich............................PE..d...(..d.........." .....P...................................................0............`..........................................&..L...P#..t.... ..P.......xx...........'..........................................8...........................................UPX0....................................UPX1.....P.......H..................@....rsrc........ .......L..............@..............................................................................................................................................................................................................................................................................................................................3.96.UPX!.$..

                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI45442\win32crypt.pyd

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Roaming\empyrean\dat.txt
                                                                                                                                                                                                                                            File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):52736
                                                                                                                                                                                                                                            Entropy (8bit):7.733565165052535
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:1536:E9uTkXr2LgA+Q0/W25PVt9sjTQaFoJ7e3eDvfabM:YXXr2ga0BVtmFyJiuD3a
                                                                                                                                                                                                                                            MD5:B386EB9F697DE442C4D6E426D7973706
                                                                                                                                                                                                                                            SHA1:0CA2E62BCCC709092A5AC4284E4AB44339917805
                                                                                                                                                                                                                                            SHA-256:4377B52E95E1A82E77D3B0E6D19706D4C064F90EF3D05F4D05D5D8131F4EBABD
                                                                                                                                                                                                                                            SHA-512:25E91A0C1DAC2D7E7D9E2E0425B5A8AE0114B1F1D25558117864ED95F9A526435835EE58DFD50DE0C05A63519F19BFC538D09DDDE4E0B4672F8B08773B8F8F9B
                                                                                                                                                                                                                                            Malicious:true
                                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........................J.........................................`..............................................Rich............PE..d......d.........." .........0.......G....................................................`.........................................hf......hc.......`..h...................$........................................S..8...........................................UPX0....................................UPX1................................@....rsrc....0...`...$..................@..............................................................................................................................................................................................................................................................................................................................................................3.96.UPX!.$..

                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI45442\win32trace.pyd

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Roaming\empyrean\dat.txt
                                                                                                                                                                                                                                            File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):14848
                                                                                                                                                                                                                                            Entropy (8bit):7.082172460598222
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:384:46KwMJFoeBJ4qCKU7xe+16ufjIS0hnUxaVXALOI1B1r:47wMJFoenUk/uf8dWBN
                                                                                                                                                                                                                                            MD5:E37A3CD90CFCC9A7D8002EFEC8E44138
                                                                                                                                                                                                                                            SHA1:3EB7D0E10193E41215B0E5B7C94C1B660189162A
                                                                                                                                                                                                                                            SHA-256:8B03D36BB3DA3CEA74FBC1FE4749E3187B1F72839C211CE1A0256B42B4B9B8C1
                                                                                                                                                                                                                                            SHA-512:A3022230F1A89ED3C3B03B17CA12991E61C29E4AE22EACEA6D700A3B8A325DCF6C8D7CC7293D2FF11941E37C4DBE0B1B5DF1DDC006F72B4DA448170653B7DDCD
                                                                                                                                                                                                                                            Malicious:true
                                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........*U@qD.@qD.@qD.I...DqD...E.BqD...A.JqD...@.HqD...G.CqD...E.BqD...E.BqD.T.E.EqD.@qE..qD...M.AqD...D.AqD...F.AqD.Rich@qD.................PE..d......d.........." .....0..........`.....................................................`.............................................T...h...8.......h....p......................................................X...8...........................................UPX0....................................UPX1.....0..........................@....rsrc................2..............@......................................................................................................................................................................................................................................................................................................................................................3.96.UPX!.$..

                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI45442\win32ui.pyd

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Roaming\empyrean\dat.txt
                                                                                                                                                                                                                                            File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):279040
                                                                                                                                                                                                                                            Entropy (8bit):7.864533071557196
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:6144:iBjVLw7ShElYer9fB/YSYVye4ZgWJRi/tPUivxJSRYpnRlhG:iBpLwGalYU9fhYVd2gmi/tPUIWRsRlhG
                                                                                                                                                                                                                                            MD5:0EBD9CB6234A1C9D90F29E17A74A6E4C
                                                                                                                                                                                                                                            SHA1:2FB9488CACFB2625D7ED682559DAC5CAEB789F3A
                                                                                                                                                                                                                                            SHA-256:5BBA9608D364E79ED444666B8CF9E609C59D3BCC94AAB0435899E42CCCF9F566
                                                                                                                                                                                                                                            SHA-512:B7229699EAA1355A8BB533133905745C5D967020A8431824460D3D267DDDD9892B2CF1582856A048B2E4F331FA43A24408D3FA27A82098F642EB64F906C76FE6
                                                                                                                                                                                                                                            Malicious:true
                                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......aM.F%,r.%,r.%,r.,T../,r..Ys.',r..Es.',r.1Gs.+,r.wYv.-,r.wYq.!,r.wYw.3,r.%,s.-*r.wYs.",r..Y{..,r..Yr.$,r..Y..$,r..Yp.$,r.Rich%,r.........................PE..d......d.........." ................0}.......................................0............`..............................................T..<...........<8................... .. ...........................H...(...x...8...........................................UPX0....................................UPX1................................@....rsrc...............................@......................................................................................................................................................................................................................................................................................................................................3.96.UPX!.$..

                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI45442\yarl\_quoting_c.cp310-win_amd64.pyd

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Roaming\empyrean\dat.txt
                                                                                                                                                                                                                                            File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):41984
                                                                                                                                                                                                                                            Entropy (8bit):7.860945320611378
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:768:tzY7iGEvYJSIlYZEVifuxMiC863eHarUVbQc3Vxun838MrkOC4:m7TEvYRyZ0ifXZ8WeLVbQ4MMrDH
                                                                                                                                                                                                                                            MD5:10834C99A1000E83B5846B7B426481C0
                                                                                                                                                                                                                                            SHA1:231E46B8B5582C36E201C195E93D4AE00DFB7541
                                                                                                                                                                                                                                            SHA-256:617E9C9889E9510FA0CDB00CA20E959850CC4BF231AC440ED8E11E3962A04653
                                                                                                                                                                                                                                            SHA-512:8E9BF6A4C6F5DAD727AD1C172E7DFEA4F2A23184F0D85BFDFF4E4A8939996DC370EFCDDBDEB5E26757E5DBA6BB9766EEB723B789CC86A89C054B964734CAB0B5
                                                                                                                                                                                                                                            Malicious:true
                                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......b..]&..&..&../..."..6K..$..m...$..6K..%..6K.....6K..*....%..&.....mJ..'..mJ..'..mJj.'..mJ..'..Rich&..........PE..d..."."g.........." ...).........`..@....p................................... ............`.............................................d...........................................................................8...@...........................................UPX0.....`..............................UPX1.........p......................@....rsrc...............................@..............................................................................................................................................................................................................................................................................................................................................................3.96.UPX!.$..

                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI70002\Crypto\Cipher\_ARC4.pyd

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\Desktop\NEVER OPEN!.exe
                                                                                                                                                                                                                                            File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):9728
                                                                                                                                                                                                                                            Entropy (8bit):6.791071822964766
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:192:d519kKsPOR3drvDtDvIqEk7KzmYMJHFKHkyUxaVXFaLuH2:d57kKsWR3RvDtDvIqFmdwQHnUxaVXALX
                                                                                                                                                                                                                                            MD5:D9F2264898AAAA9EF6152A1414883D0F
                                                                                                                                                                                                                                            SHA1:E0661549D6BF59FFDA98FCCC00756F44CAF02228
                                                                                                                                                                                                                                            SHA-256:836CBA3B83B00427430FE6E1C4E45790616BC85C57DBD6E6D5B6930A9745B715
                                                                                                                                                                                                                                            SHA-512:BA033BAF7C3B93BBF8FCE4F24BC37930D6CE419EE3F517D2BC9702417E821F5FDA5FB9334A08B37FED55B3B9535CD194A3B79DD70653D1F8C4C0DD906EBF1B04
                                                                                                                                                                                                                                            Malicious:true
                                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........&...H...H...H......H..I...H..I...H...I...H..M...H..L...H..K...H...@...H...H...H.......H...J...H.Rich..H.........................PE..d...ba.c.........." ...". .......p........................................................`.........................................L..........\............@........................................................@...........................................UPX0.....p..............................UPX1..... ..........................@....rsrc................"..............@......................................................................................................................................................................................................................................................................................................................................................3.96.UPX!.$..

                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI70002\Crypto\Cipher\_Salsa20.pyd

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\Desktop\NEVER OPEN!.exe
                                                                                                                                                                                                                                            File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):10752
                                                                                                                                                                                                                                            Entropy (8bit):7.0813376258556
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:192:HPt6CkaiGEmxFlCFNbJqCBSkyUxaVXFaLon/F+:F6Ch3EmDlwbJqKSnUxaVXAL8k
                                                                                                                                                                                                                                            MD5:E3AE69E44C4C82D83082BBB8C25AA8DD
                                                                                                                                                                                                                                            SHA1:116D3B46E8DAA2AEFB2D58BE4B00BD3BFC09833F
                                                                                                                                                                                                                                            SHA-256:4229235814BBEE62311E3623C07898B03D3B22281CD4E5F1A87B86450B1B740F
                                                                                                                                                                                                                                            SHA-512:8A49128A79A9F9DE27AFE150402BD8DB224F8BAE6237D6C2D29C1F543E5A929E2FD15060BFD37B49B1C4A3190A70659AA041D36BDE09674A77171DC27415B2D4
                                                                                                                                                                                                                                            Malicious:true
                                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........EY.o+..o+..o+......o+...*..o+...*..o+..o*..o+......o+.../..o+...(..o+...#..o+...+..o+......o+...)..o+.Rich.o+.................PE..d...ca.c.........." ...".0.......p........................................................`.........................................L..........\............P..L.......................................................@...........................................UPX0.....p..............................UPX1.....0......."..................@....rsrc................&..............@..............................................................................................................................................................................................................................................................................................................................................................3.96.UPX!.$..

                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI70002\Crypto\Cipher\_chacha20.pyd

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\Desktop\NEVER OPEN!.exe
                                                                                                                                                                                                                                            File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):10752
                                                                                                                                                                                                                                            Entropy (8bit):7.046269212433107
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:192:H7T6CkaiXcecnjMe0FXrdMIkCtOkyUxaVXFaL2nPVdX9lk:P6ChEcGeVWOnUxaVXALG/X9
                                                                                                                                                                                                                                            MD5:ED1BBDC7CC945DA2D1F5A914987EB885
                                                                                                                                                                                                                                            SHA1:C71F0A316E41C8AE5D21BE2E3A894E482D52774C
                                                                                                                                                                                                                                            SHA-256:1EECE2F714DC1F520D0608F9F71E692F5B269930603F8AFC330118EA38F16005
                                                                                                                                                                                                                                            SHA-512:1C26A0A0B223FD864BD01BCA8DE012DC385D116BE933C2479F25113983723DBBC2CEC147947F62C617BB7CCAD242518FECB653F008090BEEC0DEEEB5A1DFEAD4
                                                                                                                                                                                                                                            Malicious:true
                                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........EY.o+..o+..o+......o+...*..o+...*..o+..o*..o+......o+.../..o+...(..o+...#..o+...+..o+......o+...)..o+.Rich.o+.................PE..d...ca.c.........." ...".0.......p..p.....................................................`.........................................L..........\............P..d...................................................h...@...........................................UPX0.....p..............................UPX1.....0......."..................@....rsrc................&..............@..............................................................................................................................................................................................................................................................................................................................................................3.96.UPX!.$..

                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI70002\Crypto\Cipher\_pkcs1_decode.pyd

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\Desktop\NEVER OPEN!.exe
                                                                                                                                                                                                                                            File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):10240
                                                                                                                                                                                                                                            Entropy (8bit):6.978550721417444
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:192:611+odumclYAItbK07UmzqMtJ9CE1r28kyUxaVXFaLf3BD:TH5Yy073zqU99DnUxaVXAL5
                                                                                                                                                                                                                                            MD5:3EFFD59CD95B6706C1F2DD661AA943FC
                                                                                                                                                                                                                                            SHA1:6D3C1B8899E38B31E7BE2670D87050921023C7F1
                                                                                                                                                                                                                                            SHA-256:4C29950A9EDEDBBC24A813F8178723F049A529605EF6D35F16C7955768AACE9E
                                                                                                                                                                                                                                            SHA-512:D6AF4A719694547DAE5E37C833DEF291CE3EAEA3703FAA360C6ADCC6B64BA36442E0D2783D44450E0F582BC6FA07F3496919FD6C70F88DD0FC29688956939412
                                                                                                                                                                                                                                            Malicious:true
                                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.............h...h...h......h..i...h..i...h...i...h..m...h..l...h..k...h...`...h...h...h.......h...j...h.Rich..h.........PE..d...aa.c.........." ...". .......p........................................................`.........................................L...p......\............P..........................................................@...........................................UPX0.....p..............................UPX1..... ....... ..................@....rsrc................$..............@......................................................................................................................................................................................................................................................................................................................................................................3.96.UPX!.$..

                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI70002\Crypto\Cipher\_raw_aes.pyd

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\Desktop\NEVER OPEN!.exe
                                                                                                                                                                                                                                            File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):17920
                                                                                                                                                                                                                                            Entropy (8bit):7.483226756510774
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:384:NT0mEndi296LQpjT621uQ7nUxaVXALwcn:NQhvrpf6wuEvc
                                                                                                                                                                                                                                            MD5:671100B821EB357CEB5A4C5FF86BC31A
                                                                                                                                                                                                                                            SHA1:0604A7686029BECEBBEF102C14031CCF489854E9
                                                                                                                                                                                                                                            SHA-256:803E46354CDAB4AF6FF289E98DE9C56B5B08E3E9AD5F235D5A282005FA9F2D50
                                                                                                                                                                                                                                            SHA-512:2D916A41993EA1A5A0E72F0665A6D8C384C1541EE95A582EF5FBC59BE835720915046C7106ED2F9A1074EC0CDDFA7124E8079B2F837A442599C59479477960AF
                                                                                                                                                                                                                                            Malicious:true
                                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........&...H...H...H......H..I...H..I...H...I...H..M...H..L...H..K...H...@...H...H...H.......H...J...H.Rich..H.........................PE..d...^a.c.........." ...".@................................................... ............`.........................................L...........\.......................................................................@...........................................UPX0....................................UPX1.....@.......>..................@....rsrc................B..............@......................................................................................................................................................................................................................................................................................................................................................3.96.UPX!.$..

                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI70002\Crypto\Cipher\_raw_aesni.pyd

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\Desktop\NEVER OPEN!.exe
                                                                                                                                                                                                                                            File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):11264
                                                                                                                                                                                                                                            Entropy (8bit):7.042646572293955
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:192:CZ1jziP8+lCPPQFUF/ylol0uBpDIkyUxaVXFaLmEnlA:kzulCPqUFCo5BpDInUxaVXALX
                                                                                                                                                                                                                                            MD5:DCD2F68680E2FB83E9FEFA18C7B4B3E0
                                                                                                                                                                                                                                            SHA1:8EC62148F1649477273607CDAA0DCE2331799741
                                                                                                                                                                                                                                            SHA-256:D63F63985356B7D2E0E61E7968720FB72DC6B57D73BED4F337E372918078F946
                                                                                                                                                                                                                                            SHA-512:BF311F048001C199F49B12B3B0893D132A139DD4B16D06ADB26DD9108F686B50C6FEDA2A73A59324473DB6EE9063FF13C72047A97E2FCB561C8F841EE3A8360C
                                                                                                                                                                                                                                            Malicious:true
                                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........eX.o...o...o.......o.......o.......o...o...o.......o.......o.......o.......o.......o.......o.......o..Rich.o..........................PE..d...^a.c.........." ...".0.......p.. .....................................................`.........................................L..........\............P.........................................................@...........................................UPX0.....p..............................UPX1.....0.......$..................@....rsrc................(..............@......................................................................................................................................................................................................................................................................................................................................................3.96.UPX!.$..

                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI70002\Crypto\Cipher\_raw_arc2.pyd

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\Desktop\NEVER OPEN!.exe
                                                                                                                                                                                                                                            File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):12800
                                                                                                                                                                                                                                            Entropy (8bit):7.101710831645112
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:192:H68U1i2QelKEyhXjReC6SCeiJpHzoh7JfwoskyUxaVXFaLQHC:a8U8Dz1ESlinHzo5KosnUxaVXALV
                                                                                                                                                                                                                                            MD5:3F5FD606893B3DE6116D4A185E713CA3
                                                                                                                                                                                                                                            SHA1:5B0ABEB17AE2B3D59215FFFAE6688921B2A04EDA
                                                                                                                                                                                                                                            SHA-256:0898CDE5FCCFA86E2423CDF627A3745B1F59BB30DFEF0DD9423926D4167F9F82
                                                                                                                                                                                                                                            SHA-512:11580C06601D27755DF9D17DDFA8998E4E8E4FDEC55ECD1289963095BD752A69307B09606B06E5012CC73620D1B6D6CD41563C27A8218653DE7473F6E4BE1B2B
                                                                                                                                                                                                                                            Malicious:true
                                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........EY.o+..o+..o+......o+...*..o+...*..o+..o*..o+......o+.../..o+...(..o+...#..o+...+..o+......o+...)..o+.Rich.o+.................PE..d..._a.c.........." ...".0..........@.....................................................`.........................................L...........\............`......................................................8...@...........................................UPX0....................................UPX1.....0.......*..................@....rsrc...............................@..............................................................................................................................................................................................................................................................................................................................................................3.96.UPX!.$..

                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI70002\Crypto\Cipher\_raw_blowfish.pyd

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\Desktop\NEVER OPEN!.exe
                                                                                                                                                                                                                                            File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):15360
                                                                                                                                                                                                                                            Entropy (8bit):7.390629788507205
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:384:gmM80nfSoKJZi3o0DYjHeja46nUxaVXALsD:gmMTf8Z4oiYj++T
                                                                                                                                                                                                                                            MD5:418CEC0CC45B20EE8165E86CAC35963C
                                                                                                                                                                                                                                            SHA1:51B8EE4C8663BE14E1EE5FA288F676ED180DA738
                                                                                                                                                                                                                                            SHA-256:694BF801227B26DADAF9DDFF373647AB551D7A0B9CFF6DE1B42747F04EFC510E
                                                                                                                                                                                                                                            SHA-512:7986BD0BB851DC87D983EAAEB438C6F6D406FE89526AF79CFCEE0F534177EFA70AA3175D3BC730745C5F344931132C235659E1CC7164C014520477633488A158
                                                                                                                                                                                                                                            Malicious:true
                                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........EY.o+..o+..o+......o+...*..o+...*..o+..o*..o+......o+.../..o+...(..o+...#..o+...+..o+......o+...)..o+.Rich.o+.................PE..d..._a.c.........." ...".@..........0.....................................................`.........................................L...........\............p......................................................(...@...........................................UPX0....................................UPX1.....@.......4..................@....rsrc................8..............@..............................................................................................................................................................................................................................................................................................................................................................3.96.UPX!.$..

                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI70002\Crypto\Cipher\_raw_cast.pyd

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\Desktop\NEVER OPEN!.exe
                                                                                                                                                                                                                                            File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):20480
                                                                                                                                                                                                                                            Entropy (8bit):7.586579116038327
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:384:4VVgiBGs0qMuLjc5XzQk+JktIzZWFjoyXfHG1L4lcX22CnUxaVXALbUu:4VCicsfFL45KJk44NoyX/CucX8OUu
                                                                                                                                                                                                                                            MD5:243E336DEC71A28E7F61548A2425A2E1
                                                                                                                                                                                                                                            SHA1:66DCA0B999E704E9FB29861D3C5BCD065E2CB2C0
                                                                                                                                                                                                                                            SHA-256:BF53063304119CF151F22809356B5B4E44799131BBAB5319736D0321F3012238
                                                                                                                                                                                                                                            SHA-512:D0081025822FF86E7FC3E4442926988F95F91BFF3627C1952CE6B1AAEF69F8B3E42D5D3A9DD941C1A1526D6558CA6E3DAEF5AFCFB0431EEBC9B9920C7CA89101
                                                                                                                                                                                                                                            Malicious:true
                                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........EY.o+..o+..o+......o+...*..o+...*..o+..o*..o+......o+.../..o+...(..o+...#..o+...+..o+......o+...)..o+.Rich.o+.................PE..d...`a.c.........." ...".P................................................................`.........................................L...........\.......................................................................@...........................................UPX0....................................UPX1.....P.......H..................@....rsrc................L..............@..............................................................................................................................................................................................................................................................................................................................................................3.96.UPX!.$..

                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI70002\Crypto\Cipher\_raw_cbc.pyd

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\Desktop\NEVER OPEN!.exe
                                                                                                                                                                                                                                            File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):10240
                                                                                                                                                                                                                                            Entropy (8bit):6.815145028259091
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:192:HG6CkaitEsE8Vm7wvukyUxaVXFaLy300:m6ChIV9unUxaVXALV
                                                                                                                                                                                                                                            MD5:FE44F698198190DE574DC193A0E1B967
                                                                                                                                                                                                                                            SHA1:5BAD88C7CC50E61487EC47734877B31F201C5668
                                                                                                                                                                                                                                            SHA-256:32FA416A29802EB0017A2C7360BF942EDB132D4671168DE26BD4C3E94D8DE919
                                                                                                                                                                                                                                            SHA-512:C841885DD7696F337635EF759E3F61EE7F4286B622A9FB8B695988D93219089E997B944321CA49CA3BD19D41440EE7C8E1D735BD3558052F67F762BF4D1F5FC3
                                                                                                                                                                                                                                            Malicious:true
                                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........EY.o+..o+..o+......o+...*..o+...*..o+..o*..o+......o+.../..o+...(..o+...#..o+...+..o+......o+...)..o+.Rich.o+.................PE..d...aa.c.........." ...". .......p..p.....................................................`.........................................L..........\............P..X...................................................h...@...........................................UPX0.....p..............................UPX1..... ....... ..................@....rsrc................$..............@..............................................................................................................................................................................................................................................................................................................................................................3.96.UPX!.$..

                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI70002\Crypto\Cipher\_raw_cfb.pyd

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\Desktop\NEVER OPEN!.exe
                                                                                                                                                                                                                                            File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):10752
                                                                                                                                                                                                                                            Entropy (8bit):6.934741919099467
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:192:CaqmTnQIPnsvQPc6SltPZHloUYU9dOxLKFaEWakyUxaVXFaL2nC2:1DnQxvQPpSlNoUopKjWanUxaVXALj
                                                                                                                                                                                                                                            MD5:FF64FD41B794E0EF76A9EEAE1835863C
                                                                                                                                                                                                                                            SHA1:BF14E9D12B8187CA4CC9528D7331F126C3F5CA1E
                                                                                                                                                                                                                                            SHA-256:5D2D1A5F79B44F36AC87D9C6D886404D9BE35D1667C4B2EB8AAB59FB77BF8BAC
                                                                                                                                                                                                                                            SHA-512:03673F94525B63644A7DA45C652267077753F29888FB8966DA5B2B560578F961FDC67696B69A49D9577A8033FFCC7B4A6B98C051B4F53380227C392761562734
                                                                                                                                                                                                                                            Malicious:true
                                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......................;..................................................................W.............Rich............................PE..d...aa.c.........." ...".0.......p........................................................`.........................................L..........\............P..d.......................................................@...........................................UPX0.....p..............................UPX1.....0......."..................@....rsrc................&..............@......................................................................................................................................................................................................................................................................................................................................................3.96.UPX!.$..

                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI70002\Crypto\Cipher\_raw_ctr.pyd

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\Desktop\NEVER OPEN!.exe
                                                                                                                                                                                                                                            File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):11264
                                                                                                                                                                                                                                            Entropy (8bit):6.939657038298525
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:192:Tkje/clVEmNVPjkTnA614twLFhS3YO7C6W1wQykyUxaVXFaL6nvYF:8L1Bjul19GjW1wBnUxaVXALx
                                                                                                                                                                                                                                            MD5:D67F83D1482D9600AC012868FB49D16E
                                                                                                                                                                                                                                            SHA1:55C34243CDD930D76155EDF2D723FAA60A3A6865
                                                                                                                                                                                                                                            SHA-256:AA463CD4D0B4BBD4159650D66C11A699B23775BF92455FB58A2206B932A65FEC
                                                                                                                                                                                                                                            SHA-512:94E9599723BF697EAEEB0401EF80A75E46208C1984DF63A315A3CDE1A7C97DB070353ACB0712CEC887C04CAD9755A2E4E357A10B2D40F23F0B44EE277D4F4BDB
                                                                                                                                                                                                                                            Malicious:true
                                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........F...(...(...(......(..)...(..)...(...)...(..-...(..,...(..+...(... ...(...(...(.......(...*...(.Rich..(.........PE..d...ba.c.........." ...".0.......p..@.....................................................`.........................................L..........\............P......................................................8...@...........................................UPX0.....p..............................UPX1.....0.......$..................@....rsrc................(..............@......................................................................................................................................................................................................................................................................................................................................................................3.96.UPX!.$..

                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI70002\Crypto\Cipher\_raw_des.pyd

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\Desktop\NEVER OPEN!.exe
                                                                                                                                                                                                                                            File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):17408
                                                                                                                                                                                                                                            Entropy (8bit):7.508920120657843
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:384:/roOiYb00oHet1Y8z+r99tbr4FntSKVjoqDB+7XnUxaVXALP:/rpiDHm16B9RQSKCnrc
                                                                                                                                                                                                                                            MD5:B0EEF5CEAE8BA5E2A04C17B2B6AE87B5
                                                                                                                                                                                                                                            SHA1:6EA2736EE6F6955F0DBBD3A3ACC78CDD9121E468
                                                                                                                                                                                                                                            SHA-256:C9BBA124BE36ADA4549276D984BB3812EE2207C7DBF646EC6DF9A968E83205FB
                                                                                                                                                                                                                                            SHA-512:CE270FD23C2761D066D513B493C08A939CA29D94566EE39D0118BACB1619B5D860EBCFDCAE01F9A0B556DA95AFA8D34CF4E2234E302DE2408FFFA1972F643DEF
                                                                                                                                                                                                                                            Malicious:true
                                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........3.ANRg.NRg.NRg.G*..JRg...f.LRg..*f.MRg.NRf.hRg...b.BRg...c.FRg...d.JRg...o.ORg...g.ORg.....ORg...e.ORg.RichNRg.........PE..d...`a.c.........." ...".@..........`N... ...................................p............`.........................................Lb.......`..\....`..........l............b......................................XZ..@...........................................UPX0....................................UPX1.....@... ...<..................@....rsrc........`.......@..............@......................................................................................................................................................................................................................................................................................................................................................................3.96.UPX!.$..

                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI70002\Crypto\Cipher\_raw_des3.pyd

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\Desktop\NEVER OPEN!.exe
                                                                                                                                                                                                                                            File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):17408
                                                                                                                                                                                                                                            Entropy (8bit):7.495463921230312
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:384:eroO1wQv0BMJr0DW6EeBrSBnUxaVXAL8:erp1w3eF0DxzrMX
                                                                                                                                                                                                                                            MD5:D892F9D789C22787D846E405D0240987
                                                                                                                                                                                                                                            SHA1:F3B728D04904E5FD3465C7665F7FDE2318E623C3
                                                                                                                                                                                                                                            SHA-256:100CD322EA2F8E3997432D6E292373F3A07F75818C7802D7386E9810BEE619B0
                                                                                                                                                                                                                                            SHA-512:00FFAC3215FFA3DFAB82A32B569BC632E704B134AF4E3418DFBC91CCE9FA09D7E10B471B24183DFA1AEFA292B345BDDC030547FCCE1162F6AC5E464DFA7CF0E9
                                                                                                                                                                                                                                            Malicious:true
                                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........3.ANRg.NRg.NRg.G*..JRg...f.LRg..*f.MRg.NRf.hRg...b.BRg...c.FRg...d.JRg...o.ORg...g.ORg.....ORg...e.ORg.RichNRg.........PE..d...`a.c.........." ...".@..........0N... ...................................p............`.........................................Lb.......`..\....`.......................b......................................(Z..@...........................................UPX0....................................UPX1.....@... ...<..................@....rsrc........`.......@..............@......................................................................................................................................................................................................................................................................................................................................................................3.96.UPX!.$..

                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI70002\Crypto\Cipher\_raw_ecb.pyd

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\Desktop\NEVER OPEN!.exe
                                                                                                                                                                                                                                            File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):9216
                                                                                                                                                                                                                                            Entropy (8bit):6.822560284810641
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:192:h51aJh9fUQeV9tUhHQBYwkyUxaVXFaLuHB:h5k9s9tSHkYwnUxaVXALk
                                                                                                                                                                                                                                            MD5:F94726F6B584647142EA6D5818B0349D
                                                                                                                                                                                                                                            SHA1:4AA9931C0FF214BF520C5E82D8E73CEEB08AF27C
                                                                                                                                                                                                                                            SHA-256:B98297FD093E8AF7FCA2628C23A9916E767540C3C6FA8894394B5B97FFEC3174
                                                                                                                                                                                                                                            SHA-512:2B40A9B39F5D09EB8D7DDAD849C8A08AB2E73574EE0D5DB132FE8C8C3772E60298E0545516C9C26EE0B257EBDA59CFE1F56EF6C4357EF5BE9017C4DB4770D238
                                                                                                                                                                                                                                            Malicious:true
                                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......&6).bWG.bWG.bWG.k/..`WG.-+F.`WG.)/F.aWG.bWF.AWG.-+B.iWG.-+C.jWG.-+D.aWG.+O.cWG.+G.cWG.+..cWG.+E.cWG.RichbWG.........................PE..d...aa.c.........." ...". .......p........................................................`.................................................................@..........................................................@...........................................UPX0.....p..............................UPX1..... ..........................@....rsrc................ ..............@......................................................................................................................................................................................................................................................................................................................................................3.96.UPX!.$..

                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI70002\Crypto\Cipher\_raw_eksblowfish.pyd

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\Desktop\NEVER OPEN!.exe
                                                                                                                                                                                                                                            File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):15872
                                                                                                                                                                                                                                            Entropy (8bit):7.411957303167114
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:384:emM80n0sH6HhpbHIQ5TsgOnLC9DS4pf12SnUxaVXALbOd:emMT0tzIQ5AgYmS4pf1DJ
                                                                                                                                                                                                                                            MD5:E5021B9925A53B20946C93B5BF686647
                                                                                                                                                                                                                                            SHA1:DEEA7DA72EE7D2511E68B9F3D28B20B3A4AD6676
                                                                                                                                                                                                                                            SHA-256:87922D0EE99AF46080AFD4BAA2F96219FA195731C0745FCB9C7789338ECC778F
                                                                                                                                                                                                                                            SHA-512:E8A6B382C17138D9B33AE6ED8C1DFE93166E304A987BF326D129AE31948F91429F73EBD204C772C9679B35AFEA0A8E9DF613BCEC7F46C6E1448B226EB2C2A507
                                                                                                                                                                                                                                            Malicious:true
                                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........EY.o+..o+..o+......o+...*..o+...*..o+..o*..o+......o+.../..o+...(..o+...#..o+...+..o+......o+...)..o+.Rich.o+.................PE..d..._a.c.........." ...".@................................................................`.........................................L...........\............p..........................................................@...........................................UPX0....................................UPX1.....@.......6..................@....rsrc................:..............@..............................................................................................................................................................................................................................................................................................................................................................3.96.UPX!.$..

                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI70002\Crypto\Cipher\_raw_ocb.pyd

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\Desktop\NEVER OPEN!.exe
                                                                                                                                                                                                                                            File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):11776
                                                                                                                                                                                                                                            Entropy (8bit):7.033792220569869
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:192:Cm3adl/1JXscT11V9X8IdxqX+74RB6qT/lr5kyUxaVXFaLmHB:C6IXn11V9RrHkz6a5nUxaVXALs
                                                                                                                                                                                                                                            MD5:A76AEB47A31FD7F652C067AC1EA6D227
                                                                                                                                                                                                                                            SHA1:FF2D8E14E8A99F5C78C960C2AFD5BE2F9ED627AB
                                                                                                                                                                                                                                            SHA-256:C816F4A89CE6126DA70CB44062294A6A4AC0F73EC3A73EAD9269425B7B82288A
                                                                                                                                                                                                                                            SHA-512:C7CEC6A125904FCB42A6933520F88A6A1AA43FED9ECD40E20DDDDA9AC2DAC37E4D1D79951FF947A10AFB7C067C441DDF7DE9AF4E4BD56D73C1284962C085C1E9
                                                                                                                                                                                                                                            Malicious:true
                                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........%Y.oK..oK..oK......oK...J..oK...J..oK..oJ..oK...N..oK...O..oK...H..oK...C..oK...K..oK......oK...I..oK.Rich.oK.........................PE..d...ba.c.........." ...".0..........`.....................................................`.........................................L...........\............`..............H.......................................X...@...........................................UPX0....................................UPX1.....0.......&..................@....rsrc................*..............@......................................................................................................................................................................................................................................................................................................................................................3.96.UPX!.$..

                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI70002\Crypto\Cipher\_raw_ofb.pyd

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\Desktop\NEVER OPEN!.exe
                                                                                                                                                                                                                                            File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):10240
                                                                                                                                                                                                                                            Entropy (8bit):6.750046576159352
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:192:HQE6Ckai65ePzhVTL8Q5xh9XkyUxaVXFaLy3MJ:Z6ChJstpDxh9XnUxaVXALl
                                                                                                                                                                                                                                            MD5:EEA83B9021675C8CA837DFE78B5A3A58
                                                                                                                                                                                                                                            SHA1:3660833FF743781E451342BB623FA59229AE614D
                                                                                                                                                                                                                                            SHA-256:45A4E35231E504B0D50A5FD5968AB6960CB27D197F86689477701D79D8B95B3B
                                                                                                                                                                                                                                            SHA-512:FCDCCEA603737364DBDBBCD5763FD85AEB0C175E6790128C93360AF43E2587D0FD173BEE4843C681F43FB63D57FCAEF1A58BE683625C905416E0C58AF5BF1D6C
                                                                                                                                                                                                                                            Malicious:true
                                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........EY.o+..o+..o+......o+...*..o+...*..o+..o*..o+......o+.../..o+...(..o+...#..o+...+..o+......o+...)..o+.Rich.o+.................PE..d...ba.c.........." ...". .......p........................................................`.........................................L..........\............P..X.......................................................@...........................................UPX0.....p..............................UPX1..... ....... ..................@....rsrc................$..............@..............................................................................................................................................................................................................................................................................................................................................................3.96.UPX!.$..

                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI70002\Crypto\Hash\_BLAKE2b.pyd

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\Desktop\NEVER OPEN!.exe
                                                                                                                                                                                                                                            File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):11776
                                                                                                                                                                                                                                            Entropy (8bit):6.977802787830596
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:192:Hlqi6CkaiGp4OUdGyXOidiPFiV2ekyUxaVXFaL6n2fOG:FP6ChtCOesPDenUxaVXALDG
                                                                                                                                                                                                                                            MD5:1BF5CD751AED60DD92D0AB3CE6D773FA
                                                                                                                                                                                                                                            SHA1:897A5F74BBAC0B1BD7CB2DD598AA9B3B7BED326D
                                                                                                                                                                                                                                            SHA-256:CDA73AF34E4F542646952BBCB71559CCBDF3695AA74ED41D37A4A7D1F932A42D
                                                                                                                                                                                                                                            SHA-512:81113CFCEF2F434E9AC39B4B9CF08E67F1D84EAAA5A3CFFC5D088410E6E6480057DA1915AA22A8E01BE69418247C29D921D481D0577B810D99AC815D82D9F37E
                                                                                                                                                                                                                                            Malicious:true
                                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........EY.o+..o+..o+......o+...*..o+...*..o+..o*..o+......o+.../..o+...(..o+...#..o+...+..o+......o+...)..o+.Rich.o+.................PE..d...]a.c.........." ...".0.......p........................................................`.........................................L..........\............P..@.......................................................@...........................................UPX0.....p..............................UPX1.....0.......&..................@....rsrc................*..............@..............................................................................................................................................................................................................................................................................................................................................................3.96.UPX!.$..

                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI70002\Crypto\Hash\_BLAKE2s.pyd

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\Desktop\NEVER OPEN!.exe
                                                                                                                                                                                                                                            File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):11264
                                                                                                                                                                                                                                            Entropy (8bit):7.1469700456721625
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:192:HbH1U5KE2S8oKi7hn8QEcJtFnlZlmJ6pcfUcqEQbxwl22wUF2MXkyUxaVXFaLtnj:iK1S8oh7h8BcJ5ZlmYcfUcqEQb2lzFNW
                                                                                                                                                                                                                                            MD5:821670341B5465047733CC460856A2F5
                                                                                                                                                                                                                                            SHA1:E0A1BBC859A1F502BA086DDD8BCED82AB6843399
                                                                                                                                                                                                                                            SHA-256:84780C05C9AD7B1E554211CD31BBCB02CBE587E4F08BD2D0B9561D104C4D125C
                                                                                                                                                                                                                                            SHA-512:5F617695EA9A5312DBBD13E379E124A96692CC228B0BC366B93CDCDAF3E23375602D9E81CF5A4286A5CEDEAAE635F11120C2C2390876BF3FD7398C59044BE82F
                                                                                                                                                                                                                                            Malicious:true
                                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........EY.o+..o+..o+......o+...*..o+...*..o+..o*..o+......o+.../..o+...(..o+...#..o+...+..o+......o+...)..o+.Rich.o+.................PE..d...]a.c.........." ...".0.......p........................................................`.........................................L..........\............P..@.......................................................@...........................................UPX0.....p..............................UPX1.....0.......$..................@....rsrc................(..............@..............................................................................................................................................................................................................................................................................................................................................................3.96.UPX!.$..

                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI70002\Crypto\Hash\_MD2.pyd

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\Desktop\NEVER OPEN!.exe
                                                                                                                                                                                                                                            File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):10752
                                                                                                                                                                                                                                            Entropy (8bit):6.941977635771166
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:192:CR911+odumclYlXkeQ67WsVa6b0/XovtI2uLHkyUxaVXFaLtniW2B:COH5YmexVrblvl4HnUxaVXALg7B
                                                                                                                                                                                                                                            MD5:11A097C3DFDCFBB2ACB2EE0C92A9CB10
                                                                                                                                                                                                                                            SHA1:D15EF7DF71C8549B9B956DAC89E2542D1452ED08
                                                                                                                                                                                                                                            SHA-256:DAE038EB9D1CCDE31F9889818DB281AE70588FF5AB94A2AB7F33F8A1708F7325
                                                                                                                                                                                                                                            SHA-512:29149388B53FD85F7E77A0AE0ACFD172D73CC1443195A98B7392C494998998017EF11E16FAABBA479996FA2424D4C3CED2251FB5D8852A76FB2341F08AD08C01
                                                                                                                                                                                                                                            Malicious:true
                                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........%Y.oK..oK..oK......oK...J..oK...J..oK..oJ..oK...N..oK...O..oK...H..oK...C..oK...K..oK......oK...I..oK.Rich.oK.........................PE..d...Va.c.........." ...".0.......p........................................................`.........................................L..........\............P..(......................................................@...........................................UPX0.....p..............................UPX1.....0......."..................@....rsrc................&..............@......................................................................................................................................................................................................................................................................................................................................................3.96.UPX!.$..

                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI70002\Crypto\Hash\_MD4.pyd

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\Desktop\NEVER OPEN!.exe
                                                                                                                                                                                                                                            File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):10752
                                                                                                                                                                                                                                            Entropy (8bit):7.05097021372971
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:192:CgwgkM1OqY2hQbIGcKqV31LGT63hjvYx4kyUxaVXFaLonXlFw:Cxw/hwI2q11LnO4nUxaVXALkXw
                                                                                                                                                                                                                                            MD5:D32A2064E2DA99B370F277026BB54747
                                                                                                                                                                                                                                            SHA1:1F12598490871A86B6E2B46527DD3F10B30B183D
                                                                                                                                                                                                                                            SHA-256:959EA4BB2F433F79CBC4AFD7E77CD256E3E67416E9E6AA0E3646BCAF686E40CD
                                                                                                                                                                                                                                            SHA-512:0A2ECE5075FF9212863D80AEFFAB356B314EED3CC806C599C7665F62C30CD726CE8EC00922DFDC2E8F5AE3E2A9D9B9F7B4BD1677A02623034332DFD0413D3E02
                                                                                                                                                                                                                                            Malicious:true
                                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........%Y.oK..oK..oK......oK...J..oK...J..oK..oJ..oK...N..oK...O..oK...H..oK...C..oK...K..oK......oK...I..oK.Rich.oK.........................PE..d...Va.c.........." ...".0.......p........................................................`.........................................L..........\............P..(.......................................................@...........................................UPX0.....p..............................UPX1.....0......."..................@....rsrc................&..............@......................................................................................................................................................................................................................................................................................................................................................3.96.UPX!.$..

                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI70002\Crypto\Hash\_MD5.pyd

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\Desktop\NEVER OPEN!.exe
                                                                                                                                                                                                                                            File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):12288
                                                                                                                                                                                                                                            Entropy (8bit):7.136950075672147
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:192:C1sG1qextX4NJ9Lx8ZTZUaiQgp0AdXeST53lHA3WUkyUxaVXFaLHnU8:C2kX4NJOTmQg1dXeS1NAGUnUxaVXAL0
                                                                                                                                                                                                                                            MD5:EE11CB538BDAB49AA3499C394060F5CE
                                                                                                                                                                                                                                            SHA1:43B018D561A3201D3AA96951B8A1380D4AEB92B1
                                                                                                                                                                                                                                            SHA-256:23DDA5CE329198FE9471C7DCA31AF69144AB7A350D3E6F11D60E294C7996B1CA
                                                                                                                                                                                                                                            SHA-512:AFBDB4692AC186F62AE3B53803F8A7357E32EB40732D095A7086566B94592C3E056B48C6CA6C62742B8DE14C7F309496F83B664C42D55E679AFA60B4F1468832
                                                                                                                                                                                                                                            Malicious:true
                                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........%Y.oK..oK..oK......oK...J..oK...J..oK..oJ..oK...N..oK...O..oK...H..oK...C..oK...K..oK......oK...I..oK.Rich.oK.........................PE..d...Wa.c.........." ...".0.......p.......................................................`.........................................L..........\............P..X......................................................@...........................................UPX0.....p..............................UPX1.....0.......(..................@....rsrc................,..............@......................................................................................................................................................................................................................................................................................................................................................3.96.UPX!.$..

                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI70002\Crypto\Hash\_RIPEMD160.pyd

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\Desktop\NEVER OPEN!.exe
                                                                                                                                                                                                                                            File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):11264
                                                                                                                                                                                                                                            Entropy (8bit):6.909373515854209
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:192:Hsi6CkaTs6Ac86kwsvQrehMrP+bekyUxaVXFaL2nPV7:p6ChT1AjzQa6P+benUxaVXALGp
                                                                                                                                                                                                                                            MD5:19CA6E706818CF08F91EBB82BF9911E9
                                                                                                                                                                                                                                            SHA1:AB53841686BD55FC58A7262A79568A714A6D870B
                                                                                                                                                                                                                                            SHA-256:11933E4F74368B334C1D2118D4E975533185517264CA45F3382274DD27540DEB
                                                                                                                                                                                                                                            SHA-512:658908AA5487DC398B58E9EA704E83A63146C7D87126FA275296263C981AF48D08AB3D20D541401EB0A22489AD23991E32E6238BCAF46DAFFFA971EC769FFE96
                                                                                                                                                                                                                                            Malicious:true
                                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........EY.o+..o+..o+......o+...*..o+...*..o+..o*..o+......o+.../..o+...(..o+...#..o+...+..o+......o+...)..o+.Rich.o+.................PE..d...\a.c.........." ...".0.......p.......................................................`.........................................L..........\............P..............$..........................................@...........................................UPX0.....p..............................UPX1.....0.......$..................@....rsrc................(..............@..............................................................................................................................................................................................................................................................................................................................................................3.96.UPX!.$..

                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI70002\Crypto\Hash\_SHA1.pyd

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\Desktop\NEVER OPEN!.exe
                                                                                                                                                                                                                                            File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):13312
                                                                                                                                                                                                                                            Entropy (8bit):7.240942496482241
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:384:CDyIXn11ON21FUOyquRmMS17VCgHgmynUxaVXALana4:CDyQ11a21FYjRmMAVULZ
                                                                                                                                                                                                                                            MD5:D28807CB842B8A9F7611175CBBBC8867
                                                                                                                                                                                                                                            SHA1:FFB37BCC48B93D47EC6BA442E1BC7AA90A98246A
                                                                                                                                                                                                                                            SHA-256:C6870DB1D8518D0E594C7E7A0271636BCFCCAF58BE584A20E2A7EFCE1E3D4BB7
                                                                                                                                                                                                                                            SHA-512:0C9B1E751BDC8B995BF3BB8B90E884009F80D39E48AE679EB1551AD74D9A4987B80858EC180DCF81F25247571EB07B051E564F64594A4374E7BF5B07F68B90E8
                                                                                                                                                                                                                                            Malicious:true
                                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........%Y.oK..oK..oK......oK...J..oK...J..oK..oJ..oK...N..oK...O..oK...H..oK...C..oK...K..oK......oK...I..oK.Rich.oK.........................PE..d...Wa.c.........." ...".0................................................................`.........................................L...........\............`..X...........$...........................................@...........................................UPX0....................................UPX1.....0.......,..................@....rsrc................0..............@......................................................................................................................................................................................................................................................................................................................................................3.96.UPX!.$..

                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI70002\Crypto\Hash\_SHA224.pyd

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\Desktop\NEVER OPEN!.exe
                                                                                                                                                                                                                                            File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):14848
                                                                                                                                                                                                                                            Entropy (8bit):7.292530574848384
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:384:C6PTNMvsMA5oqMs6C5JWBCZy6nUxaVXALe:C6pMvsbtqwvN
                                                                                                                                                                                                                                            MD5:3ADAFA903E2D2681181606C962A83E62
                                                                                                                                                                                                                                            SHA1:D9963B1A62DE6A0CD4E319BC24E1F6D86E5FB74C
                                                                                                                                                                                                                                            SHA-256:407318F348E50F68E9C0517467BD9FB9AB40823302A84CB56B4E015A76821D17
                                                                                                                                                                                                                                            SHA-512:F1B90E760878D8D3E8801C42CDA4F3651E95B0F12DF49458637D7BC4B87780B4E914345E5854EAC2EB34668E0A088F526BC6360B0DD0597A8B3CD38A1708D837
                                                                                                                                                                                                                                            Malicious:true
                                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........%Y.oK..oK..oK......oK...J..oK...J..oK..oJ..oK...N..oK...O..oK...H..oK...C..oK...K..oK......oK...I..oK.Rich.oK.........................PE..d...Ya.c.........." ...".@..........P.....................................................`.........................................L...........\............p..............4...$...................................H...@...........................................UPX0....................................UPX1.....@.......2..................@....rsrc................6..............@......................................................................................................................................................................................................................................................................................................................................................3.96.UPX!.$..

                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI70002\Crypto\Hash\_SHA256.pyd

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\Desktop\NEVER OPEN!.exe
                                                                                                                                                                                                                                            File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):14848
                                                                                                                                                                                                                                            Entropy (8bit):7.305090410676597
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:384:C/PTNMvsMA5oqPFQrVLOhFsCpem+EnUxaVXALe:C/pMvspFQRihFsCppN
                                                                                                                                                                                                                                            MD5:FDA96B4CA2499DE84F3F982B536911DF
                                                                                                                                                                                                                                            SHA1:898E6DA58A9F99C2E97B7B968C7BB905CD1B8E3F
                                                                                                                                                                                                                                            SHA-256:DDAF1B7C30CC0BAC0A30845C8279D9DE3E3165149FBA5BCBF5FE9C06849E97CB
                                                                                                                                                                                                                                            SHA-512:91DE91D99D9E1AB1DECE569031B4C94EB31438235CC54FD5D9DB1C6C6588E99B5A12C8731ED02D89ADB635AE32A6217336D4EA212A28F318B8D2FA5D157674F1
                                                                                                                                                                                                                                            Malicious:true
                                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........%Y.oK..oK..oK......oK...J..oK...J..oK..oJ..oK...N..oK...O..oK...H..oK...C..oK...K..oK......oK...I..oK.Rich.oK.........................PE..d...Xa.c.........." ...".@..........P.....................................................`.........................................L...........\............p..............4...$...................................H...@...........................................UPX0....................................UPX1.....@.......2..................@....rsrc................6..............@......................................................................................................................................................................................................................................................................................................................................................3.96.UPX!.$..

                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI70002\Crypto\Hash\_SHA384.pyd

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\Desktop\NEVER OPEN!.exe
                                                                                                                                                                                                                                            File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):15360
                                                                                                                                                                                                                                            Entropy (8bit):7.387902805722102
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:384:CZKaj0o+l4vgQDD7pvJhEkgEo9nUxaVXALQ6:C8MDWoFDnpvWbX
                                                                                                                                                                                                                                            MD5:961ED0A2E355E9D15D98918438E75F2C
                                                                                                                                                                                                                                            SHA1:044210C4B576E85333ACC7911D6B65AAA7D2AE6D
                                                                                                                                                                                                                                            SHA-256:F3526F51E53E2DC1251893DD345AD59F519F9C3C69860AE8320E029241676D59
                                                                                                                                                                                                                                            SHA-512:DD7E9352E0C132C9FCE841D0C9A40D27C99E99661F5452760E67A09CACC701081FCAE46BD90E1D81EBD7F1C641C271767BE5D1D76A72E8FD0728AA069B330606
                                                                                                                                                                                                                                            Malicious:true
                                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........%Y.oK..oK..oK......oK...J..oK...J..oK..oJ..oK...N..oK...O..oK...H..oK...C..oK...K..oK......oK...I..oK.Rich.oK.........................PE..d...Za.c.........." ...".@................................................................`.........................................L...........\...........................4...........................................@...........................................UPX0....................................UPX1.....@.......4..................@....rsrc................8..............@......................................................................................................................................................................................................................................................................................................................................................3.96.UPX!.$..

                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI70002\Crypto\Hash\_SHA512.pyd

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\Desktop\NEVER OPEN!.exe
                                                                                                                                                                                                                                            File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):15360
                                                                                                                                                                                                                                            Entropy (8bit):7.456796403229419
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:384:CWKaj0t9/BuZh2MulpDvqyGxTvnUxaVXALF:CTMw9/BMhruKyGxDO
                                                                                                                                                                                                                                            MD5:17BDD9F18FC0BA23BCF7A2F0DBE6C34D
                                                                                                                                                                                                                                            SHA1:09D42AE8EC33CA02B9889132A4957D0FE4274BB5
                                                                                                                                                                                                                                            SHA-256:820C8E6E5C7480A709B3665848884BA9D852163C79560A651131DE89ACE0261A
                                                                                                                                                                                                                                            SHA-512:91DBCD8654F7404A8CD9A40912B995F45FE5A405AF78737B6DFB113DB6DAE12D9D36BF773CC702E2696BF79AB21F2EC505FFA87F74575DFD45C449A03C40A7F2
                                                                                                                                                                                                                                            Malicious:true
                                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........%Y.oK..oK..oK......oK...J..oK...J..oK..oJ..oK...N..oK...O..oK...H..oK...C..oK...K..oK......oK...I..oK.Rich.oK.........................PE..d...\a.c.........." ...".@................................................................`.........................................L...........\...........................4...........................................@...........................................UPX0....................................UPX1.....@.......4..................@....rsrc................8..............@......................................................................................................................................................................................................................................................................................................................................................3.96.UPX!.$..

                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI70002\Crypto\Hash\_ghash_clmul.pyd

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\Desktop\NEVER OPEN!.exe
                                                                                                                                                                                                                                            File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):10752
                                                                                                                                                                                                                                            Entropy (8bit):6.789317389612839
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:192:p1U5KEc/Y4ELhbko1JQdwXBSkyUxaVXFaLZnxzm:EKX/shnQduSnUxaVXALr
                                                                                                                                                                                                                                            MD5:461EFFE91D16420811D0ADB865654DE7
                                                                                                                                                                                                                                            SHA1:863AD8549892CB921DFFC35559FC7385598BF0A9
                                                                                                                                                                                                                                            SHA-256:0F322BFB8F6C26DF329D6254B2FE8A25C1AB4AB51F9404F6EAE943E0A253F469
                                                                                                                                                                                                                                            SHA-512:CC05A3D9A6F48AFD8E70BFABC870156E50D2CE6509E4E46C0F5567EAF1C2CC1AB52B8CA1990861E46AF569DE9717219BB205860D48177241D44BF573C0F50CDF
                                                                                                                                                                                                                                            Malicious:true
                                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........&...H...H...H......H..I...H..I...H...I...H..M...H..L...H..K...H...@...H...H...H.......H...J...H.Rich..H.........................PE..d...]a.c.........." ...".0.......p.......................................................`.........................................T..........d............P..................$......................................@...........................................UPX0.....p..............................UPX1.....0......."..................@....rsrc................&..............@......................................................................................................................................................................................................................................................................................................................................................3.96.UPX!.$..

                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI70002\Crypto\Hash\_ghash_portable.pyd

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\Desktop\NEVER OPEN!.exe
                                                                                                                                                                                                                                            File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):10752
                                                                                                                                                                                                                                            Entropy (8bit):6.817402405280982
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:192:Hje1U5KEc/Y4EL94AxD9JFkyUxaVXFaLfnpT:RKX/s9D9JFnUxaVXALh
                                                                                                                                                                                                                                            MD5:3057B01EC05D6ABD5CEE82EC2E4CFB06
                                                                                                                                                                                                                                            SHA1:A82D7D2183AD2C4D5B68B805DEA6487B9FDD3E43
                                                                                                                                                                                                                                            SHA-256:2DB1135EC696600AB7D53634BACAD4BBCB8DC25B09E6BD2C2633E8DF75736082
                                                                                                                                                                                                                                            SHA-512:1548894E039DFB33C17EB9CDB05C6C31F8D993C285898522E0776A063D2240F9F48F8717F9598A4957B5673B3256652E7FD2260D1E9DB34FA86D144925C06A52
                                                                                                                                                                                                                                            Malicious:true
                                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........EY.o+..o+..o+......o+...*..o+...*..o+..o*..o+......o+.../..o+...(..o+...#..o+...+..o+......o+...)..o+.Rich.o+.................PE..d...]a.c.........." ...".0.......p.......................................................`.........................................L..........\............P..X...............$......................................@...........................................UPX0.....p..............................UPX1.....0......."..................@....rsrc................&..............@..............................................................................................................................................................................................................................................................................................................................................................3.96.UPX!.$..

                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI70002\Crypto\Hash\_keccak.pyd

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\Desktop\NEVER OPEN!.exe
                                                                                                                                                                                                                                            File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):12288
                                                                                                                                                                                                                                            Entropy (8bit):7.060617294398413
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:192:CVj1ole1gwA1QapW0MEGqvjtv7ovK+u8NsS1mZKQ6kkyUxaVXFaLHncx:CSe1rwtph4q7JoSb8N5cKHknUxaVXAL8
                                                                                                                                                                                                                                            MD5:EB197359306DAA1DF7E19DC1E85D046F
                                                                                                                                                                                                                                            SHA1:B0D013525C512F887BEB025F855E439D654877E3
                                                                                                                                                                                                                                            SHA-256:8BB9B9E91287E12F867A53E0D6C8067FB9344FFB46CE6D874E44A6E89C8FE14D
                                                                                                                                                                                                                                            SHA-512:EBD339879E0DA163008DF5195316C086035BB980878A61E031E34FDC74253BF7AD495EC97FE1057BD5FA3D322C6C707ADF405709DD44834238F705435E02CC1B
                                                                                                                                                                                                                                            Malicious:true
                                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........%Y.oK..oK..oK......oK...J..oK...J..oK..oJ..oK...N..oK...O..oK...H..oK...C..oK...K..oK......oK...I..oK.Rich.oK.........................PE..d...\a.c.........." ...".0.......p........................................................`.........................................L..........\............P..p...........@...........................................@...........................................UPX0.....p..............................UPX1.....0.......(..................@....rsrc................,..............@......................................................................................................................................................................................................................................................................................................................................................3.96.UPX!.$..

                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI70002\Crypto\Hash\_poly1305.pyd

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\Desktop\NEVER OPEN!.exe
                                                                                                                                                                                                                                            File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):11776
                                                                                                                                                                                                                                            Entropy (8bit):7.021267811320247
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:192:CV011I5c1918YWN+ZnOsrjHDSyPrmnbNnYyDgIkyUxaVXFaLKnBC:CwYcfWYWJsrTDSKrmbYInUxaVXALY
                                                                                                                                                                                                                                            MD5:B18D6148260D3F01B4CFB38EE35F76BB
                                                                                                                                                                                                                                            SHA1:87064360D9A06D9B8507AA6CB3C9C49FACB2D159
                                                                                                                                                                                                                                            SHA-256:E82A778AB0A50807F9E895761E4BCDE2AB1F194B0BEA29BB1242F782388C3322
                                                                                                                                                                                                                                            SHA-512:6C2DB42605B6B8125860EB666149C186BB02ACD2CD769FE0D494E7566D30824663DC9C4A19A654FD6CB0DC62E9EC13B105FB6C67B288E8B8BEC65EC5DDF2CD9A
                                                                                                                                                                                                                                            Malicious:true
                                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........%Y.oK..oK..oK......oK...J..oK...J..oK..oJ..oK...N..oK...O..oK...H..oK...C..oK...K..oK......oK...I..oK.Rich.oK.........................PE..d...^a.c.........." ...".0.......p..`.....................................................`.........................................L..........\............P..|...................................................X...@...........................................UPX0.....p..............................UPX1.....0.......&..................@....rsrc................*..............@......................................................................................................................................................................................................................................................................................................................................................3.96.UPX!.$..

                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI70002\Crypto\Math\_modexp.pyd

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\Desktop\NEVER OPEN!.exe
                                                                                                                                                                                                                                            File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):20480
                                                                                                                                                                                                                                            Entropy (8bit):7.522268054098919
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:384:jVIehK2iflZpwNAFvzReHErimGpOqQ8lxiFviBaDOA5/cnUxaVXALaY:jVruHdRecEJlw58A5EBY
                                                                                                                                                                                                                                            MD5:22720D896AFDBCDCBD949F5D5492C82B
                                                                                                                                                                                                                                            SHA1:86A9A1DC7F6B0BFB37977824DF983943BE3141CE
                                                                                                                                                                                                                                            SHA-256:6F355BF63DD20593F44DB12EAB941096EFD70F62D778BDEA546B48F0D055E881
                                                                                                                                                                                                                                            SHA-512:8F1840A9DAAC58AC18A13D2B810BA410FAEE133D12DF49BE76699073E96B766AA21C2116BEE9D45555E12CE0E2E516BCD3A561DF3528E9FA57980F1EA72C68EC
                                                                                                                                                                                                                                            Malicious:true
                                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......L..|.../.../.../..Q/.../G....../C....../.../#../G....../G....../G....../....../....../.=/.../....../Rich.../................PE..d...la.c.........." ...".P.......... ........................................ ............`.........................................L...d.......\...............$.......................................................@...........................................UPX0....................................UPX1.....P.......H..................@....rsrc................L..............@..............................................................................................................................................................................................................................................................................................................................................................3.96.UPX!.$..

                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI70002\Crypto\Protocol\_scrypt.pyd

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\Desktop\NEVER OPEN!.exe
                                                                                                                                                                                                                                            File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):10240
                                                                                                                                                                                                                                            Entropy (8bit):6.826599062620208
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:192:z1Qxmkp6kBsHaEDzSbbc6PpnXJoBQ5hkyUxaVXFaLr3sUK:mbsHaEabcSJ5hnUxaVXALo
                                                                                                                                                                                                                                            MD5:FF7E401961C18D07C055B796A70E7D9F
                                                                                                                                                                                                                                            SHA1:71FEA35BE66E71445B22B957C9DE52CB72C42DAA
                                                                                                                                                                                                                                            SHA-256:0B23AC14EB398813E04F9116B66F77E93DEB2F9473C6534AAEEE0742128E219F
                                                                                                                                                                                                                                            SHA-512:3885E7579CA4953167CA8F171A239355E3A0B128620CD4919FD8336DDB7877BBAEA07B0EC987D3A3F00BE495778CA003EC2D694373CFA6450644A82F090CFE5D
                                                                                                                                                                                                                                            Malicious:true
                                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......................;..................................................................W.............Rich............................PE..d...ca.c.........." ...". .......p.......................................................`.........................................L...d......\............P..4......................................................@...........................................UPX0.....p..............................UPX1..... ....... ..................@....rsrc................$..............@......................................................................................................................................................................................................................................................................................................................................................3.96.UPX!.$..

                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI70002\Crypto\PublicKey\_ec_ws.pyd

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\Desktop\NEVER OPEN!.exe
                                                                                                                                                                                                                                            File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):638976
                                                                                                                                                                                                                                            Entropy (8bit):7.998469740064385
                                                                                                                                                                                                                                            Encrypted:true
                                                                                                                                                                                                                                            SSDEEP:12288:3utRJVHFtuPQ5Yi66r+uWMkf51I6NqAvPBTd74LlSSgdd:+tRfltQiFrhWMkf53tvUhk
                                                                                                                                                                                                                                            MD5:9977AF4D41DBD25919E57275A3B6A60C
                                                                                                                                                                                                                                            SHA1:81BF50D93CB871B40F8E1C95A06BA7E1E5C77141
                                                                                                                                                                                                                                            SHA-256:7A467F18E2DFB9276F5CC6709102B70D004D8EEB55E3E53270419D3F3960EDFE
                                                                                                                                                                                                                                            SHA-512:C8021B01E0C7CFE3DA8006D1529DFEFE851B6ED9ECA104FACB17B3BDA2A6B6062143FA9A9B3462E4A0BE58E6579FC34B6520B9E267E1C9B27B9950AA0807C7C8
                                                                                                                                                                                                                                            Malicious:true
                                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......`...$..L$..L$..L-.#L"..Lk.M&..Lo.M'..L$..L...Lk.M(..Lk.M,..Lk.M'..L..M!..L..M%..L..OL%..L..M%..LRich$..L................PE..d...ha.c.........." ..."......... .......0................................................`.........................................L...d.......\...............l.......................................................@...........................................UPX0..... ..............................UPX1.........0......................@....rsrc...............................@..............................................................................................................................................................................................................................................................................................................................................................3.96.UPX!.$..

                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI70002\Crypto\PublicKey\_ed25519.pyd

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\Desktop\NEVER OPEN!.exe
                                                                                                                                                                                                                                            File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):15872
                                                                                                                                                                                                                                            Entropy (8bit):7.446672321911902
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:384:N/6Y6GuC70NwWjL95yqC0AG1kOnUxaVXALR:J6UB7ewWOk1J6
                                                                                                                                                                                                                                            MD5:03AB1F87202DBBB7A0B911283F9628F6
                                                                                                                                                                                                                                            SHA1:968DCB59BFFFECD767160356449B2E6397CEB819
                                                                                                                                                                                                                                            SHA-256:7C6131D04BA4EBB0C4A5434ADD080A33A30E6DB7542A54BFE6EBE4CA3F13FAFF
                                                                                                                                                                                                                                            SHA-512:0170A3AE72141DABC95ACF21D3F9602F0BB0A47E1AA834E0FC01F7E75E727ACF9A6BEB66484327639EFEE12E0106A030E56121E604DEDA0DF3C44B3EA1C58706
                                                                                                                                                                                                                                            Malicious:true
                                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........Y.o...o...o.......o.......o.......o...o...o.......o.......o.......o.......o.......o....t..o.......o..Rich.o..................PE..d...ja.c.........." ...".@.......... .....................................................`.........................................L...0.......\...........................|...........................................@...........................................UPX0....................................UPX1.....@.......6..................@....rsrc................:..............@..............................................................................................................................................................................................................................................................................................................................................................3.96.UPX!.$..

                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI70002\Crypto\PublicKey\_ed448.pyd

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\Desktop\NEVER OPEN!.exe
                                                                                                                                                                                                                                            File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):27136
                                                                                                                                                                                                                                            Entropy (8bit):7.716235505829019
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:384:N+U1/EIha4hI63riOlt0IVQNv3sdIHaOyyFOHBjXuwtd1INmDwvrFDh1nUxaVXAV:N+U1/jhVhd3riwKMTFJluwRE9fp0
                                                                                                                                                                                                                                            MD5:999485C3306CE844545D6FF32B1778F7
                                                                                                                                                                                                                                            SHA1:F6E146C47AA1992D91A46BDF1727BD752C9608A5
                                                                                                                                                                                                                                            SHA-256:933F66840E793D4897594E934B78D5513C5A4C6B28A930F2B3E89E5A0AA203AD
                                                                                                                                                                                                                                            SHA-512:315ED2B1CDDB0A5476DB91B6ABE041D772437E5C72E7F9D9A67B747E61E5DA2E5F4C035FE67487BB31E55B560F9846A908D927FBEF9CC791D36E578247B1CA6A
                                                                                                                                                                                                                                            Malicious:true
                                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......L..|.../.../.../..Q/.../G....../C....../.../#../G....../G....../G....../....../....../.=/.../....../Rich.../................PE..d...ka.c.........." ...".p...........s... ................................................`.........................................L...h......\............0..$...............$.......................................@...........................................UPX0....................................UPX1.....p... ...b..................@....rsrc................f..............@..............................................................................................................................................................................................................................................................................................................................................................3.96.UPX!.$..

                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI70002\Crypto\PublicKey\_x25519.pyd

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\Desktop\NEVER OPEN!.exe
                                                                                                                                                                                                                                            File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):9216
                                                                                                                                                                                                                                            Entropy (8bit):6.731328673523401
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:192:O51aJh9fUQmKaF3wB0S57R2kyUxaVXFaLuHhE:O5k9C3a02R2nUxaVXALkE
                                                                                                                                                                                                                                            MD5:959E90A606763B4193A624D012974BB2
                                                                                                                                                                                                                                            SHA1:FC80DE8F6CFFFA0BA034948BCFFF8D8CDEBA29E5
                                                                                                                                                                                                                                            SHA-256:6D63F30609F05450906E8EBD8C90E47827BBBF9EA92906E984223FD51E4908A7
                                                                                                                                                                                                                                            SHA-512:78161B7FC028B90AC40477D1181A00294D4D96378BB88980B8D1A8B7C65814F50BACFDF389540EF3D8BAA3822282FC97981811C5685BD8123E59A614593B0EFB
                                                                                                                                                                                                                                            Malicious:true
                                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......&6!.bWO.bWO.bWO.k/..`WO.-+N.`WO.)/N.aWO.bWN.FWO.-+J.iWO.-+K.jWO.-+L.aWO.+G.cWO.+O.cWO.+..cWO.+M.cWO.RichbWO.........PE..d...ia.c.........." ...". .......p........................................................`.............................................P...................@..............P.......................................x...@...........................................UPX0.....p..............................UPX1..... ..........................@....rsrc................ ..............@......................................................................................................................................................................................................................................................................................................................................................................3.96.UPX!.$..

                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI70002\Crypto\Util\_cpuid_c.pyd

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\Desktop\NEVER OPEN!.exe
                                                                                                                                                                                                                                            File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):9216
                                                                                                                                                                                                                                            Entropy (8bit):6.773387048001548
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:192:C51aJh9fUQeQT3VmqRDFkyUxaVXFaLuHxJ5:C5k9xrVmqBFnUxaVXAL0J5
                                                                                                                                                                                                                                            MD5:6499087EBA82E487F21D40A769C686B6
                                                                                                                                                                                                                                            SHA1:4C5E8759FB35C47221BDA61B6226499D75CBE7E4
                                                                                                                                                                                                                                            SHA-256:2F4B5EB8397D620FA37F794BCA32A95077F764B05DB51DBA9AD34C2E2946FF60
                                                                                                                                                                                                                                            SHA-512:CE183276F0FDCCAF8BE5C34F789F2C47BAB68DFB168E0C181DD0FCF8B4A8C99527CD83C59891DCD98BBEB160DBCE884C4ECEA5EE684DEEDFF845C6B3F8205518
                                                                                                                                                                                                                                            Malicious:true
                                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......&6).bWG.bWG.bWG.k/..`WG.-+F.`WG.)/F.aWG.bWF.AWG.-+B.iWG.-+C.jWG.-+D.aWG.+O.cWG.+G.cWG.+..cWG.+E.cWG.RichbWG.........................PE..d...aa.c.........." ...". .......p........................................................`.............................................|...................@..............|...........................................@...........................................UPX0.....p..............................UPX1..... ..........................@....rsrc................ ..............@......................................................................................................................................................................................................................................................................................................................................................3.96.UPX!.$..

                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI70002\Crypto\Util\_strxor.pyd

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\Desktop\NEVER OPEN!.exe
                                                                                                                                                                                                                                            File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):9216
                                                                                                                                                                                                                                            Entropy (8bit):6.768064843872946
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:96:kbaMhzoscluM6bSM3cVhqj0rrp2C0DCLkyUx7P2EbfOlDhS+dY64At7S1TBIa+tm:zPWbS6Uhrl2hCLkyUxaVXFaLXHB
                                                                                                                                                                                                                                            MD5:9C34D1EC0B1C10FE8F53B9CAA572856A
                                                                                                                                                                                                                                            SHA1:141CDB91EC3C8135A4AC1FE879D82A9E078AB3CB
                                                                                                                                                                                                                                            SHA-256:4AB62B514BAE327476ADD45F5804895578E9F1658D8CF40AC5E7C4FB227469FA
                                                                                                                                                                                                                                            SHA-512:6447889FFE049579F3E09D5828393F7DC5268B2061895ED424F3C83B8C1929D6FECC6F8C9823C483F451C31458736D27D83EB3979A5C91703DAD913957717D09
                                                                                                                                                                                                                                            Malicious:true
                                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......&6).bWG.bWG.bWG.k/..`WG.-+F.`WG.)/F.aWG.bWF.AWG.-+B.iWG.-+C.jWG.-+D.aWG.+O.cWG.+G.cWG.+..cWG.+E.cWG.RichbWG.........................PE..d...ca.c.........." ...". .......p........................................................`.............................................t...................@..............t...........................................@...........................................UPX0.....p..............................UPX1..... ..........................@....rsrc................ ..............@......................................................................................................................................................................................................................................................................................................................................................3.96.UPX!.$..

                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI70002\PIL\_imaging.cp310-win_amd64.pyd

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\Desktop\NEVER OPEN!.exe
                                                                                                                                                                                                                                            File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):750080
                                                                                                                                                                                                                                            Entropy (8bit):7.998268583758689
                                                                                                                                                                                                                                            Encrypted:true
                                                                                                                                                                                                                                            SSDEEP:12288:TcOlugK0Q4OCDzXvegFEiBqhzD/Yup9B2pMUHcNrIEvpyobII6QnKDzsrM/w+tR6:TcrCDD9bBqhzLhpvO3cNrDBnwQKDAMPp
                                                                                                                                                                                                                                            MD5:24B9ED7A68752B1FBFF8D6E4DEB3CCF2
                                                                                                                                                                                                                                            SHA1:B5F02F742F3E7DECA22B01AF2CDFE5049D187A86
                                                                                                                                                                                                                                            SHA-256:EA70560B18994EEC4C1E1856EDA5FD2108CC22F602F3721C1BEEDD1679996B12
                                                                                                                                                                                                                                            SHA-512:DB1373943986ED0B44DCA7FFAC7C96F955A648BE88B837805400CA774B5B70341D5A5F8AF2A6C59222B6BE2002737A40E74B1458344AA88417458699F928D978
                                                                                                                                                                                                                                            Malicious:true
                                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......#d.5g..fg..fg..fn}.fw..f(y.ge..f(yufc..f(y.gi..f(y.go..f(y.gc..f.p.ge..f,}.g`..fg..fc..f.y.g...fg..f|..f.y.g-..f.y.gf..f.ywff..f.y.gf..fRichg..f........PE..d.....'d.........." ...".p.......... .$...................................... %...........`...........................................%.`.....%.......%.......#............. .%. ...........................8.%.(...l.%.@...........................................UPX0....................................UPX1.....p.......h..................@....rsrc.........%......l..............@......................................................................................................................................................................................................................................................................................................................................3.96.UPX!.$..

                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI70002\PIL\_imagingcms.cp310-win_amd64.pyd

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\Desktop\NEVER OPEN!.exe
                                                                                                                                                                                                                                            File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):96768
                                                                                                                                                                                                                                            Entropy (8bit):7.954287656970143
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:1536:8vaKG5Of6QM511dQ5FBvrlxRcqu0UrXQSYiEd+SU6+fRoPJH4NbrJ/Q/3aM6Q9/V:8SKy5dQ5XhxRDUrgbhdPF+fmBYN6OJf
                                                                                                                                                                                                                                            MD5:6733DB0C6AF1962358A2B0E819A23448
                                                                                                                                                                                                                                            SHA1:A7A095C71A3809DD1558CF5BEA17F7C16CBC5625
                                                                                                                                                                                                                                            SHA-256:3BCF5AD133FDD648C22B67D2819C923771D4586514D5E9D0051E088BA10BCBFC
                                                                                                                                                                                                                                            SHA-512:7FCC307ADD30ECDFEF1F2D7446CC6F202785195673A2ACE8F9C5250A2A64319FE7D7B9218847E9F93A1545CD65887D5D4A0B32EBB08EC012CD7D5AAA9306E099
                                                                                                                                                                                                                                            Malicious:true
                                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........rx..+..+..+...+..+...*..+...*..+...*..+...*..+!..*..+...*..+..+...+$..*...+$..*..+$..+..+$..*..+Rich..+........................PE..d.....'d.........." ...".p...........2.......................................P............`.........................................|D..h....@.......@..........\............D.......................................>..@...........................................UPX0....................................UPX1.....p.......p..................@....rsrc........@.......t..............@..............................................................................................................................................................................................................................................................................................................................................3.96.UPX!.$..

                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI70002\PIL\_imagingft.cp310-win_amd64.pyd

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\Desktop\NEVER OPEN!.exe
                                                                                                                                                                                                                                            File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):692224
                                                                                                                                                                                                                                            Entropy (8bit):7.998379316295987
                                                                                                                                                                                                                                            Encrypted:true
                                                                                                                                                                                                                                            SSDEEP:12288:zj7kGcwm1BQ16D7fWH6uIcFVt19qDpBHlv+h9DBW7:zjIGcwmQKWH6SFTrqDpBx+LDa
                                                                                                                                                                                                                                            MD5:F63DA7EEDFC08FE144D3BF4E9556BF2D
                                                                                                                                                                                                                                            SHA1:727C28A211A6EB168FC4F1114D437530D0472C82
                                                                                                                                                                                                                                            SHA-256:78BAFB6ED313F0F5CC0115558FED81C46BA5055AADB5117B85373722C8DCCA16
                                                                                                                                                                                                                                            SHA-512:6A2A590CE32EA5581FAEB6B55DAE0D6156831267EC2B347E4B5C9602EE74A1EF58F182D56B25DCCF4E2C655ABFC2CD9240EC530536A1DBD0086B34EB37B793E3
                                                                                                                                                                                                                                            Malicious:true
                                                                                                                                                                                                                                            Preview:MZ......................@...................................(...........!..L.!This program cannot be run in DOS mode....$......................<................R............................X........................P.........Rich...........................PE..d.....'d.........." ..."................. ................................................`.........................................X...d......h............`..@.......................................................@...........................................UPX0....................................UPX1......... ......................@....rsrc...............................@......................................................................................................................................................................................................................................................................................................................3.96.UPX!.$..

                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI70002\PIL\_imagingtk.cp310-win_amd64.pyd

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\Desktop\NEVER OPEN!.exe
                                                                                                                                                                                                                                            File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):12288
                                                                                                                                                                                                                                            Entropy (8bit):6.8574100581789965
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:192:DCK+UCIU7Aj+u54CJTiSVCWbFHj79+gCkyUxaVXFaL2HpAKdrye:D5CRt0iSVCWbZj78gCnUxaVXAL0AKdry
                                                                                                                                                                                                                                            MD5:94C237E6ACDBF6EE7F060D109C47B58B
                                                                                                                                                                                                                                            SHA1:ED5305A5CA7C5CA1E2246444A20C9EDC82F495C9
                                                                                                                                                                                                                                            SHA-256:78ACC538AB16006B8B1162704924979FC4F3EA32C96C3D7F419E45B5805251CF
                                                                                                                                                                                                                                            SHA-512:4632BFC70ACFED1F7915A1E4DF68DC48DA432A8D644D59849332AFDC82CFAAD4FC705E11B8B2BFBF56AA36C0878658BCD928BCB0A5B75A1EB1C928ED350127A6
                                                                                                                                                                                                                                            Malicious:true
                                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......bJ.?&+.l&+.l&+.l/S}l,+.liW.m$+.liW.m*+.liW.m.+.liW.m%+.l.^.m$+.lmS.m#+.l&+.l.+.l.W.m$+.l.W.m'+.l.W.l'+.l.W.m'+.lRich&+.l........................PE..d.....'d.........." ...".0..........0.....................................................`.............................................d....................`..............,.......................................(...@...........................................UPX0....................................UPX1.....0.......&..................@....rsrc................*..............@..............................................................................................................................................................................................................................................................................................................................................3.96.UPX!.$..

                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI70002\PIL\_webp.cp310-win_amd64.pyd

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\Desktop\NEVER OPEN!.exe
                                                                                                                                                                                                                                            File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):216064
                                                                                                                                                                                                                                            Entropy (8bit):7.98646204031228
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:6144:nA5Pjci7Q5avbYeaWBn5wWD1YKrfyjCKXBVjtmbX:ePjcPgZPhnrfyOKXA
                                                                                                                                                                                                                                            MD5:96BF2F1EC99EDE91E4C85C1C55E88825
                                                                                                                                                                                                                                            SHA1:15CA18D5C4620E9BF1BDF46902FE238410A29B6D
                                                                                                                                                                                                                                            SHA-256:84498379B48C4FA2955688910F3409944BF4FC819C0F7C7FE07A5D1ED7D25EFA
                                                                                                                                                                                                                                            SHA-512:1A7229CA7AEB1F1B8A525BBCB9952D741AD43BBC597ADA0A423586F2A65C3C6045716313EBB073CAC03D2E8802ACE2A49C9350E95953E288B8D1AC5F4F07F8E5
                                                                                                                                                                                                                                            Malicious:true
                                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......O.4...Z...Z...Z.......Z.D.[...Z.@.[...Z.D._...Z.D.^...Z.D.Y...Z..[...Z...[.X.Z..^.].Z..R...Z..Z...Z......Z..X...Z.Rich..Z.........................PE..d.....'d.........." ...".P.......`.......p................................................`.........................................x...\.................... ...L..................................................x...@...........................................UPX0.....`..............................UPX1.....P...p...B..................@....rsrc................F..............@......................................................................................................................................................................................................................................................................................................................................3.96.UPX!.$..

                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI70002\VCRUNTIME140.dll

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\Desktop\NEVER OPEN!.exe
                                                                                                                                                                                                                                            File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):109392
                                                                                                                                                                                                                                            Entropy (8bit):6.643764685776923
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:1536:DcghbEGyzXJZDWnEzWG9q4lVOiVgXjO5/Auecbq8qZU34zW/K0zD:DV3iC0h9q4v6XjKAuecbq8qGISb/
                                                                                                                                                                                                                                            MD5:870FEA4E961E2FBD00110D3783E529BE
                                                                                                                                                                                                                                            SHA1:A948E65C6F73D7DA4FFDE4E8533C098A00CC7311
                                                                                                                                                                                                                                            SHA-256:76FDB83FDE238226B5BEBAF3392EE562E2CB7CA8D3EF75983BF5F9D6C7119644
                                                                                                                                                                                                                                            SHA-512:0B636A3CDEFA343EB4CB228B391BB657B5B4C20DF62889CD1BE44C7BEE94FFAD6EC82DC4DB79949EDEF576BFF57867E0D084E0A597BF7BF5C8E4ED1268477E88
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........u...u...u.E.t...u.....u...t...u..v...u..q...u..p...u..u...u......u..w...u.Rich..u.........PE..d.....y..........." ...".....`.......................................................5....`A........................................`C..4....K...............p.......\..PO...........-..p............................,..@............................................text............................... ..`.rdata...A.......B..................@..@.data...0....`.......D..............@....pdata.......p.......H..............@..@_RDATA..\............T..............@..@.rsrc................V..............@..@.reloc...............Z..............@..B................................................................................................................................................................................................................................

                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI70002\VCRUNTIME140_1.dll

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\Desktop\NEVER OPEN!.exe
                                                                                                                                                                                                                                            File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):49488
                                                                                                                                                                                                                                            Entropy (8bit):6.652691609629867
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:768:8EgYXUcHJcUJSDW/tfxL1qBS3hO6nb/TEHEXi9zufUKQXi9zug:8vGS8fZ1eUpreA+zuTc+zug
                                                                                                                                                                                                                                            MD5:BBA9680BC310D8D25E97B12463196C92
                                                                                                                                                                                                                                            SHA1:9A480C0CF9D377A4CAEDD4EA60E90FA79001F03A
                                                                                                                                                                                                                                            SHA-256:E0B66601CC28ECB171C3D4B7AC690C667F47DA6B6183BFF80604C84C00D265AB
                                                                                                                                                                                                                                            SHA-512:1575C786AC3324B17057255488DA5F0BC13AD943AC9383656BAF98DB64D4EC6E453230DE4CD26B535CE7E8B7D41A9F2D3F569A0EFF5A84AEB1C2F9D6E3429739
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..............L...L...L...M...L...M...L.FL...L...L...L...M...L...M...L...M...L...M...L..*L...L...M...LRich...L........................PE..d...%CU..........." ...".<...8.......A...............................................@....`A........................................0m.......m..x....................r..PO......D....c..p...........................pb..@............P..h............................text...0:.......<.................. ..`.rdata..."...P...$...@..............@..@.data................d..............@....pdata...............f..............@..@.rsrc................l..............@..@.reloc..D............p..............@..B................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI70002\_asyncio.pyd

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\Desktop\NEVER OPEN!.exe
                                                                                                                                                                                                                                            File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):35712
                                                                                                                                                                                                                                            Entropy (8bit):7.649102416316352
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:768:+2sbZA5n1we/lPgOb1koYpu53VnJ2gl+NfOlQI75n2VYiSyvPRPxWED:+2RhZtXxkoYiTTENKQI75n2V7SynRPx
                                                                                                                                                                                                                                            MD5:CD9D22812520B671EED3964DA7E5CDB9
                                                                                                                                                                                                                                            SHA1:ADE6CC31B7610CFAE8EE8D2BA61C2C3D123AC5C1
                                                                                                                                                                                                                                            SHA-256:00275ADF6FFE251CA6C46864D44B6F2F29341B76CE5C9E26EB11721CB8B134AB
                                                                                                                                                                                                                                            SHA-512:A07E008D39B1044D89151A871FFFB18EA82814BF12574D6D959EF28CD590F2A09242D739FD9ABC4F6A4E32D1EB8CBD813BCEDCCA524551EAC1E1D92E2E245491
                                                                                                                                                                                                                                            Malicious:true
                                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........TF.q.F.q.F.q.O...D.q...p.D.q...t.J.q...u.N.q...r.E.q...p.E.q...p.D.q.F.p...q...|.G.q...q.G.q....G.q...s.G.q.RichF.q.................PE..d...$..c.........." ...".`.......... #.......................................P............`..........................................J..P....I..P....@......................DK..$..................................../..@...........................................UPX0....................................UPX1.....`.......R..................@....rsrc........@.......V..............@......................................................................................................................................................................................................................................................................................................................................................3.96.UPX!.$..

                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI70002\_bz2.pyd

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\Desktop\NEVER OPEN!.exe
                                                                                                                                                                                                                                            File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):48504
                                                                                                                                                                                                                                            Entropy (8bit):7.773461990395197
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:768:7iQxyc/3D2HGItfsKbsonbgiHUoYVcW5I7tVbenYiSyv5PxWEDX:75xdEsKbtnbgqUoYt5I7tVb07SyxPx9
                                                                                                                                                                                                                                            MD5:758FFF1D194A7AC7A1E3D98BCF143A44
                                                                                                                                                                                                                                            SHA1:DE1C61A8E1FB90666340F8B0A34E4D8BFC56DA07
                                                                                                                                                                                                                                            SHA-256:F5E913A9F2ADF7D599EA9BB105E144BA11699BBCB1514E73EDCF7E062354E708
                                                                                                                                                                                                                                            SHA-512:468D7C52F14812D5BDE1E505C95CB630E22D71282BDA05BF66324F31560BFA06095CF60FC0D34877F8B361CCD65A1B61D0FD1F91D52FACB0BAF8E74F3FED31CC
                                                                                                                                                                                                                                            Malicious:true
                                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$....................a.........................................t.........................................Rich....................PE..d...2..c.........." ..."............pd....................................................`.............................................H.................... .. ..................................................hp..@...........................................UPX0....................................UPX1................................@....rsrc...............................@..............................................................................................................................................................................................................................................................................................................................................3.96.UPX!.$..

                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI70002\_ctypes.pyd

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\Desktop\NEVER OPEN!.exe
                                                                                                                                                                                                                                            File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):58232
                                                                                                                                                                                                                                            Entropy (8bit):7.821424155463504
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:1536:JUP3/jolpinLX2rRaWMzhB8yLI7QP7U7SykPxiM:u3/jolwXuRaW6SOI7QP7U2xB
                                                                                                                                                                                                                                            MD5:6CA9A99C75A0B7B6A22681AA8E5AD77B
                                                                                                                                                                                                                                            SHA1:DD1118B7D77BE6BB33B81DA65F6B5DC153A4B1E8
                                                                                                                                                                                                                                            SHA-256:D39390552C55D8FD4940864905CD4437BC3F8EFE7FF3CA220543B2C0EFAB04F8
                                                                                                                                                                                                                                            SHA-512:B0B5F2979747D2F6796D415DD300848F32B4E79EDE59827AC447AF0F4EA8709B60D6935D09E579299B3BC54B6C0F10972F17F6C0D1759C5388AD5B14689A23FE
                                                                                                                                                                                                                                            Malicious:true
                                                                                                                                                                                                                                            Preview:MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$.......NC..."..."..."...Z..."..E^..."..E^..."..E^..."..E^..."...^..."...P..."...P..."...K..."..."..."...^..."...^..."...^x.."...^..."..Rich."..........................PE..d.../..c.........." ...".........p..P........................................@............`.........................................H<.......9.......0..........,............<......................................X%..@...........................................UPX0.....p..............................UPX1................................@....rsrc........0......................@..............................................................................................................................................................................................................................................................................................................................3.96.UPX!.$..

                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI70002\_decimal.pyd

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\Desktop\NEVER OPEN!.exe
                                                                                                                                                                                                                                            File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):106368
                                                                                                                                                                                                                                            Entropy (8bit):7.935447983813077
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:3072:ggCMV2Mz94bMgxECS8kePpTn8XI75qNp8mx:g1MV2Mz94og2tJePpwFp
                                                                                                                                                                                                                                            MD5:EB45EA265A48348CE0AC4124CB72DF22
                                                                                                                                                                                                                                            SHA1:ECDC1D76A205F482D1ED9C25445FA6D8F73A1422
                                                                                                                                                                                                                                            SHA-256:3881F00DBC4AADF9E87B44C316D93425A8F6BA73D72790987226238DEFBC7279
                                                                                                                                                                                                                                            SHA-512:F7367BF2A2D221A7508D767AD754B61B2B02CDD7AE36AE25B306F3443D4800D50404AC7E503F589450ED023FF79A2FB1DE89A30A49AA1DD32746C3E041494013
                                                                                                                                                                                                                                            Malicious:true
                                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........|RTy..Ty..Ty..]...Zy......Vy......Yy......\y......Py......Wy......Vy..Ty...y......Uy......[y......Uy......Uy......Uy..RichTy..........PE..d...)..c.........." ...".p................................................... ............`.............................................P........................'......................................................@...........................................UPX0....................................UPX1.....p.......d..................@....rsrc................h..............@......................................................................................................................................................................................................................................................................................................................................................3.96.UPX!.$..

                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI70002\_hashlib.pyd

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\Desktop\NEVER OPEN!.exe
                                                                                                                                                                                                                                            File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):34688
                                                                                                                                                                                                                                            Entropy (8bit):7.615342100631813
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:768:aU3dM1TMhvg8KNML5TOuzSsI/RYdI75ImtYiSyvfPxWEabVV/:aedM1TMho8iMLPmv/KdI75Imt7SyXPxA
                                                                                                                                                                                                                                            MD5:0D723BC34592D5BB2B32CF259858D80E
                                                                                                                                                                                                                                            SHA1:EACFABD037BA5890885656F2485C2D7226A19D17
                                                                                                                                                                                                                                            SHA-256:F2B927AAA856D23F628B01380D5A19BFE9233DB39C9078C0E0585D376948C13F
                                                                                                                                                                                                                                            SHA-512:3E79455554D527D380ADCA39AC10DBF3914CA4980D8EE009B7DAF30AEB4E9359D9D890403DA9CC2B69327C695C57374C390FA780A8FD6148BBEA3136138EAD33
                                                                                                                                                                                                                                            Malicious:true
                                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........_.A.>...>...>...F2..>...B...>...B...>...B...>...B...>..iB...>...L...>...D...>...>..Q>..iB...>..iB...>..iB^..>..iB...>..Rich.>..........................PE..d.../..c.........." ...".P..........p........................................@............`..........................................;..P....9.......0.......................;......................................h*..@...........................................UPX0....................................UPX1.....P.......L..................@....rsrc........0.......P..............@......................................................................................................................................................................................................................................................................................................................................3.96.UPX!.$..

                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI70002\_lzma.pyd

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\Desktop\NEVER OPEN!.exe
                                                                                                                                                                                                                                            File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):86392
                                                                                                                                                                                                                                            Entropy (8bit):7.918616838915833
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:1536:I1KvmqFMCNL6eKmtYs76LBlBqLBxcZiV6IHxdc/k4Ncs7I7e1gT7SyJPxs:aqdLCOz76LBl4VxYcdc/19I7e1gTvxs
                                                                                                                                                                                                                                            MD5:ABCEECEAEFF3798B5B0DE412AF610F58
                                                                                                                                                                                                                                            SHA1:C3C94C120B5BED8BCCF8104D933E96AC6E42CA90
                                                                                                                                                                                                                                            SHA-256:216AA4BB6F62DD250FD6D2DCDE14709AA82E320B946A21EDEEC7344ED6C2C62E
                                                                                                                                                                                                                                            SHA-512:3E1A2EB86605AA851A0C5153F7BE399F6259ECAAD86DBCBF12EEAE5F985DC2EA2AB25683285E02B787A5B75F7DF70B4182AE8F1567946F99AD2EC7B27D4C7955
                                                                                                                                                                                                                                            Malicious:true
                                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......b.J[&.$.&.$.&.$./..".$.i.%.$.$.i.!.*.$.i. ...$.i.'.%.$...%.%.$...%.$.$.&.%.C.$...)...$...$.'.$.....'.$...&.'.$.Rich&.$.........PE..d...B..c.........." ...". ................................................................`.........................................4...L....................P..........................................................@...........................................UPX0....................................UPX1..... ..........................@....rsrc...............................@..............................................................................................................................................................................................................................................................................................................................................................3.96.UPX!.$..

                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI70002\_multiprocessing.pyd

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\Desktop\NEVER OPEN!.exe
                                                                                                                                                                                                                                            File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):25984
                                                                                                                                                                                                                                            Entropy (8bit):7.493810835339704
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:768:Gmy6HNbpr+8C6LSf93tePBI7Rt2lYiSyvPPxWEa5Z:d9+8FKR0PBI7Rt2l7SynPxeZ
                                                                                                                                                                                                                                            MD5:0D48797F8115161D1F4F607862C894F8
                                                                                                                                                                                                                                            SHA1:377E116CE713CEF85764A722D83A6E43BDAB30A7
                                                                                                                                                                                                                                            SHA-256:5D5C7C93157A6C483D03FEA46AAD60D91A53D87707D744FA7810134A0E6D2CD9
                                                                                                                                                                                                                                            SHA-512:A61119FDD99A2900AF4CC738BA4BB9ACD7171906F15DDDBCF27CD2D4830EA155BBB590C2B4E9459EA70A17285CCF5649EFACDA81F05B9EF15CE4E4BFA77CD73A
                                                                                                                                                                                                                                            Malicious:true
                                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........$Z*.E4y.E4y.E4y.=.y.E4y.95x.E4y.91x.E4y.90x.E4y.97x.E4yS95x.E4y.E5y.E4y?75x.E4yS99x.E4yS94x.E4yS9.y.E4yS96x.E4yRich.E4y........................PE..d...+..c.........." ...".0..........p.....................................................`.........................................4...`....................`......................................................x...@...........................................UPX0....................................UPX1.....0.......,..................@....rsrc................0..............@..............................................................................................................................................................................................................................................................................................................................................3.96.UPX!.$..

                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI70002\_overlapped.pyd

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\Desktop\NEVER OPEN!.exe
                                                                                                                                                                                                                                            File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):31616
                                                                                                                                                                                                                                            Entropy (8bit):7.5665023159396565
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:768:5k8GDYwKGtevarixdxu3dI7st2bYiSyvxPxWEa:2ETi93dI7st2b7SypPx
                                                                                                                                                                                                                                            MD5:D22D51B9F7E5273373A380B832905832
                                                                                                                                                                                                                                            SHA1:5B96CBD365101AFF5F9FEA55065A015ECFCD9725
                                                                                                                                                                                                                                            SHA-256:A56E339E622E613E0664705988A2166168873CFC9507385BB6F7AC17E0546701
                                                                                                                                                                                                                                            SHA-512:93B3C5031A67F2EC68BF6F12A795CE7DCA87D04D470E7097B47E8C1C2FB246C4D8D56FF4C6EC61D271815EB79FEFAE311A05D135B0B69CEC012D319DBBB4C40B
                                                                                                                                                                                                                                            Malicious:true
                                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........({..F(..F(..F(...(..F(..G)..F(..C)..F(..B)..F(..E)..F(..G)..F(..G(..F(c.G)..F(c.B)..F(..K)..F(..F)..F(...(..F(..D)..F(Rich..F(................PE..d...-..c.........." ...".@................................................................`.........................................x...X...............................................................................@...........................................UPX0....................................UPX1.....@.......@..................@....rsrc................D..............@..............................................................................................................................................................................................................................................................................................................................................3.96.UPX!.$..

                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI70002\_queue.pyd

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\Desktop\NEVER OPEN!.exe
                                                                                                                                                                                                                                            File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):24960
                                                                                                                                                                                                                                            Entropy (8bit):7.453287262532455
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:384:rQpaT/6xXedjhX9CYLxhfcggnUxaVXALAZI77U2NuIYiSy1pCQAqfUvPxh8E9VFX:DSxw19p9uzZI77U2xYiSyvlfUvPxWEl
                                                                                                                                                                                                                                            MD5:0D267BB65918B55839A9400B0FB11AA2
                                                                                                                                                                                                                                            SHA1:54E66A14BEA8AE551AB6F8F48D81560B2ADD1AFC
                                                                                                                                                                                                                                            SHA-256:13EE41980B7D0FB9CE07F8E41EE6A309E69A30BBF5B801942F41CBC357D59E9C
                                                                                                                                                                                                                                            SHA-512:C2375F46A98E44F54E2DD0A5CC5F016098500090BB78DE520DC5E05AEF8E6F11405D8F6964850A03060CAED3628D0A6303091CBA1F28A0AA9B3B814217D71E56
                                                                                                                                                                                                                                            Malicious:true
                                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........._ZF.1.F.1.F.1.O..D.1...0.D.1...4.J.1...5.N.1...2.E.1...0.E.1...0.D.1.F.0...1...<.G.1...1.G.1.....G.1...3.G.1.RichF.1.........PE..d...&..c.........." ...".0..........`.....................................................`.............................................L.......P............`..............<.......................................X...@...........................................UPX0....................................UPX1.....0.......(..................@....rsrc................,..............@..............................................................................................................................................................................................................................................................................................................................................................3.96.UPX!.$..

                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI70002\_socket.pyd

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\Desktop\NEVER OPEN!.exe
                                                                                                                                                                                                                                            File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):42880
                                                                                                                                                                                                                                            Entropy (8bit):7.6996745691481285
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:768:GL7Syo5lzOt+ufVwPVXahccu0D+gFiPnmJsSK0I7QwbmAYiSyvb9ZPxWEl:mkbzcKNGu0yXwbK0I7QwbmA7Syj/Px
                                                                                                                                                                                                                                            MD5:AFD296823375E106C4B1AC8B39927F8B
                                                                                                                                                                                                                                            SHA1:B05D811E5A5921D5B5CC90B9E4763FD63783587B
                                                                                                                                                                                                                                            SHA-256:E423A7C2CE5825DFDD41CFC99C049FF92ABFB2AA394C85D0A9A11DE7F8673007
                                                                                                                                                                                                                                            SHA-512:95E98A24BE9E603B2870B787349E2AA7734014AC088C691063E4078E11A04898C9C547D6998224B1B171FC4802039C3078A28C7E81D59F6497F2F9230D8C9369
                                                                                                                                                                                                                                            Malicious:true
                                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........Z..{4..{4..{4......{4...5..{4...1..{4...0..{4...7..{4.U.5..{4..{5.\{4.9.5..{4.U.9..{4.U.4..{4.U....{4.U.6..{4.Rich.{4.........................PE..d...0..c.........." ...".p..........0m....................................................`.............................................P.......h............ ..l...........X.......................................8y..@...........................................UPX0....................................UPX1.....p.......l..................@....rsrc................p..............@..............................................................................................................................................................................................................................................................................................................................................3.96.UPX!.$..

                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI70002\_sqlite3.pyd

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\Desktop\NEVER OPEN!.exe
                                                                                                                                                                                                                                            File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):50048
                                                                                                                                                                                                                                            Entropy (8bit):7.763546199450955
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:1536:u8Mdv1OCWk0z+q3QCjbouAfI75QrA7SyDPx:hQO00zrrvbgI75QrANx
                                                                                                                                                                                                                                            MD5:7B45AFC909647C373749EF946C67D7CF
                                                                                                                                                                                                                                            SHA1:81F813C1D8C4B6497C01615DCB6AA40B92A7BD20
                                                                                                                                                                                                                                            SHA-256:A5F39BFD2B43799922E303A3490164C882F6E630777A3A0998E89235DC513B5E
                                                                                                                                                                                                                                            SHA-512:FE67E58F30A2C95D7D42A102ED818F4D57BAA524C5C2D781C933DE201028C75084C3E836FF4237E066F3C7DD6A5492933C3DA3FEE76EB2C50A6915996EF6D7FB
                                                                                                                                                                                                                                            Malicious:true
                                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......8..|...|...|...u...z...3...~...3.~.}...3...q...3...t...3..........y.......~...|..........u......}....|.}......}...Rich|...........PE..d...[..c.........." ...".........@..0....P................................................`.............................................P.......4............`..............(.......................................(...@...........................................UPX0.....@..............................UPX1.........P......................@....rsrc...............................@......................................................................................................................................................................................................................................................................................................................................................3.96.UPX!.$..

                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI70002\_ssl.pyd

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\Desktop\NEVER OPEN!.exe
                                                                                                                                                                                                                                            File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):62328
                                                                                                                                                                                                                                            Entropy (8bit):7.850362561913567
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:1536:CedJItp3BP6kGsJMthwMtbyG68sj8I7t7QOC7SycPxu:P8tVBPpGsUt+usYI7t7QT+xu
                                                                                                                                                                                                                                            MD5:1E643C629F993A63045B0FF70D6CF7C6
                                                                                                                                                                                                                                            SHA1:9AF2D22226E57DC16C199CAD002E3BEB6A0A0058
                                                                                                                                                                                                                                            SHA-256:4A50B4B77BF9E5D6F62C7850589B80B4CAA775C81856B0D84CB1A73D397EB38A
                                                                                                                                                                                                                                            SHA-512:9D8CD6E9C03880CC015E87059DB28FF588881679F8E3F5A26A90F13E2C34A5BD03FB7329D9A4E33C4A01209C85A36FC999E77D9ECE42CEBDB738C2F1FD6775AF
                                                                                                                                                                                                                                            Malicious:true
                                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......,z..h.gLh.gLh.gLac.Ln.gL'gfMj.gL'gbMe.gL'gcM`.gL'gdMk.gL.gfMj.gL.afMl.gLh.fL..gL.ifMo.gL.gjMj.gL.ggMi.gL.g.Li.gL.geMi.gLRichh.gL................PE..d...3..c.........." ..."............ .....................................................`.........................................p...d....................P......................................................(...@...........................................UPX0....................................UPX1................................@....rsrc...............................@..............................................................................................................................................................................................................................................................................................................................................3.96.UPX!.$..

                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI70002\_uuid.pyd

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\Desktop\NEVER OPEN!.exe
                                                                                                                                                                                                                                            File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):22400
                                                                                                                                                                                                                                            Entropy (8bit):7.361536802022009
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:384:YbjUslT24o0uNnUxaVXALkpiI7ewWYcIYiSy1pCQDMaPxh8E9VF0Nyvzo:6j3lKNfpiI7ewWQYiSyvfPxWEx
                                                                                                                                                                                                                                            MD5:81DFA68CA3CB20CED73316DBC78423F6
                                                                                                                                                                                                                                            SHA1:8841CF22938AA6EE373FF770716BB9C6D9BC3E26
                                                                                                                                                                                                                                            SHA-256:D0CB6DD98A2C9D4134C6EC74E521BAD734BC722D6A3B4722428BF79E7B66F190
                                                                                                                                                                                                                                            SHA-512:E24288AE627488251682CD47C1884F2DC5F4CD834D7959B9881E5739C42D91FD0A30E75F0DE77F5B5A0D63D9BAEBCAFA56851E7E40812DF367FD433421C0CCDB
                                                                                                                                                                                                                                            Malicious:true
                                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........;$p^ZJ#^ZJ#^ZJ#W".#\ZJ#.&K"\ZJ#.&O"RZJ#.&N"VZJ#.&I"]ZJ#.&K"\ZJ#.(K"[ZJ#^ZK#tZJ#.&B"_ZJ#.&J"_ZJ#.&.#_ZJ#.&H"_ZJ#Rich^ZJ#................PE..d...+..c.........." ...". .......`.......p................................................`.........................................8...L....................@......................................................x...@...........................................UPX0.....`..............................UPX1..... ...p......................@....rsrc................"..............@......................................................................................................................................................................................................................................................................................................................................................3.96.UPX!.$..

                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI70002\_win32sysloader.pyd

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\Desktop\NEVER OPEN!.exe
                                                                                                                                                                                                                                            File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):11776
                                                                                                                                                                                                                                            Entropy (8bit):6.772611075994812
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:192:lpadimkU6KnFt4Zdcpbd8m5OonxCe4W7Oj5aLRkyUxaVXFaL2cxa/UQ0D:C4KFtycpbd8EOonxCeZOFaLRnUxaVXAt
                                                                                                                                                                                                                                            MD5:CA5D703BECCFFFB4CEF13729E56DE725
                                                                                                                                                                                                                                            SHA1:F5AEB8D98D4FEDE04F3EF76A8C2E3A6AC5CE1C64
                                                                                                                                                                                                                                            SHA-256:3113117C0B67CD9532053ADEE0D87A83B32E9EEC4101BEA437EE3AB3F6D1D6A2
                                                                                                                                                                                                                                            SHA-512:BED0F5490DA5593C7C94C9F292B5FB2698A6040A8F4FB1151709BED3E450D55E8D74F9B558EEB0893EA89BF01B05A5DF714B67CFC2B419A52E0C2C00BB2A16AA
                                                                                                                                                                                                                                            Malicious:true
                                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......tSf.02..02..02..9J..22..bG..22..$Y..22..bG..;2..bG..82..bG..32..[..32..02...2...G..12...G..12...G..12..Rich02..................PE..d......d.........." .....0.......... .....................................................`.............................................`...x...P.......x....`..............(...........................................8...........................................UPX0....................................UPX1.....0.......$..................@....rsrc................(..............@..............................................................................................................................................................................................................................................................................................................................................................3.96.UPX!.$..

                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI70002\aiohttp\_helpers.cp310-win_amd64.pyd

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\Desktop\NEVER OPEN!.exe
                                                                                                                                                                                                                                            File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):26112
                                                                                                                                                                                                                                            Entropy (8bit):7.670706649814581
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:768:HAgts4wZXjNKzfSpVzDaDywUIHruBnZ356:HxtJijNppVdIL6X6
                                                                                                                                                                                                                                            MD5:D76A7F9B8481AEE6DB8555A88F3EEE13
                                                                                                                                                                                                                                            SHA1:A50C77A84B8FCBC393F91244CBC8FE98D7FDE74C
                                                                                                                                                                                                                                            SHA-256:1EF0FDCB5EFE630D7674AE83D9BF82DAEE980BA5F3C6ACB76F148FFE2148C008
                                                                                                                                                                                                                                            SHA-512:502C6AC9DB73C852ABFFA59B74243D646AD005F94DEF2B7DCA2E441C74FBA3D1F3955EF0C11D2FC19A47B2D705128AC0F84D68C725129C53F72D5C3CCF5287E3
                                                                                                                                                                                                                                            Malicious:true
                                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........oB[..,...,...,..v....,...-...,..v-...,.../...,...(...,...)...,.f{-...,...-...,..$...,..,...,......,......,.Rich..,.........................PE..d....A.g.........." ...).`..........0?.......................................`............`.........................................@R..`....P..P....P.......................R......................................(K..@...........................................UPX0....................................UPX1.....`.......^..................@....rsrc........P.......b..............@..............................................................................................................................................................................................................................................................................................................................................3.96.UPX!.$..

                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI70002\aiohttp\_http_parser.cp310-win_amd64.pyd

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\Desktop\NEVER OPEN!.exe
                                                                                                                                                                                                                                            File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):82944
                                                                                                                                                                                                                                            Entropy (8bit):7.949991955133753
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:1536:7DJzqoj6kwZ0YWPXwlnsYUdjecK7UBopf3YcjRNt3WMdaNvalbgEM9xI:7DYoj6k/YKgtsYuw7UB4YQRpa
                                                                                                                                                                                                                                            MD5:858F1D3F9D32C1E6A35C8C5C81E5A5E8
                                                                                                                                                                                                                                            SHA1:4A2AF60C0DB12ADB12AFE781F9FC9675D11D1B9E
                                                                                                                                                                                                                                            SHA-256:8A26BCFBD4797E6713BE6F5E5ABDA60747BBD6C9CF58B983CD79AB86A990275C
                                                                                                                                                                                                                                            SHA-512:EC5EE5A38A2240913673535A95E1CB329BE1E835B1F1C7F68B153513DB152F70029204E118397D7A215F05025D851137EF971C83E3D7BE093C9D682311DCF03F
                                                                                                                                                                                                                                            Malicious:true
                                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........9...WR..WR..WR...R..WR.kVS..WR.VS..WRj.VS..WR..VRF.WR.kTS..WR.kSS..WR.kRS..WR.j_S..WR.jWS..WR.j.R..WR.jUS..WRRich..WR........................PE..d....A.g.........." ...).@.......p.. .....................................................`..................................................................@..............\...........................................@...........................................UPX0.....p..............................UPX1.....@.......8..................@....rsrc................<..............@..............................................................................................................................................................................................................................................................................................................................................3.96.UPX!.$..

                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI70002\aiohttp\_http_writer.cp310-win_amd64.pyd

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\Desktop\NEVER OPEN!.exe
                                                                                                                                                                                                                                            File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):25088
                                                                                                                                                                                                                                            Entropy (8bit):7.716205811403458
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:768:agf7VnuWhwjmpHKTjQ6j0+l123fPA/f9:agf7VnWUHKTjjmvI/V
                                                                                                                                                                                                                                            MD5:305F44C62CF1E39AD97CEFE02D16E52D
                                                                                                                                                                                                                                            SHA1:77F2FD9A86702DDF56813EEDCC7D26E014AA7E28
                                                                                                                                                                                                                                            SHA-256:9A156861ED877D905D4CF1F1BCC45BA0C4B33AE961138B75B817018454C8BBF7
                                                                                                                                                                                                                                            SHA-512:30E485D6802F572F8D7F5E49DA17059E041850B2B9CF3FDAB99F4B097A2A15F99EFF5113C60CDAAC0338C8C56EBCBAFB5A309293786CD9085BAB8E526FAFC73B
                                                                                                                                                                                                                                            Malicious:true
                                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........o.T.............v?..............v..............................b{..........4................S...........Rich....................PE..d....A.g.........." ...).`...........l... ................................................`.........................................@...h.......P............ ..0....................................................x..@...........................................UPX0....................................UPX1.....`... ...Z..................@....rsrc................^..............@......................................................................................................................................................................................................................................................................................................................................................3.96.UPX!.$..

                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI70002\aiohttp\_websocket.cp310-win_amd64.pyd

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\Desktop\NEVER OPEN!.exe
                                                                                                                                                                                                                                            File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):20480
                                                                                                                                                                                                                                            Entropy (8bit):7.543311887865824
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:384:alZn4Hp1CV3K/CqTERpJz08tWrPPBE0nUxaVXALeD:alF0X/CqTCJzGV
                                                                                                                                                                                                                                            MD5:3EE2A9C44E8E057107B6DA68572451E9
                                                                                                                                                                                                                                            SHA1:BE80779B8BB447F40E80A526DAEFA1028738422A
                                                                                                                                                                                                                                            SHA-256:95ADAEC9FE8FE1EAD0B7199298D813FC8A01052D9868D5633BAA89E6F59A5E61
                                                                                                                                                                                                                                            SHA-512:249CB0F40307968055994AE49776DACCF38B0E42955F2DE4F0E14F788A96C69115F25AF05549D9E27F99632592E4C8E39CA44DA9F49A9BBDA6ADFC246320AC53
                                                                                                                                                                                                                                            Malicious:true
                                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........oB[..,...,...,..v....,...-...,..v-...,.../...,...(...,...)...,.f{-...,...-.%.,..$...,..,...,......,......,.Rich..,.........................PE..d....A.g.........." ...).P..........p.....................................................`.........................................@...d.......P...............4...................................................h...@...........................................UPX0....................................UPX1.....P.......H..................@....rsrc................L..............@..............................................................................................................................................................................................................................................................................................................................................3.96.UPX!.$..

                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI70002\altgraph-0.17.4.dist-info\INSTALLER

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\Desktop\NEVER OPEN!.exe
                                                                                                                                                                                                                                            File Type:ASCII text
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):4
                                                                                                                                                                                                                                            Entropy (8bit):1.5
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:3:Mn:M
                                                                                                                                                                                                                                            MD5:365C9BFEB7D89244F2CE01C1DE44CB85
                                                                                                                                                                                                                                            SHA1:D7A03141D5D6B1E88B6B59EF08B6681DF212C599
                                                                                                                                                                                                                                            SHA-256:CEEBAE7B8927A3227E5303CF5E0F1F7B34BB542AD7250AC03FBCDE36EC2F1508
                                                                                                                                                                                                                                            SHA-512:D220D322A4053D84130567D626A9F7BB2FB8F0B854DA1621F001826DC61B0ED6D3F91793627E6F0AC2AC27AEA2B986B6A7A63427F05FE004D8A2ADFBDADC13C1
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:pip.

                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI70002\altgraph-0.17.4.dist-info\LICENSE

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\Desktop\NEVER OPEN!.exe
                                                                                                                                                                                                                                            File Type:ASCII text
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):1002
                                                                                                                                                                                                                                            Entropy (8bit):5.178870450986544
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:24:wy+rmJHcwH0MP3gt99QHOsUv4eOk4/+/m3oqMSFJ:9+aJ8YHvEnQHOs5exm3oEFJ
                                                                                                                                                                                                                                            MD5:3590EB8D695BDCEA3BA57E74ADF8A4ED
                                                                                                                                                                                                                                            SHA1:5B3C3863D521CF35E75E36A22E5EC4A80C93C528
                                                                                                                                                                                                                                            SHA-256:6C194D6DB0C64D45535D10C95142B9B0CDA7B7DCC7F1DDEE302B3D536F3DBE46
                                                                                                                                                                                                                                            SHA-512:405E4F136E282352DF9FC60C2CE126E26A344DD63F92AAB0E77DE60694BD155A13CF41C13E88C00FB95032A90526AD32C9E4B7D53CA352E03C3882ED648821F0
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:Copyright (c) 2004 Istvan Albert unless otherwise noted..Copyright (c) 2006-2010 Bob Ippolito.Copyright (2) 2010-2020 Ronald Oussoren, et. al...Permission is hereby granted, free of charge, to any person obtaining a copy.of this software and associated documentation files (the "Software"), to.deal in the Software without restriction, including without limitation the.rights to use, copy, modify, merge, publish, distribute, sublicense,.and/or sell copies of the Software, and to permit persons to whom the.Software is furnished to do so...THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR.IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,.FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE.AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER.LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING.FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS.IN THE SOFTWARE

                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI70002\altgraph-0.17.4.dist-info\METADATA

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\Desktop\NEVER OPEN!.exe
                                                                                                                                                                                                                                            File Type:ASCII text
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):7264
                                                                                                                                                                                                                                            Entropy (8bit):4.9335139350342505
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:96:D4lWAqZjaaYxmPktjas13ieOGZND9REZ4y+KezAYx09zB5KENViyh5YZXc9Me6WW:QqW8GZNjiui9KUQHDyKtZx
                                                                                                                                                                                                                                            MD5:22177E21CADF554A961F1EB13DA4CEAF
                                                                                                                                                                                                                                            SHA1:35610F8C8AE735AC6A03C7556B55170248748D6B
                                                                                                                                                                                                                                            SHA-256:691116CB60E4B1DD5554077804932FD0290357120FC9921F03D27664526B1295
                                                                                                                                                                                                                                            SHA-512:A213C826D1B84BD7207BB6FA652B2F618D27B05ABC9F308086D704FD6A5D4A26BE75522786EC77C650AB52D35D2B34A6096BCBD9553D8C7AC1372EE4B59F72B3
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:Metadata-Version: 2.1.Name: altgraph.Version: 0.17.4.Summary: Python graph (network) package.Home-page: https://altgraph.readthedocs.io.Download-URL: http://pypi.python.org/pypi/altgraph.Author: Ronald Oussoren.Author-email: ronaldoussoren@mac.com.Maintainer: Ronald Oussoren.Maintainer-email: ronaldoussoren@mac.com.License: MIT.Keywords: graph.Platform: any.Classifier: Intended Audience :: Developers.Classifier: License :: OSI Approved :: MIT License.Classifier: Programming Language :: Python.Classifier: Programming Language :: Python :: 2.Classifier: Programming Language :: Python :: 2.7.Classifier: Programming Language :: Python :: 3.Classifier: Programming Language :: Python :: 3.4.Classifier: Programming Language :: Python :: 3.5.Classifier: Programming Language :: Python :: 3.6.Classifier: Programming Language :: Python :: 3.7.Classifier: Programming Language :: Python :: 3.8.Classifier: Programming Language :: Python :: 3.9.Classifier: Programming Language :: Python :: 3.10.Class

                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI70002\altgraph-0.17.4.dist-info\RECORD

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\Desktop\NEVER OPEN!.exe
                                                                                                                                                                                                                                            File Type:CSV text
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):1466
                                                                                                                                                                                                                                            Entropy (8bit):5.80543063460573
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:24:Hzn/2zDiTzv5MIzZOTzHz4BsXWzlrIhikTz39+SWUz4EUbR4w1+4V1LkzcRG2lkx:HznuXiTzyIzYTzHz4TzlriHTz39+7I4a
                                                                                                                                                                                                                                            MD5:8F6CAAF90B4C653279EFD81CCFFFF5E3
                                                                                                                                                                                                                                            SHA1:A95049B0512A670C609D9FF2AD68CBDC62712BCA
                                                                                                                                                                                                                                            SHA-256:2D8DCE3D5542EC6ABA57299511AE6BD61EBD4789C52AE67715E219B616CC356C
                                                                                                                                                                                                                                            SHA-512:304185EE1A09C94D73C1D2D98FA5694F7BE2E5475111EE03C491FAC79F3C888D4E63C2D564B7611C339A9589A7B26E4D67E8638A887257EDB61864E20958E2B3
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:altgraph-0.17.4.dist-info/INSTALLER,sha256=zuuue4knoyJ-UwPPXg8fezS7VCrXJQrAP7zeNuwvFQg,4..altgraph-0.17.4.dist-info/LICENSE,sha256=bBlNbbDGTUVTXRDJUUK5sM2nt9zH8d3uMCs9U289vkY,1002..altgraph-0.17.4.dist-info/METADATA,sha256=aREWy2Dksd1VVAd4BJMv0CkDVxIPyZIfA9J2ZFJrEpU,7264..altgraph-0.17.4.dist-info/RECORD,,..altgraph-0.17.4.dist-info/WHEEL,sha256=a-zpFRIJzOq5QfuhBzbhiA1eHTzNCJn8OdRvhdNX0Rk,110..altgraph-0.17.4.dist-info/top_level.txt,sha256=HEBeRWf5ItVPc7Y9hW7hGlrLXZjPoL4by6CAhBV_BwA,9..altgraph-0.17.4.dist-info/zip-safe,sha256=AbpHGcgLb-kRsJGnwFEktk7uzpZOCcBY74-YBdrKVGs,1..altgraph/Dot.py,sha256=gKEp6Su_CoOWQYt5HIVs_7MBYK1BEOhKX0RLAAA-vQs,9929..altgraph/Graph.py,sha256=6b6fSHLA5QSqMDnSHIO7_WJnBYIdq3K5Bt8VipRODwg,20788..altgraph/GraphAlgo.py,sha256=Uu9aTjSKWi38iQ_e9ZrwCnzQaI1WWFDhJ6kfmu0jxAA,5645..altgraph/GraphStat.py,sha256=LKya4BKXJ5GZi5-sNYU17aOBTLxqn_tVgbiw4sWGYIU,1888..altgraph/GraphUtil.py,sha256=1T4DJc2bJn6EIU_Ct4m0oiKlXWkXvqcXE8CGL2K9en8,3990..altgraph/ObjectGraph.py,sha256=o7f

                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI70002\altgraph-0.17.4.dist-info\WHEEL

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\Desktop\NEVER OPEN!.exe
                                                                                                                                                                                                                                            File Type:ASCII text
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):110
                                                                                                                                                                                                                                            Entropy (8bit):4.798786725303218
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:3:RtEeX7MWcSlVlhVMSgP+tPCCf7irO5S:RtBMwlVSZWBBwt
                                                                                                                                                                                                                                            MD5:F1EFFD0B429F462BD08132474A8B4FA6
                                                                                                                                                                                                                                            SHA1:A9D3050AF622BDA1BD73C00DC377625FF44D2559
                                                                                                                                                                                                                                            SHA-256:6BECE9151209CCEAB941FBA10736E1880D5E1D3CCD0899FC39D46F85D357D119
                                                                                                                                                                                                                                            SHA-512:EF7D53063CFCB54155F4C700C9E99ADBA9BF6085296B8CF1E3AB86767B7C96D1A4EBF4F6B19D4942DA7F6CBC0AC25DFEA8EAE4CE461B1701CB1ACF9B2B68BB6D
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:Wheel-Version: 1.0.Generator: bdist_wheel (0.40.0).Root-Is-Purelib: true.Tag: py2-none-any.Tag: py3-none-any..

                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI70002\altgraph-0.17.4.dist-info\top_level.txt

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\Desktop\NEVER OPEN!.exe
                                                                                                                                                                                                                                            File Type:ASCII text
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):9
                                                                                                                                                                                                                                            Entropy (8bit):2.94770277922009
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:3:gRUEv:gee
                                                                                                                                                                                                                                            MD5:BEB0CA64AA7DD6722F65930793F447D5
                                                                                                                                                                                                                                            SHA1:9BBA1BCE17FB25BDC9E6AA7AD8077999422EFD86
                                                                                                                                                                                                                                            SHA-256:1C405E4567F922D54F73B63D856EE11A5ACB5D98CFA0BE1BCBA08084157F0700
                                                                                                                                                                                                                                            SHA-512:BC4C40BCC527A9E40A934B6B594278A89625C9142795582C223E227A2D6ECCEB3233F10AA790E87D44171207AC0FEAC09581BD63C71937F97BB8F07E8CC88F30
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:altgraph.

                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI70002\altgraph-0.17.4.dist-info\zip-safe

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\Desktop\NEVER OPEN!.exe
                                                                                                                                                                                                                                            File Type:very short file (no magic)
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):1
                                                                                                                                                                                                                                            Entropy (8bit):0.0
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:3:v:v
                                                                                                                                                                                                                                            MD5:68B329DA9893E34099C7D8AD5CB9C940
                                                                                                                                                                                                                                            SHA1:ADC83B19E793491B1C6EA0FD8B46CD9F32E592FC
                                                                                                                                                                                                                                            SHA-256:01BA4719C80B6FE911B091A7C05124B64EEECE964E09C058EF8F9805DACA546B
                                                                                                                                                                                                                                            SHA-512:BE688838CA8686E5C90689BF2AB585CEF1137C999B48C70B92F67A5C34DC15697B5D11C982ED6D71BE1E1E7F7B4E0733884AA97C3F7A339A8ED03577CF74BE09
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:.

                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI70002\attrs-23.1.0.dist-info\INSTALLER

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\Desktop\NEVER OPEN!.exe
                                                                                                                                                                                                                                            File Type:ASCII text
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):4
                                                                                                                                                                                                                                            Entropy (8bit):1.5
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:3:Mn:M
                                                                                                                                                                                                                                            MD5:365C9BFEB7D89244F2CE01C1DE44CB85
                                                                                                                                                                                                                                            SHA1:D7A03141D5D6B1E88B6B59EF08B6681DF212C599
                                                                                                                                                                                                                                            SHA-256:CEEBAE7B8927A3227E5303CF5E0F1F7B34BB542AD7250AC03FBCDE36EC2F1508
                                                                                                                                                                                                                                            SHA-512:D220D322A4053D84130567D626A9F7BB2FB8F0B854DA1621F001826DC61B0ED6D3F91793627E6F0AC2AC27AEA2B986B6A7A63427F05FE004D8A2ADFBDADC13C1
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:pip.

                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI70002\attrs-23.1.0.dist-info\METADATA

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\Desktop\NEVER OPEN!.exe
                                                                                                                                                                                                                                            File Type:HTML document, Unicode text, UTF-8 text
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):11348
                                                                                                                                                                                                                                            Entropy (8bit):5.155260943272538
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:192:j/sUYExPRtXLt5Yy9EqOmoKTioEJdQ/0GmlWEx+VqAI6OfmEIPSo9t+kwLaH:j/sW6y9EqHoKvgAml9rqOnQLy8
                                                                                                                                                                                                                                            MD5:7774D77D730C0C295CB6E3E46817DAD6
                                                                                                                                                                                                                                            SHA1:406B5C84945B8DC1035BD53EB33F289B9AE699FC
                                                                                                                                                                                                                                            SHA-256:CA0970517928EF943E209E8B98F550E18F7D2894B708F2B4356F28BD7158B038
                                                                                                                                                                                                                                            SHA-512:6E991F3144CCA536E906A180DA7FAF3198521C81EFF4143FB943ECC6C6FAA558D0B1F2AA1379A7294BAA039D67202C671027D12C821D95B859EC25E0F78C2C21
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:Metadata-Version: 2.1.Name: attrs.Version: 23.1.0.Summary: Classes Without Boilerplate.Project-URL: Documentation, https://www.attrs.org/.Project-URL: Changelog, https://www.attrs.org/en/stable/changelog.html.Project-URL: Bug Tracker, https://github.com/python-attrs/attrs/issues.Project-URL: Source Code, https://github.com/python-attrs/attrs.Project-URL: Funding, https://github.com/sponsors/hynek.Project-URL: Tidelift, https://tidelift.com/subscription/pkg/pypi-attrs?utm_source=pypi-attrs&utm_medium=pypi.Author-email: Hynek Schlawack <hs@ox.cx>.License-Expression: MIT.License-File: LICENSE.Keywords: attribute,boilerplate,class.Classifier: Development Status :: 5 - Production/Stable.Classifier: Intended Audience :: Developers.Classifier: License :: OSI Approved :: MIT License.Classifier: Programming Language :: Python :: 3.7.Classifier: Programming Language :: Python :: 3.8.Classifier: Programming Language :: Python :: 3.9.Classifier: Programming Language :: Python :: 3.10.Classifier: P

                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI70002\attrs-23.1.0.dist-info\RECORD

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\Desktop\NEVER OPEN!.exe
                                                                                                                                                                                                                                            File Type:CSV text
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):3642
                                                                                                                                                                                                                                            Entropy (8bit):5.807416853955938
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:96:QalxI0guUoqipQEqdwBxTGNmmUuAqG2PX2rUXjiFcoqL/+Q:zaUoUTGwnuA2XE9Q
                                                                                                                                                                                                                                            MD5:A3AD7B8CDA8539786366BBBEC93D29AD
                                                                                                                                                                                                                                            SHA1:D79FE6C3773C0E56AB64F6288B2CEF36BACC10A6
                                                                                                                                                                                                                                            SHA-256:0C4D6F02B4FECD5A3A81D45A6D684D38998F2A8DAB51490548A27D85A5377299
                                                                                                                                                                                                                                            SHA-512:03A7FBF8AE5FB6C4BAD790EDC6C3479BB604FB7E3F8CCCCB96FE7A8EF45DCEB1BCF12415D51437C5048AA01183A3CD0E55D5A64FA1E7B22D7DAB8031822ED77B
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:attr/__init__.py,sha256=dSRUBxRVTh-dXMrMR_oQ3ZISu2QSfhSZlik03Mjbu30,3241..attr/__init__.pyi,sha256=rIK-2IakIoehVtqXK5l5rs9_fJNCbnYtKTS3cOAVJD8,17609..attr/__pycache__/__init__.cpython-310.pyc,,..attr/__pycache__/_cmp.cpython-310.pyc,,..attr/__pycache__/_compat.cpython-310.pyc,,..attr/__pycache__/_config.cpython-310.pyc,,..attr/__pycache__/_funcs.cpython-310.pyc,,..attr/__pycache__/_make.cpython-310.pyc,,..attr/__pycache__/_next_gen.cpython-310.pyc,,..attr/__pycache__/_version_info.cpython-310.pyc,,..attr/__pycache__/converters.cpython-310.pyc,,..attr/__pycache__/exceptions.cpython-310.pyc,,..attr/__pycache__/filters.cpython-310.pyc,,..attr/__pycache__/setters.cpython-310.pyc,,..attr/__pycache__/validators.cpython-310.pyc,,..attr/_cmp.py,sha256=diMUQV-BIg7IjIb6-o1hswtnjrR4qdAUz_tE8gxS96w,4098..attr/_cmp.pyi,sha256=sGQmOM0w3_K4-X8cTXR7g0Hqr290E8PTObA9JQxWQqc,399..attr/_compat.py,sha256=d3cpIu60IbKrLywPni17RUEQY7MvkqqKifyzJ5H3zRU,5803..attr/_config.py,sha256=5W8lgRePuIOWu1ZuqF1899e2CmXGc9

                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI70002\attrs-23.1.0.dist-info\WHEEL

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\Desktop\NEVER OPEN!.exe
                                                                                                                                                                                                                                            File Type:ASCII text
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):87
                                                                                                                                                                                                                                            Entropy (8bit):4.699003560068366
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:3:RtEeXAaCQnvxP+tPCCfA5I:Rt2PQZWBB3
                                                                                                                                                                                                                                            MD5:14CCD3CE79ED5ED7DAD2420CD7C0D412
                                                                                                                                                                                                                                            SHA1:388B959646735E0095900E61F3AF8A90F594F0A3
                                                                                                                                                                                                                                            SHA-256:108D89B06C9DC142F918FF6DEA4CD9BFB1B71C33E2EC5B990C37FD227E9A9913
                                                                                                                                                                                                                                            SHA-512:6EA1321D7F62E8284C3C5B29A3D7940890A4488503832457BF6580108351C0B2A0EE871928561DFF7F71C9BA9D1B89B2D93C1C5839EEC4815032E89E670934B4
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:Wheel-Version: 1.0.Generator: hatchling 1.14.0.Root-Is-Purelib: true.Tag: py3-none-any.

                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI70002\attrs-23.1.0.dist-info\licenses\LICENSE

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\Desktop\NEVER OPEN!.exe
                                                                                                                                                                                                                                            File Type:ASCII text
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):1109
                                                                                                                                                                                                                                            Entropy (8bit):5.104415762129373
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:24:bGf8rUrmJHHH0yN3gtsHw1hC09QHOsUv4eOk4/+/m3oqLFh:bW8rUaJHlxE3dQHOs5exm3ogFh
                                                                                                                                                                                                                                            MD5:5E55731824CF9205CFABEAB9A0600887
                                                                                                                                                                                                                                            SHA1:243E9DD038D3D68C67D42C0C4BA80622C2A56246
                                                                                                                                                                                                                                            SHA-256:882115C95DFC2AF1EEB6714F8EC6D5CBCABF667CAFF8729F42420DA63F714E9F
                                                                                                                                                                                                                                            SHA-512:21B242BF6DCBAFA16336D77A40E69685D7E64A43CC30E13E484C72A93CD4496A7276E18137DC601B6A8C3C193CB775DB89853ECC6D6EB2956DEEE36826D5EBFE
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:The MIT License (MIT)..Copyright (c) 2015 Hynek Schlawack and the attrs contributors..Permission is hereby granted, free of charge, to any person obtaining a copy.of this software and associated documentation files (the "Software"), to deal.in the Software without restriction, including without limitation the rights.to use, copy, modify, merge, publish, distribute, sublicense, and/or sell.copies of the Software, and to permit persons to whom the Software is.furnished to do so, subject to the following conditions:..The above copyright notice and this permission notice shall be included in all.copies or substantial portions of the Software...THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR.IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,.FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE.AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER.LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHE

                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI70002\base_library.zip

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\Desktop\NEVER OPEN!.exe
                                                                                                                                                                                                                                            File Type:Zip archive data, at least v2.0 to extract, compression method=store
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):831920
                                                                                                                                                                                                                                            Entropy (8bit):5.700113193168901
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:12288:9gYJuVvEWSxVqF8MgFA4a2YCdXVwxjfpEreiSRMN7:9gYJz1x3La2xVwxjfpErefMN7
                                                                                                                                                                                                                                            MD5:524A85217DC9EDC8C9EFC73159CA955D
                                                                                                                                                                                                                                            SHA1:A4238CBDE50443262D00A843FFE814435FB0F4E2
                                                                                                                                                                                                                                            SHA-256:808549964ADB09AFAFB410CDC030DF4813C5C2A7276A94E7F116103AF5DE7621
                                                                                                                                                                                                                                            SHA-512:F5A929B35A63F073BDC7600155BA2F0F262E6F60CF67EFB38FA44E8B3BE085CF1D5741D66D25A1ECAAF3F94ABFE9BBE97D135F8A47C11F2B811D2AAC6876F46C
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:PK..........!...`.5...5......._collections_abc.pyco........%.A........................@.......d.Z.d.d.l.m.Z.m.Z...d.d.l.Z.e.e.e.....Z.e.d...Z.d.d...Z.e.e...Z.[.g.d...Z.d.Z.e.e.d.....Z.e.e.e.......Z.e.e.i.........Z.e.e.i.........Z.e.e.i.........Z.e.e.g.....Z.e.e.e.g.......Z.e.e.e.d.......Z.e.e.e.d.d.>.......Z.e.e.e.......Z.e.e.d.....Z e.e.d.....Z!e.e.e"......Z#e.i.......Z$e.i.......Z%e.i.......Z&e.e.j'..Z(e.d.d.......Z)d.d...Z*e*..Z*e.e*..Z+e*.,....[*d.d...Z-e-..Z-e.e-..Z.[-d.d...Z/G.d.d...d.e.d...Z0G.d.d...d.e.d...Z1G.d.d...d.e1..Z2e2.3e+....G.d.d...d.e.d...Z4G.d.d ..d e4..Z5G.d!d"..d"e5..Z6e6.3e.....G.d#d$..d$e.d...Z7G.d%d&..d&e7..Z8e8.3e.....e8.3e.....e8.3e.....e8.3e.....e8.3e.....e8.3e.....e8.3e.....e8.3e.....e8.3e.....e8.3e.....e8.3e ....e8.3e!....e8.3e#....G.d'd(..d(e7..Z9G.d)d*..d*e8..Z:e:.3e)....G.d+d,..d,e.d...Z;G.d-d...d.e.d...Z<G.d/d0..d0e;e7e<..Z=G.d1d2..d2e...Z>d3d4..Z?d5d6..Z@d7d8..ZAG.d9d:..d:e.d...ZBG.d;d<..d<e=..ZCeC.3eD....G.d=d>..d>eC..ZEeE.3e.....G.d?d@..d@e=..ZFeF

                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI70002\certifi\cacert.pem

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\Desktop\NEVER OPEN!.exe
                                                                                                                                                                                                                                            File Type:ASCII text
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):299427
                                                                                                                                                                                                                                            Entropy (8bit):6.047872935262006
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:6144:QW1x/M8fRR1jplkXURrVADwYCuCigT/QRSRqNb7d8iu5Nahx:QWb/TRJLWURrI5RWavdF08/
                                                                                                                                                                                                                                            MD5:50EA156B773E8803F6C1FE712F746CBA
                                                                                                                                                                                                                                            SHA1:2C68212E96605210EDDF740291862BDF59398AEF
                                                                                                                                                                                                                                            SHA-256:94EDEB66E91774FCAE93A05650914E29096259A5C7E871A1F65D461AB5201B47
                                                                                                                                                                                                                                            SHA-512:01ED2E7177A99E6CB3FBEF815321B6FA036AD14A3F93499F2CB5B0DAE5B713FD2E6955AA05F6BDA11D80E9E0275040005E5B7D616959B28EFC62ABB43A3238F0
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:.# Issuer: CN=GlobalSign Root CA O=GlobalSign nv-sa OU=Root CA.# Subject: CN=GlobalSign Root CA O=GlobalSign nv-sa OU=Root CA.# Label: "GlobalSign Root CA".# Serial: 4835703278459707669005204.# MD5 Fingerprint: 3e:45:52:15:09:51:92:e1:b7:5d:37:9f:b1:87:29:8a.# SHA1 Fingerprint: b1:bc:96:8b:d4:f4:9d:62:2a:a8:9a:81:f2:15:01:52:a4:1d:82:9c.# SHA256 Fingerprint: eb:d4:10:40:e4:bb:3e:c7:42:c9:e3:81:d3:1e:f2:a4:1a:48:b6:68:5c:96:e7:ce:f3:c1:df:6c:d4:33:1c:99.-----BEGIN CERTIFICATE-----.MIIDdTCCAl2gAwIBAgILBAAAAAABFUtaw5QwDQYJKoZIhvcNAQEFBQAwVzELMAkG.A1UEBhMCQkUxGTAXBgNVBAoTEEdsb2JhbFNpZ24gbnYtc2ExEDAOBgNVBAsTB1Jv.b3QgQ0ExGzAZBgNVBAMTEkdsb2JhbFNpZ24gUm9vdCBDQTAeFw05ODA5MDExMjAw.MDBaFw0yODAxMjgxMjAwMDBaMFcxCzAJBgNVBAYTAkJFMRkwFwYDVQQKExBHbG9i.YWxTaWduIG52LXNhMRAwDgYDVQQLEwdSb290IENBMRswGQYDVQQDExJHbG9iYWxT.aWduIFJvb3QgQ0EwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDaDuaZ.jc6j40+Kfvvxi4Mla+pIH/EqsLmVEQS98GPR4mdmzxzdzxtIK+6NiY6arymAZavp.xy0Sy6scTHAHoT0KMM0VjU/43dSMUBUc71DuxC73/OlS8pF94G3VNTCOXkNz

                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI70002\charset_normalizer\md.cp310-win_amd64.pyd

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\Desktop\NEVER OPEN!.exe
                                                                                                                                                                                                                                            File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):9728
                                                                                                                                                                                                                                            Entropy (8bit):6.7152932063633255
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:192:vf0YFowZibj4wNg2ne15sZ7aaucmkyUxaVXFaLuH2iX:vN+wZiPg2eQoXcmnUxaVXALXi
                                                                                                                                                                                                                                            MD5:AC03714161DA507E824756742A877DA9
                                                                                                                                                                                                                                            SHA1:702DBD2296CA50F6502BC5AAC5B826B63CF9E200
                                                                                                                                                                                                                                            SHA-256:CAFC9C2BEFC85AF6CC0F9CF0FA7681BAE89C9ACF511CADC39A0CEE77D174B2C2
                                                                                                                                                                                                                                            SHA-512:6B773B2F31512211A0944391733B77F25EF720D07A4057AB8432941950403FACED50C8BC3166B36F648E6394BDF0D9943CCD81E689622558719DFE782C59BB2C
                                                                                                                                                                                                                                            Malicious:true
                                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$....................X...................................^............................4...........Rich....................PE..d...c#.g.........." ...). .......p........................................................`.........................................@...p......P............@..........................................................@...........................................UPX0.....p..............................UPX1..... ..........................@....rsrc................"..............@......................................................................................................................................................................................................................................................................................................................................................3.96.UPX!.$..

                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI70002\charset_normalizer\md__mypyc.cp310-win_amd64.pyd

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\Desktop\NEVER OPEN!.exe
                                                                                                                                                                                                                                            File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):40448
                                                                                                                                                                                                                                            Entropy (8bit):7.852971014132377
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:768:lwMuNrL6Rm1CUja3BN0ep4U0Kv8WCpg1gkkX+vv5uwgSz:lJuNrLoeab3OW62XwPk
                                                                                                                                                                                                                                            MD5:150731368D678F5B2F9EA8CB1A966B8A
                                                                                                                                                                                                                                            SHA1:8263055AEE278B6724E30AFF7BD4BD471BB1C904
                                                                                                                                                                                                                                            SHA-256:08BBCCF9BE3982BBB356E5DF1E6FDDAA94BB5F12B765BCA7BD5701C86141F814
                                                                                                                                                                                                                                            SHA-512:A5E984F9995E13FEFD8A1750B8FEF7670CFEF11FF019880AF06D4DFF453416B43E077084F529E37FC24F4A70C1951CFC101F2611D7C860924BBF2922A98027A8
                                                                                                                                                                                                                                            Malicious:true
                                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........VyR.7...7...7...O...7.......7...O...7.......7.......7.......7..JB...7...7..b7......7......7......7......7..Rich.7..........PE..d...b#.g.........." ...).............H.......................................p............`..........................................b..d....`.......`......................<c.......................................T..@...........................................UPX0....................................UPX1................................@....rsrc........`......................@..............................................................................................................................................................................................................................................................................................................................................................3.96.UPX!.$..

                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI70002\frozenlist\_frozenlist.cp310-win_amd64.pyd

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\Desktop\NEVER OPEN!.exe
                                                                                                                                                                                                                                            File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):37376
                                                                                                                                                                                                                                            Entropy (8bit):7.8223066199355635
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:768:DX5NQnY+H236BVyqRLjqutCwYUw/8WM+6OxWFfT0:lNQRWKBcIqgpw/2+NgR
                                                                                                                                                                                                                                            MD5:E115982EE531ACD056BF254EC6C7EE81
                                                                                                                                                                                                                                            SHA1:E8BF6292B21E93A9CD308561726899526F92B14F
                                                                                                                                                                                                                                            SHA-256:85C4106E07C01945F8A26D105E53F9E149635B7B976EBEFD6B2211CAA1E001D7
                                                                                                                                                                                                                                            SHA-512:10831AD85CD53277F30C13653958509909183003C2CDCBCD866EE3FBFE40A6D147EBB0EE3EE8AC6EF3272D814F320D02C827037E0FE6551465BB091D785A2C45
                                                                                                                                                                                                                                            Malicious:true
                                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......r.56..f6..f6..f?.Ef2..f&5.g4..f}..g4..f&5.g5..f&5.g>..f&5.g;..f...g5..f6..f...f}4.g7..f}4.g7..f}4)f7..f}4.g7..fRich6..f........PE..d...V..g.........." ...).........0.......@................................................`.............................................h....................p..|.......................................................@...........................................UPX0.....0..............................UPX1.........@......................@....rsrc...............................@..............................................................................................................................................................................................................................................................................................................................................................3.96.UPX!.$..

                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI70002\libcrypto-1_1.dll

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\Desktop\NEVER OPEN!.exe
                                                                                                                                                                                                                                            File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):1189728
                                                                                                                                                                                                                                            Entropy (8bit):7.9451398145343335
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:24576:xffQrZJIe6/4gho5HE1F03fkOyUU/BtSIgA0ft+rBFOWRIQ6sCYB1CPwDv3uFfJp:pf8JWwgho5HL3fknPSIKorCo1CPwDv3Q
                                                                                                                                                                                                                                            MD5:DA5FE6E5CFC41381025994F261DF7148
                                                                                                                                                                                                                                            SHA1:13998E241464952D2D34EB6E8ECFCD2EB1F19A64
                                                                                                                                                                                                                                            SHA-256:DE045C36AE437A5B40FC90A8A7CC037FACD5B7E307CFCF9A9087C5F1A6A2CF18
                                                                                                                                                                                                                                            SHA-512:A0D7EBF83204065236439D495EB3C97BE093C41DAAC2E6CFBBB1AA8FFEAC049402A3DEA7139B1770D2E1A45E08623A56A94D64C8F0C5BE74C5BAE039A2BC6CA9
                                                                                                                                                                                                                                            Malicious:true
                                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........a...2...2...2...2...2..3...2..3...2..3...2..3...2...2...2L.3...2..3...2..3.2..3...2..p2...2..3...2Rich...2........................PE..d...m..b.........." ... .........@%.025..P%..................................P7...........`......................................... H5......C5.h....@5......`2.............H7......................................=5.@...........................................UPX0.....@%.............................UPX1.........P%.....................@....rsrc........@5.....................@..............................................................................................................................................................................................................................................................................................................................................3.96.UPX!.$..

                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI70002\libffi-7.dll

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\Desktop\NEVER OPEN!.exe
                                                                                                                                                                                                                                            File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):24088
                                                                                                                                                                                                                                            Entropy (8bit):7.529671673324906
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:384:TRZBxuj5W4IBzuU2CUvOEvbY4nUxaVXALNxZRCXTpnYPLxDG4y80uzFLhHj:lwlGuUm2EvbrmWpWDG4yKRF
                                                                                                                                                                                                                                            MD5:B5150B41CA910F212A1DD236832EB472
                                                                                                                                                                                                                                            SHA1:A17809732C562524B185953FFE60DFA91BA3CE7D
                                                                                                                                                                                                                                            SHA-256:1A106569AC0AD3152F3816FF361AA227371D0D85425B357632776AC48D92EA8A
                                                                                                                                                                                                                                            SHA-512:9E82B0CAA3D72BB4A7AD7D66EBFB10EDB778749E89280BCA67C766E72DC794E99AAB2BC2980D64282A384699929CE6CC996462A73584898D2DF67A57BFF2A9C6
                                                                                                                                                                                                                                            Malicious:true
                                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......6.3.r}]Ar}]Ar}]A{..Ap}]A .\@p}]A..\@q}]Ar}\AU}]A .X@~}]A .Y@z}]A .^@q}]A..Y@t}]A..^@s}]A..]@s}]A.._@s}]ARichr}]A........................PE..d......].........." .....@................................................................`.........................................................................................................................................................................UPX0....................................UPX1.....@.......:..................@...UPX2.................>..............@......................................................................................................................................................................................................................................................................................................................................................3.96.UPX!.$..

                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI70002\libssl-1_1.dll

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\Desktop\NEVER OPEN!.exe
                                                                                                                                                                                                                                            File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):208224
                                                                                                                                                                                                                                            Entropy (8bit):7.921732676851239
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:3072:XSI3oPlWLlPVVc5MpJa1pOjJnnioIZW8/Qf6bRXGKrs8qJjueW1LR/oSBZLetz:CIek5VC0FiHof6Z1rgJ63R/oSi
                                                                                                                                                                                                                                            MD5:48D792202922FFFE8EA12798F03D94DE
                                                                                                                                                                                                                                            SHA1:F8818BE47BECB8CCF2907399F62019C3BE0EFEB5
                                                                                                                                                                                                                                            SHA-256:8221A76831A103B2B2AE01C3702D0BBA4F82F2AFD4390A3727056E60B28650CC
                                                                                                                                                                                                                                            SHA-512:69F3A8B556DD517AE89084623F499EF89BD0F97031E3006677CEED330ED13FCC56BF3CDE5C9ED0FC6C440487D13899FFDA775E6A967966294CADFD70069B2833
                                                                                                                                                                                                                                            Malicious:true
                                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........D.p*..p*..p*......p*...+..p*.\.+..p*.../..p*......p*...)..p*...+..p*..p+.iq*......p*...*..p*.....p*...(..p*.Rich.p*.........PE..d......b.........." ... .....P...`..@....p................................................`..........................................6..4@...3.......0...........M...........v......................................8%..@...........................................UPX0.....`..............................UPX1.........p......................@....rsrc....P...0...H..................@..............................................................................................................................................................................................................................................................................................................................................................3.96.UPX!.$..

                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI70002\mfc140u.dll

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\Desktop\NEVER OPEN!.exe
                                                                                                                                                                                                                                            File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):5653424
                                                                                                                                                                                                                                            Entropy (8bit):6.729277267882055
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:49152:EuEsNcEc8/CK4b11P5ViH8gw0+NVQD5stWIlE7lva8iposS9j5fzSQzs7ID+AVuS:EnL8+5fiEnQFLOAkGkzdnEVomFHKnPS
                                                                                                                                                                                                                                            MD5:03A161718F1D5E41897236D48C91AE3C
                                                                                                                                                                                                                                            SHA1:32B10EB46BAFB9F81A402CB7EFF4767418956BD4
                                                                                                                                                                                                                                            SHA-256:E06C4BD078F4690AA8874A3DEB38E802B2A16CCB602A7EDC2E077E98C05B5807
                                                                                                                                                                                                                                            SHA-512:7ABCC90E845B43D264EE18C9565C7D0CBB383BFD72B9CEBB198BA60C4A46F56DA5480DA51C90FF82957AD4C84A4799FA3EB0CEDFFAA6195F1315B3FF3DA1BE47
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......Q.cu...&...&...&...'...&...'...&...'...&..&...&G..'...&G..'...&...'...&...&..&G..'...&G..'...&G..'...&G..'...&G..&...&G..'...&Rich...&................PE..d....~.a.........." .....(-..X)......X,.......................................V......YV...`A..........................................:.....h.;.......?......`=..8....V..'...PU.0p..p.5.T...........................`...8............@-.P...0.:......................text....&-......(-................. ..`.rdata.......@-......,-.............@..@.data....6... <.......<.............@....pdata...8...`=..:....<.............@..@.didat..H.....?.......?.............@....rsrc.........?.......?.............@..@.reloc..0p...PU..r....T.............@..B................................................................................................................................................................................

                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI70002\multidict\_multidict.cp310-win_amd64.pyd

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\Desktop\NEVER OPEN!.exe
                                                                                                                                                                                                                                            File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):20480
                                                                                                                                                                                                                                            Entropy (8bit):7.620137621014922
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:384:3j0inCNIw61COjZ0FbIj/jvIUrn+HHRCkmJeZMF50aEB1lZ9nUxaVXALeqg8:3w1D6vjZd1SxCjeZM0TBX1q
                                                                                                                                                                                                                                            MD5:0A9B975CEE2760BFF77865A34F7028F0
                                                                                                                                                                                                                                            SHA1:55FCC33419E41A43FB5B52EF81A9A150C480F98E
                                                                                                                                                                                                                                            SHA-256:20424D01666FC6C53F2DE690C68DD4E0755BD40BF26D983C0E986DDDC7995615
                                                                                                                                                                                                                                            SHA-512:86C8B09FDC5355614E831AB869D02EC5423F6943DE158F51896422CDFC3F4BD8CFD9664F47AB2EE87DB0BE2BB48CF10DD42CF877542DE0593FE6FEACB69731D7
                                                                                                                                                                                                                                            Malicious:true
                                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........o.T.............v?............v........................&{................................S.............Rich............PE..d....|.f.........." ...).P...................................................@............`.........................................@2..d....0..P....0.......................2.......................................&..@...........................................UPX0....................................UPX1.....P.......H..................@....rsrc........0.......L..............@..............................................................................................................................................................................................................................................................................................................................................................3.96.UPX!.$..

                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI70002\propcache\_helpers_c.cp310-win_amd64.pyd

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\Desktop\NEVER OPEN!.exe
                                                                                                                                                                                                                                            File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):32768
                                                                                                                                                                                                                                            Entropy (8bit):7.777596001077688
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:768:saXim60eBsX5cAR0NOhDEuU8dP0LAZ2dP97MTT5:saXi0eB45cAASDEuNd8LAZ2p97Mn
                                                                                                                                                                                                                                            MD5:1E8E455DAB1C155FA2ADC89C244971BA
                                                                                                                                                                                                                                            SHA1:8347F3A0888D4389749D4401044318651698F0E2
                                                                                                                                                                                                                                            SHA-256:960CFB8E43176D3F11309A9A6FB646F5349E5F323A41082DC9745D2430180887
                                                                                                                                                                                                                                            SHA-512:BA3E3F0E8D7CCF0A368D2DCD67B80F73A3364287460427079BA45489F0F257A4E515775A5F8980352C1F971054DBB3941FA17E09F305E74921834C50E7C33611
                                                                                                                                                                                                                                            Malicious:true
                                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........o.T.............v?..............v..............................b{...........................S...........Rich....................PE..d......g.........." ...)................. ................................................`.........................................@...d......P............@..l.......................................................@...........................................UPX0....................................UPX1......... ...x..................@....rsrc................|..............@......................................................................................................................................................................................................................................................................................................................................................3.96.UPX!.$..

                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI70002\psutil\_psutil_windows.pyd

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\Desktop\NEVER OPEN!.exe
                                                                                                                                                                                                                                            File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):34816
                                                                                                                                                                                                                                            Entropy (8bit):7.787702936942791
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:768:l5HOA2w0JLJLH+AKL7/d2gt6UDsPioZLxivYG7HWFynfcwRVG:LHOE0T+AKL70g/oZ9sY22Ef9V
                                                                                                                                                                                                                                            MD5:FB17B2F2F09725C3FFCA6345ACD7F0A8
                                                                                                                                                                                                                                            SHA1:B8D747CC0CB9F7646181536D9451D91D83B9FC61
                                                                                                                                                                                                                                            SHA-256:9C7D401418DB14353DB85B54FF8C7773EE5D17CBF9A20085FDE4AF652BD24FC4
                                                                                                                                                                                                                                            SHA-512:B4ACB60045DA8639779B6BB01175B13344C3705C92EA55F9C2942F06C89E5F43CEDAE8C691836D63183CACF2D0A98AA3BCB0354528F1707956B252206991BF63
                                                                                                                                                                                                                                            Malicious:true
                                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............O..O..O...O..O..N..O..N..O..N..O..N..O...N..O..N..O..O,.OY..N..OY..N..OY.pO..OY..N..ORich..O........PE..d.....=d.........." ............. ......0................................................`.........................................8...`......H............P..X......................................................8...........................................UPX0..... ..............................UPX1.........0...~..................@....rsrc...............................@..............................................................................................................................................................................................................................................................................................................................................................3.96.UPX!.$..

                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI70002\pyexpat.pyd

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\Desktop\NEVER OPEN!.exe
                                                                                                                                                                                                                                            File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):88440
                                                                                                                                                                                                                                            Entropy (8bit):7.917287109292123
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:1536:HqOsxiaMRf0wQhTR0lJrTMQLFrwAx0qHMKVqhgjOE+hpeWpUM2MkNpho8aI7Qhgk:K8kmJfMQLFD+XWq+aDBplFk+I7Qhge0g
                                                                                                                                                                                                                                            MD5:5A328B011FA748939264318A433297E2
                                                                                                                                                                                                                                            SHA1:D46DD2BE7C452E5B6525E88A2D29179F4C07DE65
                                                                                                                                                                                                                                            SHA-256:E8A81B47029E8500E0F4E04CCF81F8BDF23A599A2B5CD627095678CDF2FABC14
                                                                                                                                                                                                                                            SHA-512:06FA8262378634A42F5AB8C1E5F6716202544C8B304DE327A08AA20C8F888114746F69B725ED3088D975D09094DF7C3A37338A93983B957723AA2B7FDA597F87
                                                                                                                                                                                                                                            Malicious:true
                                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......9h..}..}..}..tqu.q..2u....2u.p..2u.u..2u.~...u....{.~..}......u.y...u.|...u..|...u.|..Rich}..................PE..d...+..c.........." ...". ........... .......................................@............`..........................................<..P....9.......0.......................<.......................................,..@...........................................UPX0....................................UPX1..... ..........................@....rsrc........0......."..............@......................................................................................................................................................................................................................................................................................................................................................3.96.UPX!.$..

                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI70002\pyinstaller-5.1.dist-info\COPYING.txt

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\Desktop\NEVER OPEN!.exe
                                                                                                                                                                                                                                            File Type:ASCII text
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):30634
                                                                                                                                                                                                                                            Entropy (8bit):4.687948422038189
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:384:8+ztint/HdxEUwi5rDL676yV12rPd34ZomzM2FR+qWi9vlKM1zJlFvmNz5VrlkTv:rzolHv7FgixMFzMqd9TzJlFvAfxk1rt
                                                                                                                                                                                                                                            MD5:371FE7FDEE041250F12B3A4658A14278
                                                                                                                                                                                                                                            SHA1:A4AAA06709FF77945CA1A42ECCC06C9C99182A27
                                                                                                                                                                                                                                            SHA-256:DD7315735D0C3CBB0CC861A3EA4D9CEE497568B98CACEA64AF3EA51F4E4B5386
                                                                                                                                                                                                                                            SHA-512:77FBA931238B59A44357996EC3A39D5E8CDD8E8CBED963927A814B30AADA1F0FF88FB2D62D2DCD9955DBA9458C4A310252B72E52963FEBD0E80639ABA53A9D19
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:================================. The PyInstaller licensing terms.================================. ..Copyright (c) 2010-2022, PyInstaller Development Team.Copyright (c) 2005-2009, Giovanni Bajo.Based on previous work under copyright (c) 2002 McMillan Enterprises, Inc....PyInstaller is licensed under the terms of the GNU General Public License.as published by the Free Software Foundation; either version 2 of the License,.or (at your option) any later version....Bootloader Exception.--------------------..In addition to the permissions in the GNU General Public License, the.authors give you unlimited permission to link or embed compiled bootloader.and related files into combinations with other programs, and to distribute.those combinations without any restriction coming from the use of those.files. (The General Public License restrictions do apply in other respects;.for example, they cover modification of the files, and distribution when.not linked into a combined executable.). . .Bootlo

                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI70002\pyinstaller-5.1.dist-info\INSTALLER

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\Desktop\NEVER OPEN!.exe
                                                                                                                                                                                                                                            File Type:ASCII text
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):4
                                                                                                                                                                                                                                            Entropy (8bit):1.5
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:3:Mn:M
                                                                                                                                                                                                                                            MD5:365C9BFEB7D89244F2CE01C1DE44CB85
                                                                                                                                                                                                                                            SHA1:D7A03141D5D6B1E88B6B59EF08B6681DF212C599
                                                                                                                                                                                                                                            SHA-256:CEEBAE7B8927A3227E5303CF5E0F1F7B34BB542AD7250AC03FBCDE36EC2F1508
                                                                                                                                                                                                                                            SHA-512:D220D322A4053D84130567D626A9F7BB2FB8F0B854DA1621F001826DC61B0ED6D3F91793627E6F0AC2AC27AEA2B986B6A7A63427F05FE004D8A2ADFBDADC13C1
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:pip.

                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI70002\pyinstaller-5.1.dist-info\METADATA

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\Desktop\NEVER OPEN!.exe
                                                                                                                                                                                                                                            File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):7292
                                                                                                                                                                                                                                            Entropy (8bit):5.0285832056593485
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:192:VZBasM/s4VN2ZKMWNOXMdUUmUqhpVqhkHv:K72ZRCOXmUU8hpukHv
                                                                                                                                                                                                                                            MD5:E7753706452DF740FDC082E289749E18
                                                                                                                                                                                                                                            SHA1:EDC4321CB411C97514854D84230FE513596B798F
                                                                                                                                                                                                                                            SHA-256:B7F3A310E76406C2DFF20B84BF92BC7507E9612ED063C010291F1A93FA28C73C
                                                                                                                                                                                                                                            SHA-512:D5BC6F1146DB79A73F2435823A21F579FED659AD8FC36563C4C833160E2E829687AE7C086C309F2487E9551E2EFB65494CCEA21474E8AFC340F163766371DF0F
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:Metadata-Version: 2.1..Name: pyinstaller..Version: 5.1..Summary: PyInstaller bundles a Python application and all its dependencies into a single package...Home-page: https://www.pyinstaller.org/..Author: Hartmut Goebel, Giovanni Bajo, David Vierra, David Cortesi, Martin Zibricky..License: GPLv2-or-later with a special exception which allows to use PyInstaller to build and distribute non-free programs (including commercial ones)..Project-URL: Source, https://github.com/pyinstaller/pyinstaller..Keywords: packaging, app, apps, bundle, convert, standalone, executable,pyinstaller, cxfreeze, freeze, py2exe, py2app, bbfreeze..Classifier: Development Status :: 6 - Mature..Classifier: Environment :: Console..Classifier: Intended Audience :: Developers..Classifier: Intended Audience :: Other Audience..Classifier: Intended Audience :: System Administrators..Classifier: License :: OSI Approved :: GNU General Public License v2 (GPLv2)..Classifier: Natural Language :: English..Classifier: Operating

                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI70002\pyinstaller-5.1.dist-info\RECORD

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\Desktop\NEVER OPEN!.exe
                                                                                                                                                                                                                                            File Type:CSV text
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):61650
                                                                                                                                                                                                                                            Entropy (8bit):5.605684014075479
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:1536:HqEIJtsSWQJQq4WPY1y0yvtZY6W3+j73wt5a14bXPA+Yla1U9MZhGO5oLZlu:CU/ZiL7u
                                                                                                                                                                                                                                            MD5:FB69230F6D30CF6906AD4EC3BD4964E4
                                                                                                                                                                                                                                            SHA1:51EDDAD0A01A5393084943BD928AFB8D00CDB36A
                                                                                                                                                                                                                                            SHA-256:AAA4F7B839D22619D352A1E644E3F625DFD04B70052C337898D192C85B5E3227
                                                                                                                                                                                                                                            SHA-512:0032D514C6957C68C2A77AA6ED6136F81D54216B25006E1A1DF9F031C48BBAE72BE7E9AC7EE3043AD46C3FB9D445C754D0567259FF14F5ECADC4B97C3E728496
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:../../Scripts/pyi-archive_viewer.exe,sha256=zeUWRldhfNTI8CFN69VnOZ4InP-GQYR5AlTOz7hI7ZU,108441..../../Scripts/pyi-bindepend.exe,sha256=zJH--FKRys5R8kVEf73Gcl2sEaFuEbmvDaZPY1xfREo,108436..../../Scripts/pyi-grab_version.exe,sha256=BCM902Q4Utj6Bb-VQYMVNHdnJAR6u6H88j_4FKARIZ4,108439..../../Scripts/pyi-makespec.exe,sha256=LCvrmmuKraQ0Wsh1HqXoGZO5k13qWk_t80W3U8UGgU4,108435..../../Scripts/pyi-set_version.exe,sha256=7LDhhmmiEm9WkWCJ75QC2EIWB7NBiYgAQGIgKkh8c6E,108438..../../Scripts/pyinstaller.exe,sha256=-kiDALlfa3e3PjBy0wMqRd_-gR0qLShqogOn9qtzK1c,108420..PyInstaller/__init__.py,sha256=yxwRT03ZzCOJlfU8-OxhCCUTqjifnWlXnZQtpEOzjoo,2995..PyInstaller/__main__.py,sha256=2KLwhQRzVi24ICVDCEe-QQOXvk5q1eoPa6HMMnAyD0g,6688..PyInstaller/__pycache__/__init__.cpython-310.pyc,,..PyInstaller/__pycache__/__main__.cpython-310.pyc,,..PyInstaller/__pycache__/_recursion_to_deep_message.cpython-310.pyc,,..PyInstaller/__pycache__/_shared_with_waf.cpython-310.pyc,,..PyInstaller/__pycache__/compat.cpython-310.pyc,,..P

                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI70002\pyinstaller-5.1.dist-info\WHEEL

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\Desktop\NEVER OPEN!.exe
                                                                                                                                                                                                                                            File Type:ASCII text
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):91
                                                                                                                                                                                                                                            Entropy (8bit):4.718144065224423
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:3:RtEeXMRYFAQb6gP+tPCCfA5S:RtC1cxWBBf
                                                                                                                                                                                                                                            MD5:F8DE0AF416CFA64B783E891E98B23FB2
                                                                                                                                                                                                                                            SHA1:49C79C79C440ED3BC40387054075670F05445FCF
                                                                                                                                                                                                                                            SHA-256:474E8F0375156074E1C07BF1B9158CA9A19CAFE3EE9E25DA8708E641114C1246
                                                                                                                                                                                                                                            SHA-512:04FDA440B27B7A1B701EE33731253FAF850B5ACE046F0CF3B7A02FF66EB268975177589430ABF049D1D1DD9CB58C73019A763BE06DDCEACB0348E4089B60B6FF
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:Wheel-Version: 1.0.Generator: setuptools (75.5.0).Root-Is-Purelib: true.Tag: py3-none-any..

                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI70002\pyinstaller-5.1.dist-info\direct_url.json

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\Desktop\NEVER OPEN!.exe
                                                                                                                                                                                                                                            File Type:JSON data
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):109
                                                                                                                                                                                                                                            Entropy (8bit):4.639181519626878
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:3:YBM7W/RzQXjHxi6KjAXWKVVtgK3rIlw3rIldrDJOXIeUHY:Ym6RzKRihjFGPbIKbIrVOX5U4
                                                                                                                                                                                                                                            MD5:4E1763FA942DDBF4753FE8C21D7BD31C
                                                                                                                                                                                                                                            SHA1:3DDDF2939F1488DE229B8C4B9FBB3DA9D4CDEF13
                                                                                                                                                                                                                                            SHA-256:D006A8C986B233A281FDDB267AFDAC05E79B1CDF2A79E8B0B3A761EDFDACC781
                                                                                                                                                                                                                                            SHA-512:700B0AAF9E9B17DA82853D74C2725D1B054658D2552102E0E634FE61B71E574BF2C978E251BA830B61BA57DDCC1FB8383C31DD11D52C4C723987DDAC0946C0E9
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:{"dir_info": {}, "url": "file:///C:/Users/poops/Downloads/empyrean-main/empyrean-main/build/pyinstaller-5.1"}

                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI70002\pyinstaller-5.1.dist-info\entry_points.txt

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\Desktop\NEVER OPEN!.exe
                                                                                                                                                                                                                                            File Type:ASCII text
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):360
                                                                                                                                                                                                                                            Entropy (8bit):4.529432579272841
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:6:1VkKXL0DjyXLfUynXLEB85AQFXLHHVtAcRNnXLAX2OXFnXLLMi:1qKXIyXLpXg4hX7VtdFXsX2OXFnXMi
                                                                                                                                                                                                                                            MD5:E15B5909D49DAB451BEB91C31B9732BF
                                                                                                                                                                                                                                            SHA1:83A5F4EFEF9C91101FA2E7AC0CBED17FE9282145
                                                                                                                                                                                                                                            SHA-256:933880B425B47C933547830B21387BA2144517BCA3638B213A88F4E3441DBD02
                                                                                                                                                                                                                                            SHA-512:AE280B4B217AA95D7275B58DC73E7586C1999DC363A0B83E7CA350207541F13B18F30B2BB634EB4BA2F4C191940B5CCC7FC201024000E4FD28431AE6C4A69617
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:[console_scripts].pyi-archive_viewer = PyInstaller.utils.cliutils.archive_viewer:run.pyi-bindepend = PyInstaller.utils.cliutils.bindepend:run.pyi-grab_version = PyInstaller.utils.cliutils.grab_version:run.pyi-makespec = PyInstaller.utils.cliutils.makespec:run.pyi-set_version = PyInstaller.utils.cliutils.set_version:run.pyinstaller = PyInstaller.__main__:run.

                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI70002\pyinstaller-5.1.dist-info\top_level.txt

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\Desktop\NEVER OPEN!.exe
                                                                                                                                                                                                                                            File Type:ASCII text
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):12
                                                                                                                                                                                                                                            Entropy (8bit):3.418295834054489
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:3:rLWTXvn:f8Xvn
                                                                                                                                                                                                                                            MD5:0A28E8E758F80C4B73AFD9DBEF9F96DD
                                                                                                                                                                                                                                            SHA1:10072E4EC58C0E15D5A62FD256AC9D7BC6A28BCB
                                                                                                                                                                                                                                            SHA-256:1AE466BD65C64D124D6262B989618E82536FE0BDDBCBB60A68488AC9C359E174
                                                                                                                                                                                                                                            SHA-512:38D7A1B6198701708F90750C9D82390A150972FB898FC91C825FF6F6FE2A560B3BCC381A388BB7FE5DFAE63550BEC2A6A7CFED1390E620A5B2A559726C1439E5
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:PyInstaller.

                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI70002\python3.dll

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\Desktop\NEVER OPEN!.exe
                                                                                                                                                                                                                                            File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):64896
                                                                                                                                                                                                                                            Entropy (8bit):6.101810529421494
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:768:Y88LeBLeeFtp5V1BfO2yvSk70QZF1nEyjnskQkr/RFB1qucwdBeCw0myou6ZwJq9:Y8wewnvtjnsfwERI7Q0L7SyCPx
                                                                                                                                                                                                                                            MD5:C17B7A4B853827F538576F4C3521C653
                                                                                                                                                                                                                                            SHA1:6115047D02FBBAD4FF32AFB4EBD439F5D529485A
                                                                                                                                                                                                                                            SHA-256:D21E60F3DFBF2BAB0CC8A06656721FA3347F026DF10297674FC635EBF9559A68
                                                                                                                                                                                                                                            SHA-512:8E08E702D69DF6840781D174C4565E14A28022B40F650FDA88D60172BE2D4FFD96A3E9426D20718C54072CA0DA27E0455CC0394C098B75E062A27559234A3DF7
                                                                                                                                                                                                                                            Malicious:true
                                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......]{....e...e...e..fm...e..fe...e..f....e..fg...e.Rich..e.........................PE..d......c.........." ..."..................................................................`.........................................`...`................................)..............T............................................................................rdata..............................@..@.rsrc...............................@..@................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI70002\python310.dll

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\Desktop\NEVER OPEN!.exe
                                                                                                                                                                                                                                            File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):1513336
                                                                                                                                                                                                                                            Entropy (8bit):7.992007410704943
                                                                                                                                                                                                                                            Encrypted:true
                                                                                                                                                                                                                                            SSDEEP:24576:3mhx0O5yMVUEV51zVZ/7KqaI0jVSn/OCNYLfUehwHqDdt9OJzoCr2TAY/f+TNX56:3mT0OjUK51xZ/7s6GDwKDD9OJEwsAE2C
                                                                                                                                                                                                                                            MD5:69D4F13FBAEEE9B551C2D9A4A94D4458
                                                                                                                                                                                                                                            SHA1:69540D8DFC0EE299A7FF6585018C7DB0662AA629
                                                                                                                                                                                                                                            SHA-256:801317463BD116E603878C7C106093BA7DB2BECE11E691793E93065223FC7046
                                                                                                                                                                                                                                            SHA-512:8E632F141DAF44BC470F8EE677C6F0FDCBCACBFCE1472D928576BF7B9F91D6B76639D18E386D5E1C97E538A8FE19DD2D22EA47AE1ACF138A0925E3C6DD156378
                                                                                                                                                                                                                                            Malicious:true
                                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........<...R..R..R...S..R......R...W..R...V..R...Q..R.....R.K.S..R..S..R.'._.X.R.'.R..R.'....R.'.P..R.Rich..R.........PE..d......c.........." ...". ......../...E.../...................................F...........`...........................................F.......F.d.....F.......B...............F.......................................E.@...........................................UPX0....../.............................UPX1..... ..../.....................@....rsrc.........F.....................@..............................................................................................................................................................................................................................................................................................................................................................3.96.UPX!.$..

                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI70002\pythoncom310.dll

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\Desktop\NEVER OPEN!.exe
                                                                                                                                                                                                                                            File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):198144
                                                                                                                                                                                                                                            Entropy (8bit):7.899184952490433
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:6144:irs7d9ovn0ICgOdewE9SJy9sZQ3KfmPpd:b59ovn0IC1yl3xPpd
                                                                                                                                                                                                                                            MD5:9051ABAE01A41EA13FEBDEA7D93470C0
                                                                                                                                                                                                                                            SHA1:B06BD4CD4FD453EB827A108E137320D5DC3A002F
                                                                                                                                                                                                                                            SHA-256:F12C8141D4795719035C89FF459823ED6174564136020739C106F08A6257B399
                                                                                                                                                                                                                                            SHA-512:58D8277EC4101AD468DD8C4B4A9353AB684ECC391E5F9DB37DE44D5C3316C17D4C7A5FFD547CE9B9A08C56E3DD6D3C87428EAE12144DFB72FC448B0F2CFC47DA
                                                                                                                                                                                                                                            Malicious:true
                                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......B..x...+...+...+..P+...+T..*...+T..*...+T..*...+T..*...+..*...+...*...+...*...+...*...+...+U..+..*W..+..*...+..*...+Rich...+................PE..d...k..d.........." .........p.......7....................................................`.........................................0W...c..pS.......P..p....@...z..................................................C..8...........................................UPX0....................................UPX1................................@....rsrc....p...P...l..................@..............................................................................................................................................................................................................................................................................................................................................3.96.UPX!.$..

                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI70002\pywintypes310.dll

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\Desktop\NEVER OPEN!.exe
                                                                                                                                                                                                                                            File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):64000
                                                                                                                                                                                                                                            Entropy (8bit):7.542185527581843
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:1536:k2xBKwcTFzoNwouLGtUHhYrn/irawXffuJm8ei:kaBKwGOwoKGtUHhsnalvfuTe
                                                                                                                                                                                                                                            MD5:6F2AA8FA02F59671F99083F9CEF12CDA
                                                                                                                                                                                                                                            SHA1:9FD0716BCDE6AC01CD916BE28AA4297C5D4791CD
                                                                                                                                                                                                                                            SHA-256:1A15D98D4F9622FA81B60876A5F359707A88FBBBAE3AE4E0C799192C378EF8C6
                                                                                                                                                                                                                                            SHA-512:F5D5112E63307068CDB1D0670FE24B65A9F4942A39416F537BDBC17DEDFD99963861BF0F4E94299CDCE874816F27B3D86C4BEBB889C3162C666D5EE92229C211
                                                                                                                                                                                                                                            Malicious:true
                                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........9.$.X.w.X.w.X.w. [w.X.w.-.v.X.w.75w.X.w.-.v.X.w.-.v.X.w.-.v.X.w.3.v.X.wJ1.v.X.w.3.v.X.w.X.w.X.w,-.v.X.w,-.v.X.w,-.v.X.wRich.X.w........................PE..d......d.........." .........P.......z....................................................`.........................................p...dB..p...........p.......L......................................................8...........................................UPX0....................................UPX1................................@....rsrc....P.......J..................@......................................................................................................................................................................................................................................................................................................................................3.96.UPX!.$..

                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI70002\select.pyd

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\Desktop\NEVER OPEN!.exe
                                                                                                                                                                                                                                            File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):24952
                                                                                                                                                                                                                                            Entropy (8bit):7.398475586533855
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:384:wm71gl6dfHKsz8nUxaVXALcTwI77G26hMWIYiSy1pCQ0AA7Pxh8E9VF0Nym5ty:/1gl65HKXzTwI77G2BYiSyv87PxWEgC
                                                                                                                                                                                                                                            MD5:72009CDE5945DE0673A11EFB521C8CCD
                                                                                                                                                                                                                                            SHA1:BDDB47AC13C6302A871A53BA303001837939F837
                                                                                                                                                                                                                                            SHA-256:5AAA15868421A46461156E7817A69EEEB10B29C1E826A9155B5F8854FACF3DCA
                                                                                                                                                                                                                                            SHA-512:D00A42700C9201F23A44FD9407FEA7EA9DF1014C976133F33FF711150727BF160941373D53F3A973F7DD6CA7B5502E178C2B88EA1815CA8BCE1A239ED5D8256D
                                                                                                                                                                                                                                            Malicious:true
                                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........].t.<r'.<r'.<r'.D.'.<r'.@s&.<r'.@w&.<r'.@v&.<r'.@q&.<r'i@s&.<r'.<s'.<r'.Ns&.<r'i@.&.<r'i@r&.<r'i@.'.<r'i@p&.<r'Rich.<r'........PE..d...&..c.........." ...".0..........@.....................................................`......................................... ...L....................`..............l.......................................H...@...........................................UPX0....................................UPX1.....0.......(..................@....rsrc................,..............@..............................................................................................................................................................................................................................................................................................................................................................3.96.UPX!.$..

                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI70002\sqlite3.dll

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\Desktop\NEVER OPEN!.exe
                                                                                                                                                                                                                                            File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):623480
                                                                                                                                                                                                                                            Entropy (8bit):7.993548202681751
                                                                                                                                                                                                                                            Encrypted:true
                                                                                                                                                                                                                                            SSDEEP:12288:qZNIrMyJHzTarSwdWd5Xhm/27cz5hQYuHDiL1IcUq4P8ryHn5+8yjz:2NPsHzTaWwdS5xV70QYMDiCc34e8nI8+
                                                                                                                                                                                                                                            MD5:B70D218798C0FEC39DE1199C796EBCE8
                                                                                                                                                                                                                                            SHA1:73B9F8389706790A0FEC3C7662C997D0A238A4A0
                                                                                                                                                                                                                                            SHA-256:4830E8D4AE005A73834371FE7BB5B91CA8A4C4C3A4B9A838939F18920F10FAFF
                                                                                                                                                                                                                                            SHA-512:2EDE15CC8A229BFC599980CE7180A7A3C37C0264415470801CF098EF4DAC7BCF857821F647614490C1B0865882619A24E3AC0848B5AEA1796FAD054C0DD6F718
                                                                                                                                                                                                                                            Malicious:true
                                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......CG;..&U..&U..&U..^..&U.HZT..&U.HZP..&U.HZQ..&U.HZV..&U..TT..&U..&T..&U..Z]..&U..ZU..&U..Z...&U..ZW..&U.Rich.&U.................PE..d...X..c.........." ...".0...0............................................................`.............................................d"..................................x...........................................@...........................................UPX0....................................UPX1.....0.......(..................@....rsrc....0...........,..............@..............................................................................................................................................................................................................................................................................................................................................................3.96.UPX!.$..

                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI70002\unicodedata.pyd

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\Desktop\NEVER OPEN!.exe
                                                                                                                                                                                                                                            File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):294784
                                                                                                                                                                                                                                            Entropy (8bit):7.987306847288753
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:6144:XudZUEjoXwDrGv4qJBd4R0u3FIp6O4LMHS+OsfW/+vzoFZ:MGEjyirGd+f3FIp7eMHS+CUUT
                                                                                                                                                                                                                                            MD5:CA3BAEBF8725C7D785710F1DFBB2736D
                                                                                                                                                                                                                                            SHA1:8F9AEC2732A252888F3873967D8CC0139FF7F4E5
                                                                                                                                                                                                                                            SHA-256:F2D03A39556491D1ACE63447B067B38055F32F5F1523C01249BA18052C599B4C
                                                                                                                                                                                                                                            SHA-512:5C2397E4DCB361A154CD3887C229BCF7EF980ACBB4B851A16294D5DF6245B2615CC4B42F6A95CF1D3C49B735C2F7025447247D887CCF4CD964F19F14E4533470
                                                                                                                                                                                                                                            Malicious:true
                                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......0...t..t..t..}...r..;...v..;...y..;...|..;...w.....w......v..t..%.....u.....u...y.u.....u..Richt..........PE..d...(..c.........." ...".P..........@V... ................................................`..........................................{..X....y.......p..........<............{......................................8b..@...........................................UPX0....................................UPX1.....P... ...D..................@....rsrc........p.......H..............@..............................................................................................................................................................................................................................................................................................................................................................3.96.UPX!.$..

                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI70002\win32api.pyd

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\Desktop\NEVER OPEN!.exe
                                                                                                                                                                                                                                            File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):49664
                                                                                                                                                                                                                                            Entropy (8bit):7.834375167131465
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:768:lLHqNUpP9700eM3qeU4NWAXcnLim2sp94osOk7OPBBho8rzspYJP0Wgze:lLzrSeUGQLi+5sOt5Bbzs2Cze
                                                                                                                                                                                                                                            MD5:561F419A2B44158646EE13CD9AF44C60
                                                                                                                                                                                                                                            SHA1:93212788DE48E0A91E603D74F071A7C8F42FE39B
                                                                                                                                                                                                                                            SHA-256:631465DA2A1DAD0CB11CD86B14B4A0E4C7708D5B1E8D6F40AE9E794520C3AAF7
                                                                                                                                                                                                                                            SHA-512:D76AB089F6DC1BEFFD5247E81D267F826706E60604A157676E6CBC3B3447F5BCEE66A84BF35C21696C020362FADD814C3E0945942CDC5E0DFE44C0BCA169945C
                                                                                                                                                                                                                                            Malicious:true
                                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......X.uV....................N.......N.......N.......................N...................J...........................Rich............PE..d......d.........." ................@.....................................................`.........................................(.......`...........`...........................................................8...8.......................@...................UPX0....................................UPX1................................@....rsrc...............................@..............................................................................................................................................................................................................................................................................................................................................................3.96.UPX!.$..

                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI70002\win32com\shell\shell.pyd

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\Desktop\NEVER OPEN!.exe
                                                                                                                                                                                                                                            File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):152576
                                                                                                                                                                                                                                            Entropy (8bit):7.9721137465367
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:3072:jA+IckcVeE911B9PROpB23W4Ukx0xluxTZ/7cpltdYwT7VbbDAH:k5cv91jtROLH4n0xluxIlTF
                                                                                                                                                                                                                                            MD5:63ED2B5247381E04868B2362AB6CA3F0
                                                                                                                                                                                                                                            SHA1:804963B6F433CCB298B5D0B284CDDE63B0DEC388
                                                                                                                                                                                                                                            SHA-256:353D17F47E6EB8691F5C431B2526B468B28D808CBEE83F8F0D4B5C809728325E
                                                                                                                                                                                                                                            SHA-512:8C9148C1ED8F1A6ECD51B8D1C6DC3B0B96DC6828EFC0C6B8652872D9D4FEEB5704CDCCD43FD23F71A9E995733CC3A8B352BCB4B8BB59F05F596CEBDAA5C29966
                                                                                                                                                                                                                                            Malicious:true
                                                                                                                                                                                                                                            Preview:MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$.......M................).....[......[......[......[...................................................O.................Rich............................PE..d...(..d.........." .....P...................................................0............`..........................................&..L...P#..t.... ..P.......xx...........'..........................................8...........................................UPX0....................................UPX1.....P.......H..................@....rsrc........ .......L..............@..............................................................................................................................................................................................................................................................................................................................3.96.UPX!.$..

                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI70002\win32crypt.pyd

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\Desktop\NEVER OPEN!.exe
                                                                                                                                                                                                                                            File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):52736
                                                                                                                                                                                                                                            Entropy (8bit):7.733565165052535
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:1536:E9uTkXr2LgA+Q0/W25PVt9sjTQaFoJ7e3eDvfabM:YXXr2ga0BVtmFyJiuD3a
                                                                                                                                                                                                                                            MD5:B386EB9F697DE442C4D6E426D7973706
                                                                                                                                                                                                                                            SHA1:0CA2E62BCCC709092A5AC4284E4AB44339917805
                                                                                                                                                                                                                                            SHA-256:4377B52E95E1A82E77D3B0E6D19706D4C064F90EF3D05F4D05D5D8131F4EBABD
                                                                                                                                                                                                                                            SHA-512:25E91A0C1DAC2D7E7D9E2E0425B5A8AE0114B1F1D25558117864ED95F9A526435835EE58DFD50DE0C05A63519F19BFC538D09DDDE4E0B4672F8B08773B8F8F9B
                                                                                                                                                                                                                                            Malicious:true
                                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........................J.........................................`..............................................Rich............PE..d......d.........." .........0.......G....................................................`.........................................hf......hc.......`..h...................$........................................S..8...........................................UPX0....................................UPX1................................@....rsrc....0...`...$..................@..............................................................................................................................................................................................................................................................................................................................................................3.96.UPX!.$..

                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI70002\win32trace.pyd

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\Desktop\NEVER OPEN!.exe
                                                                                                                                                                                                                                            File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):14848
                                                                                                                                                                                                                                            Entropy (8bit):7.082172460598222
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:384:46KwMJFoeBJ4qCKU7xe+16ufjIS0hnUxaVXALOI1B1r:47wMJFoenUk/uf8dWBN
                                                                                                                                                                                                                                            MD5:E37A3CD90CFCC9A7D8002EFEC8E44138
                                                                                                                                                                                                                                            SHA1:3EB7D0E10193E41215B0E5B7C94C1B660189162A
                                                                                                                                                                                                                                            SHA-256:8B03D36BB3DA3CEA74FBC1FE4749E3187B1F72839C211CE1A0256B42B4B9B8C1
                                                                                                                                                                                                                                            SHA-512:A3022230F1A89ED3C3B03B17CA12991E61C29E4AE22EACEA6D700A3B8A325DCF6C8D7CC7293D2FF11941E37C4DBE0B1B5DF1DDC006F72B4DA448170653B7DDCD
                                                                                                                                                                                                                                            Malicious:true
                                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........*U@qD.@qD.@qD.I...DqD...E.BqD...A.JqD...@.HqD...G.CqD...E.BqD...E.BqD.T.E.EqD.@qE..qD...M.AqD...D.AqD...F.AqD.Rich@qD.................PE..d......d.........." .....0..........`.....................................................`.............................................T...h...8.......h....p......................................................X...8...........................................UPX0....................................UPX1.....0..........................@....rsrc................2..............@......................................................................................................................................................................................................................................................................................................................................................3.96.UPX!.$..

                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI70002\win32ui.pyd

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\Desktop\NEVER OPEN!.exe
                                                                                                                                                                                                                                            File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):279040
                                                                                                                                                                                                                                            Entropy (8bit):7.864533071557196
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:6144:iBjVLw7ShElYer9fB/YSYVye4ZgWJRi/tPUivxJSRYpnRlhG:iBpLwGalYU9fhYVd2gmi/tPUIWRsRlhG
                                                                                                                                                                                                                                            MD5:0EBD9CB6234A1C9D90F29E17A74A6E4C
                                                                                                                                                                                                                                            SHA1:2FB9488CACFB2625D7ED682559DAC5CAEB789F3A
                                                                                                                                                                                                                                            SHA-256:5BBA9608D364E79ED444666B8CF9E609C59D3BCC94AAB0435899E42CCCF9F566
                                                                                                                                                                                                                                            SHA-512:B7229699EAA1355A8BB533133905745C5D967020A8431824460D3D267DDDD9892B2CF1582856A048B2E4F331FA43A24408D3FA27A82098F642EB64F906C76FE6
                                                                                                                                                                                                                                            Malicious:true
                                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......aM.F%,r.%,r.%,r.,T../,r..Ys.',r..Es.',r.1Gs.+,r.wYv.-,r.wYq.!,r.wYw.3,r.%,s.-*r.wYs.",r..Y{..,r..Yr.$,r..Y..$,r..Yp.$,r.Rich%,r.........................PE..d......d.........." ................0}.......................................0............`..............................................T..<...........<8................... .. ...........................H...(...x...8...........................................UPX0....................................UPX1................................@....rsrc...............................@......................................................................................................................................................................................................................................................................................................................................3.96.UPX!.$..

                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI70002\yarl\_quoting_c.cp310-win_amd64.pyd

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\Desktop\NEVER OPEN!.exe
                                                                                                                                                                                                                                            File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):41984
                                                                                                                                                                                                                                            Entropy (8bit):7.860945320611378
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:768:tzY7iGEvYJSIlYZEVifuxMiC863eHarUVbQc3Vxun838MrkOC4:m7TEvYRyZ0ifXZ8WeLVbQ4MMrDH
                                                                                                                                                                                                                                            MD5:10834C99A1000E83B5846B7B426481C0
                                                                                                                                                                                                                                            SHA1:231E46B8B5582C36E201C195E93D4AE00DFB7541
                                                                                                                                                                                                                                            SHA-256:617E9C9889E9510FA0CDB00CA20E959850CC4BF231AC440ED8E11E3962A04653
                                                                                                                                                                                                                                            SHA-512:8E9BF6A4C6F5DAD727AD1C172E7DFEA4F2A23184F0D85BFDFF4E4A8939996DC370EFCDDBDEB5E26757E5DBA6BB9766EEB723B789CC86A89C054B964734CAB0B5
                                                                                                                                                                                                                                            Malicious:true
                                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......b..]&..&..&../..."..6K..$..m...$..6K..%..6K.....6K..*....%..&.....mJ..'..mJ..'..mJj.'..mJ..'..Rich&..........PE..d..."."g.........." ...).........`..@....p................................... ............`.............................................d...........................................................................8...@...........................................UPX0.....`..............................UPX1.........p......................@....rsrc...............................@..............................................................................................................................................................................................................................................................................................................................................................3.96.UPX!.$..

                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\arvdhy_a

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Roaming\empyrean\dat.txt
                                                                                                                                                                                                                                            File Type:ASCII text, with no line terminators
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):4
                                                                                                                                                                                                                                            Entropy (8bit):2.0
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:3:qn:qn
                                                                                                                                                                                                                                            MD5:3F1D1D8D87177D3D8D897D7E421F84D6
                                                                                                                                                                                                                                            SHA1:DD082D742A5CB751290F1DB2BD519C286AA86D95
                                                                                                                                                                                                                                            SHA-256:F02285FB90ED8C81531FE78CF4E2ABB68A62BE73EE7D317623E2C3E3AEFDFFF2
                                                                                                                                                                                                                                            SHA-512:2AE2B3936F31756332CA7A4B877D18F3FCC50E41E9472B5CD45A70BEA82E29A0FA956EE6A9EE0E02F23D9DB56B41D19CB51D88AAC06E9C923A820A21023752A9
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:blat

                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\jqcskgc2

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Roaming\empyrean\dat.txt
                                                                                                                                                                                                                                            File Type:ASCII text, with no line terminators
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):4
                                                                                                                                                                                                                                            Entropy (8bit):2.0
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:3:qn:qn
                                                                                                                                                                                                                                            MD5:3F1D1D8D87177D3D8D897D7E421F84D6
                                                                                                                                                                                                                                            SHA1:DD082D742A5CB751290F1DB2BD519C286AA86D95
                                                                                                                                                                                                                                            SHA-256:F02285FB90ED8C81531FE78CF4E2ABB68A62BE73EE7D317623E2C3E3AEFDFFF2
                                                                                                                                                                                                                                            SHA-512:2AE2B3936F31756332CA7A4B877D18F3FCC50E41E9472B5CD45A70BEA82E29A0FA956EE6A9EE0E02F23D9DB56B41D19CB51D88AAC06E9C923A820A21023752A9
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:blat

                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\tmp61_5leqc\gen_py\__init__.py

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Roaming\empyrean\dat.txt
                                                                                                                                                                                                                                            File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):176
                                                                                                                                                                                                                                            Entropy (8bit):4.713840781302666
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:3:S3yE25MOWrYXtHVE/DRFrgm5/gvJgXDLAUDA+ERo6+aEYqVS1f6gq1WGgVSBn:S3mSOWWHVUDjrgmxgRgzLXDA6Va8VeuR
                                                                                                                                                                                                                                            MD5:8C7CA775CF482C6027B4A2D3DB0F6A31
                                                                                                                                                                                                                                            SHA1:E3596A87DD6E81BA7CF43B0E8E80DA5BC823EA1A
                                                                                                                                                                                                                                            SHA-256:52C72CF96B12AE74D84F6C049775DA045FAE47C007DC834CA4DAC607B6F518EA
                                                                                                                                                                                                                                            SHA-512:19C7D229723249885B125121B3CC86E8C571360C1FB7F2AF92B251E6354A297B4C2B9A28E708F2394CA58C35B20987F8B65D9BD6543370F063BBD59DB4A186AC
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:# Generated file - this directory may be deleted to reset the COM cache.....import win32com..if __path__[:-1] != win32com.__gen_path__: __path__.append(win32com.__gen_path__)..

                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\tmp61_5leqc\gen_py\dicts.dat

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Roaming\empyrean\dat.txt
                                                                                                                                                                                                                                            File Type:data
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):10
                                                                                                                                                                                                                                            Entropy (8bit):2.7219280948873625
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:3:qW6:qW6
                                                                                                                                                                                                                                            MD5:2C7344F3031A5107275CE84AED227411
                                                                                                                                                                                                                                            SHA1:68ACAD72A154CBE8B2D597655FF84FD31D57C43B
                                                                                                                                                                                                                                            SHA-256:83CDA9FECC9C008B22C0C8E58CBCBFA577A3EF8EE9B2F983ED4A8659596D5C11
                                                                                                                                                                                                                                            SHA-512:F58362C70A2017875D231831AE5868DF22D0017B00098A28AACB5753432E8C4267AA7CBF6C5680FEB2DC9B7ABADE5654C3651685167CC26AA208A9EB71528BB6
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:..K....}..

                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\tmpfnzjife2\gen_py\__init__.py

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Roaming\empyrean\dat.txt
                                                                                                                                                                                                                                            File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):176
                                                                                                                                                                                                                                            Entropy (8bit):4.713840781302666
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:3:S3yE25MOWrYXtHVE/DRFrgm5/gvJgXDLAUDA+ERo6+aEYqVS1f6gq1WGgVSBn:S3mSOWWHVUDjrgmxgRgzLXDA6Va8VeuR
                                                                                                                                                                                                                                            MD5:8C7CA775CF482C6027B4A2D3DB0F6A31
                                                                                                                                                                                                                                            SHA1:E3596A87DD6E81BA7CF43B0E8E80DA5BC823EA1A
                                                                                                                                                                                                                                            SHA-256:52C72CF96B12AE74D84F6C049775DA045FAE47C007DC834CA4DAC607B6F518EA
                                                                                                                                                                                                                                            SHA-512:19C7D229723249885B125121B3CC86E8C571360C1FB7F2AF92B251E6354A297B4C2B9A28E708F2394CA58C35B20987F8B65D9BD6543370F063BBD59DB4A186AC
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:# Generated file - this directory may be deleted to reset the COM cache.....import win32com..if __path__[:-1] != win32com.__gen_path__: __path__.append(win32com.__gen_path__)..

                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\tmpfnzjife2\gen_py\dicts.dat

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Roaming\empyrean\dat.txt
                                                                                                                                                                                                                                            File Type:data
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):10
                                                                                                                                                                                                                                            Entropy (8bit):2.7219280948873625
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:3:qW6:qW6
                                                                                                                                                                                                                                            MD5:2C7344F3031A5107275CE84AED227411
                                                                                                                                                                                                                                            SHA1:68ACAD72A154CBE8B2D597655FF84FD31D57C43B
                                                                                                                                                                                                                                            SHA-256:83CDA9FECC9C008B22C0C8E58CBCBFA577A3EF8EE9B2F983ED4A8659596D5C11
                                                                                                                                                                                                                                            SHA-512:F58362C70A2017875D231831AE5868DF22D0017B00098A28AACB5753432E8C4267AA7CBF6C5680FEB2DC9B7ABADE5654C3651685167CC26AA208A9EB71528BB6
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:..K....}..

                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\tmpufkq9fz1\gen_py\__init__.py

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\Desktop\NEVER OPEN!.exe
                                                                                                                                                                                                                                            File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):176
                                                                                                                                                                                                                                            Entropy (8bit):4.713840781302666
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:3:S3yE25MOWrYXtHVE/DRFrgm5/gvJgXDLAUDA+ERo6+aEYqVS1f6gq1WGgVSBn:S3mSOWWHVUDjrgmxgRgzLXDA6Va8VeuR
                                                                                                                                                                                                                                            MD5:8C7CA775CF482C6027B4A2D3DB0F6A31
                                                                                                                                                                                                                                            SHA1:E3596A87DD6E81BA7CF43B0E8E80DA5BC823EA1A
                                                                                                                                                                                                                                            SHA-256:52C72CF96B12AE74D84F6C049775DA045FAE47C007DC834CA4DAC607B6F518EA
                                                                                                                                                                                                                                            SHA-512:19C7D229723249885B125121B3CC86E8C571360C1FB7F2AF92B251E6354A297B4C2B9A28E708F2394CA58C35B20987F8B65D9BD6543370F063BBD59DB4A186AC
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:# Generated file - this directory may be deleted to reset the COM cache.....import win32com..if __path__[:-1] != win32com.__gen_path__: __path__.append(win32com.__gen_path__)..

                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\tmpufkq9fz1\gen_py\dicts.dat

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\Desktop\NEVER OPEN!.exe
                                                                                                                                                                                                                                            File Type:data
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):10
                                                                                                                                                                                                                                            Entropy (8bit):2.7219280948873625
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:3:qW6:qW6
                                                                                                                                                                                                                                            MD5:2C7344F3031A5107275CE84AED227411
                                                                                                                                                                                                                                            SHA1:68ACAD72A154CBE8B2D597655FF84FD31D57C43B
                                                                                                                                                                                                                                            SHA-256:83CDA9FECC9C008B22C0C8E58CBCBFA577A3EF8EE9B2F983ED4A8659596D5C11
                                                                                                                                                                                                                                            SHA-512:F58362C70A2017875D231831AE5868DF22D0017B00098A28AACB5753432E8C4267AA7CBF6C5680FEB2DC9B7ABADE5654C3651685167CC26AA208A9EB71528BB6
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:..K....}..

                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\zjkxqdur

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\Desktop\NEVER OPEN!.exe
                                                                                                                                                                                                                                            File Type:ASCII text, with no line terminators
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):4
                                                                                                                                                                                                                                            Entropy (8bit):2.0
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:3:qn:qn
                                                                                                                                                                                                                                            MD5:3F1D1D8D87177D3D8D897D7E421F84D6
                                                                                                                                                                                                                                            SHA1:DD082D742A5CB751290F1DB2BD519C286AA86D95
                                                                                                                                                                                                                                            SHA-256:F02285FB90ED8C81531FE78CF4E2ABB68A62BE73EE7D317623E2C3E3AEFDFFF2
                                                                                                                                                                                                                                            SHA-512:2AE2B3936F31756332CA7A4B877D18F3FCC50E41E9472B5CD45A70BEA82E29A0FA956EE6A9EE0E02F23D9DB56B41D19CB51D88AAC06E9C923A820A21023752A9
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:blat

                                                                                                                                                                                                                                            C:\Users\user\AppData\Roaming\empyrean\cards_db

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Roaming\empyrean\dat.txt
                                                                                                                                                                                                                                            File Type:SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):114688
                                                                                                                                                                                                                                            Entropy (8bit):0.9746603542602881
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
                                                                                                                                                                                                                                            MD5:780853CDDEAEE8DE70F28A4B255A600B
                                                                                                                                                                                                                                            SHA1:AD7A5DA33F7AD12946153C497E990720B09005ED
                                                                                                                                                                                                                                            SHA-256:1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
                                                                                                                                                                                                                                            SHA-512:E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                            C:\Users\user\AppData\Roaming\empyrean\cookie_db

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Roaming\empyrean\dat.txt
                                                                                                                                                                                                                                            File Type:SQLite 3.x database, last written using SQLite version 3042000, file counter 11, database pages 7, cookie 0x3, schema 4, UTF-8, version-valid-for 11
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):28672
                                                                                                                                                                                                                                            Entropy (8bit):2.5793180405395284
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:96:/xealJiylsMjLslk5nYPphZEhcR2hO2mOeVgN8tmKqWkh3qzRk4PeOhZ3hcR1hOI:/xGZR8wbtxq5uWRHKloIN7YItnb6Ggz
                                                                                                                                                                                                                                            MD5:41EA9A4112F057AE6BA17E2838AEAC26
                                                                                                                                                                                                                                            SHA1:F2B389103BFD1A1A050C4857A995B09FEAFE8903
                                                                                                                                                                                                                                            SHA-256:CE84656EAEFC842355D668E7141F84383D3A0C819AE01B26A04F9021EF0AC9DB
                                                                                                                                                                                                                                            SHA-512:29E848AD16D458F81D8C4F4E288094B4CFC103AD99B4511ED1A4846542F9128736A87AAC5F4BFFBEFE7DF99A05EB230911EDCE99FEE3877DEC130C2781962103
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                            C:\Users\user\AppData\Roaming\empyrean\dat.txt

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\Desktop\NEVER OPEN!.exe
                                                                                                                                                                                                                                            File Type:PE32+ executable (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):18752296
                                                                                                                                                                                                                                            Entropy (8bit):7.997981196444236
                                                                                                                                                                                                                                            Encrypted:true
                                                                                                                                                                                                                                            SSDEEP:393216:dqPnLFXlrzQMDOETgsvfGjg+lPvEny38cdwAqo:kPLFXNzQRECJlUFc8o
                                                                                                                                                                                                                                            MD5:61B5A3066BCF661F69B9E362EF1A1F8C
                                                                                                                                                                                                                                            SHA1:BC6701F2A76CB5DB3EA27371240B7E295382D29C
                                                                                                                                                                                                                                            SHA-256:2949DF50691624E3A64635FBF690527E245D5C83DD3BD8F000F34447A6386BA2
                                                                                                                                                                                                                                            SHA-512:641AACD33F4D73F5D488D1799159832B423C0025B9916AC3C5A484B57FA4DA1CE270D7CC5F7D428AB03D1AA9791995A86AF496F68417612A55BB5AD6E06B14B0
                                                                                                                                                                                                                                            Malicious:true
                                                                                                                                                                                                                                            Yara Hits:
                                                                                                                                                                                                                                            • Rule: JoeSecurity_DiscordTokenStealer_1, Description: Yara detected Discord Token Stealer, Source: C:\Users\user\AppData\Roaming\empyrean\dat.txt, Author: Joe Security
                                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......................@.....@.-...@.......H.......................@.........................Rich............PE..d....X6g..........".... .....Z.................@.............................0............`.................................................$...x.... ........... ........... ..T.......................................@............................................text............................... ..`.rdata...(.......*..................@..@.data...............................@....pdata... ......."..................@..@_RDATA..\...........................@..@.rsrc........ ......................@..@.reloc..T.... ......................@..B................................................................................................................................................................................................................

                                                                                                                                                                                                                                            C:\Users\user\AppData\Roaming\empyrean\downloads_db

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Roaming\empyrean\dat.txt
                                                                                                                                                                                                                                            File Type:SQLite 3.x database, last written using SQLite version 3035005, file counter 2, database pages 31, cookie 0x18, schema 4, UTF-8, version-valid-for 2
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):126976
                                                                                                                                                                                                                                            Entropy (8bit):0.47147045728725767
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:96:/WU+bDoYysX0uhnyTpvVjN9DLjGQLBE3u:/l+bDo3irhnyTpvVj3XBBE3u
                                                                                                                                                                                                                                            MD5:A2D1F4CF66465F9F0CAC61C4A95C7EDE
                                                                                                                                                                                                                                            SHA1:BA6A845E247B221AAEC96C4213E1FD3744B10A27
                                                                                                                                                                                                                                            SHA-256:B510DF8D67E38DCAE51FE97A3924228AD37CF823999FD3BC6BA44CA6535DE8FE
                                                                                                                                                                                                                                            SHA-512:C571E5125C005EAC0F0B72B5F132AE03783AF8D621BFA32B366B0E8A825EF8F65E33CD330E42BDC722BFA012E3447A7218F05FDD4A5AD855C1CA22DFA2F79838
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                            C:\Users\user\AppData\Roaming\empyrean\login_db

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Roaming\empyrean\dat.txt
                                                                                                                                                                                                                                            File Type:SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):40960
                                                                                                                                                                                                                                            Entropy (8bit):0.8553638852307782
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
                                                                                                                                                                                                                                            MD5:28222628A3465C5F0D4B28F70F97F482
                                                                                                                                                                                                                                            SHA1:1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
                                                                                                                                                                                                                                            SHA-256:93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
                                                                                                                                                                                                                                            SHA-512:C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                            C:\Users\user\AppData\Roaming\empyrean\run.bat

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\Desktop\NEVER OPEN!.exe
                                                                                                                                                                                                                                            File Type:DOS batch file, ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):63
                                                                                                                                                                                                                                            Entropy (8bit):4.629758447474819
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:3:mKDDVEONt+kiEaKC53KGdRn:hy+wknaZ56GTn
                                                                                                                                                                                                                                            MD5:E3DBA6CB5918342B03C6C98F19DE7415
                                                                                                                                                                                                                                            SHA1:514ADFE797B028DBCC55A4CFCCA9CBA0E6272673
                                                                                                                                                                                                                                            SHA-256:B2D86E5A1D46F15FCEB1649EB580322EA838449716D83164B4B92A2911AAD7E9
                                                                                                                                                                                                                                            SHA-512:499EE95843CB7CF121F494F76BB24D5B3E422F71DC98313B79291ABDBE6DC63C7289946A3669B7149DD6CCC2EB0454F5FAD6433C0435914ABC6EA58128EC1ED5
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:@echo off..call C:\Users\user\AppData\Roaming\empyrean\dat.txt

                                                                                                                                                                                                                                            C:\Users\user\AppData\Roaming\empyrean\vault.zip

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Roaming\empyrean\dat.txt
                                                                                                                                                                                                                                            File Type:Zip archive data, at least v2.0 to extract, compression method=store
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):5016
                                                                                                                                                                                                                                            Entropy (8bit):5.9764483500636745
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:96:OYEJMpoO2gFcRqFZL2L+yLstv3pPDYReynqsbCw4R2cksLUdmUwEmDaDKymDEDK2:KFFRiNEUds5VTx
                                                                                                                                                                                                                                            MD5:224B25F42A20D8C11A8E94648B4F52AD
                                                                                                                                                                                                                                            SHA1:1BCF6B9874DC3B8C93C9DAD798E1C60EDF2B9E08
                                                                                                                                                                                                                                            SHA-256:43C742C18E491938944DB0B5CB5958FBA45B84878DFF57A320CCA43283EF72F3
                                                                                                                                                                                                                                            SHA-512:B639BC75BFC4D7E6A550D6D41D8F771B0CE7A20676640167DA5310BF417CB2D1390DAEE25C97911D83734FC6E115A06E5C9C888404C9A7A866C020EC0AA4D88A
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:PK.........&oY.<..............cookies.txt.google.com.TRUE./.FALSE.13356618603686193.NID.511=j8SQUTltnVU5cOAeyzqSxW-qHOakRuBHDQGLTGeceC9Z5rRzk5trMKb4CuZC_CFmc7KFwQcRJL-qGz8MvkkzMZmElvXAFWLO-TPZ9PMqBYA78ZAuaepnXIRHe-TAolVoW6Z7dQnqpgyX0m-TmS72bebAgoqZv5GkpRFUcZIw1Kk..support.microsoft.com.TRUE./.TRUE.13340887435186329..AspNetCore.AuthProvider.True..support.microsoft.com.TRUE./signin-oidc.TRUE.13340887735359381..AspNetCore.Correlation.mdRqPJxLbpyv7vX0eK9YkTR-xwcrW3VBLE4Y3HEvxuU.N..support.microsoft.com.TRUE./signin-oidc.TRUE.13340887735359334..AspNetCore.OpenIdConnect.Nonce.CfDJ8Kiuy_B5JgFMo7PeP95NLhqwcJ8koDy5pXkfoWsb5SbbU2hVCbsH2qt9GF_OVCqFkLEwhvzeADNQOF5RSmkDfh5RqfqlOkx5QWo4Lltvwb0CvwBFD8ujlm3BAglOeGca3ZatkLMUkHB6alahUr8qJ7G_3AejtooymTWCzyO89hshJeX8Gh78kohbIw0IQY4v6LZriT4P2fGeBSMjrvqODB4H_bs2nbfsSfL7aN-SiX4Yyn3iFo5fv-Rsj0cGE-FFrP1uXNT7Y1VSMOfm-L0RnS8.N..support.office.com.TRUE./.TRUE.13372509232238068.EXPID.8e067c40-5461-4aef-885f-2c92ce6a5474...microsoft.com.TRUE./.FALSE.133724228370176

                                                                                                                                                                                                                                            C:\Users\user\AppData\Roaming\empyrean\vault\cookies.txt

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Roaming\empyrean\dat.txt
                                                                                                                                                                                                                                            File Type:ASCII text, with very long lines (522), with CRLF line terminators
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):3343
                                                                                                                                                                                                                                            Entropy (8bit):5.859453163399709
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:96:jJMpoO2gFcRqFZL2L+yLstv3pPDYReynqsbCw4R2cksy:NFFRiNEUdC
                                                                                                                                                                                                                                            MD5:3A53152A5A407F6FFC00ACCAF475ACA7
                                                                                                                                                                                                                                            SHA1:535A984DD89A56CA94FC1E77D4EC8B5E5F6AD6F5
                                                                                                                                                                                                                                            SHA-256:8DF02145633200812938312EE054F6686D60CC7C11B3C17E2492AAE545907A2C
                                                                                                                                                                                                                                            SHA-512:85A269B5BDF1C8B6CBBAA79756A9BCECCF18A3EE76518D7DC77223689B9FE9D48E0C079A87AB7F3EAD8A8FD35091E2C3F6EB83E66C3F61F83F57A262273904FA
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:.google.com.TRUE./.FALSE.13356618603686193.NID.511=j8SQUTltnVU5cOAeyzqSxW-qHOakRuBHDQGLTGeceC9Z5rRzk5trMKb4CuZC_CFmc7KFwQcRJL-qGz8MvkkzMZmElvXAFWLO-TPZ9PMqBYA78ZAuaepnXIRHe-TAolVoW6Z7dQnqpgyX0m-TmS72bebAgoqZv5GkpRFUcZIw1Kk..support.microsoft.com.TRUE./.TRUE.13340887435186329..AspNetCore.AuthProvider.True..support.microsoft.com.TRUE./signin-oidc.TRUE.13340887735359381..AspNetCore.Correlation.mdRqPJxLbpyv7vX0eK9YkTR-xwcrW3VBLE4Y3HEvxuU.N..support.microsoft.com.TRUE./signin-oidc.TRUE.13340887735359334..AspNetCore.OpenIdConnect.Nonce.CfDJ8Kiuy_B5JgFMo7PeP95NLhqwcJ8koDy5pXkfoWsb5SbbU2hVCbsH2qt9GF_OVCqFkLEwhvzeADNQOF5RSmkDfh5RqfqlOkx5QWo4Lltvwb0CvwBFD8ujlm3BAglOeGca3ZatkLMUkHB6alahUr8qJ7G_3AejtooymTWCzyO89hshJeX8Gh78kohbIw0IQY4v6LZriT4P2fGeBSMjrvqODB4H_bs2nbfsSfL7aN-SiX4Yyn3iFo5fv-Rsj0cGE-FFrP1uXNT7Y1VSMOfm-L0RnS8.N..support.office.com.TRUE./.TRUE.13372509232238068.EXPID.8e067c40-5461-4aef-885f-2c92ce6a5474...microsoft.com.TRUE./.FALSE.13372422837017624.MC1.GUID=749eee6039c5489b9db3000c7ab3f

                                                                                                                                                                                                                                            C:\Users\user\AppData\Roaming\empyrean\vault\web_history.txt

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Roaming\empyrean\dat.txt
                                                                                                                                                                                                                                            File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):1447
                                                                                                                                                                                                                                            Entropy (8bit):5.2939251835731485
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:24:2rTKOmoLwoh9wWEZOmoLwpjRmZDKJLOmoLwpjRSpDKJLOmoLrTscOWzoGwoPpAcP:SdmSTwEmSYVcDKJymSYVuDKJymSrV3PZ
                                                                                                                                                                                                                                            MD5:7C745F9B4F4CBDFB228CE16681A339F3
                                                                                                                                                                                                                                            SHA1:4EDA1565D42EAC4D7EF8674EC49AF2ADEBF3C0CD
                                                                                                                                                                                                                                            SHA-256:750CE5E82DF5E393FF5B3D116006A5967D0D9DD97A07DB7AAC5D8F4C42EA8EAF
                                                                                                                                                                                                                                            SHA-512:CC93E8D4A8BC5B0C7CB2B8ECCC0859D190992246905928D581417053185BA7AB98289294C9B74152FBAECB226C25819457CCFEE31F4301012A76F557E7211075
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:https://go.microsoft.com/fwlink/?linkid=851546.Examples of Office product keys - Microsoft Support.13340808471256388..https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016.Examples of Office product keys - Microsoft Support.13340808471256388..https://support.microsoft.com/en-us/office/7d48285b-20e8-4b9b-91ad-216e34163bad?wt.mc_id=enterpk2016&ui=en-us&rs=en-us&ad=us.Examples of Office product keys - Microsoft Support.13340808471256388..https://support.microsoft.com/en-us/office/examples-of-office-product-keys-7d48285b-20e8-4b9b-91ad-216e34163bad?wt.mc_id=enterpk2016&ui=en-us&rs=en-us&ad=us.Examples of Office product keys - Microsoft Support.13340808471256388..https://go.microsoft.com/fwlink/?LinkId=2106243.Install the English Language Pack for 32-bit Office - Microsoft Support.13340886879459830..https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17.Install the English Language Pack for 32-bit Office - Microsoft Support.13340886879

                                                                                                                                                                                                                                            C:\Users\user\AppData\Roaming\empyrean\web_history_db

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Roaming\empyrean\dat.txt
                                                                                                                                                                                                                                            File Type:SQLite 3.x database, last written using SQLite version 3035005, file counter 2, database pages 31, cookie 0x18, schema 4, UTF-8, version-valid-for 2
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):126976
                                                                                                                                                                                                                                            Entropy (8bit):0.47147045728725767
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:96:/WU+bDoYysX0uhnyTpvVjN9DLjGQLBE3u:/l+bDo3irhnyTpvVj3XBBE3u
                                                                                                                                                                                                                                            MD5:A2D1F4CF66465F9F0CAC61C4A95C7EDE
                                                                                                                                                                                                                                            SHA1:BA6A845E247B221AAEC96C4213E1FD3744B10A27
                                                                                                                                                                                                                                            SHA-256:B510DF8D67E38DCAE51FE97A3924228AD37CF823999FD3BC6BA44CA6535DE8FE
                                                                                                                                                                                                                                            SHA-512:C571E5125C005EAC0F0B72B5F132AE03783AF8D621BFA32B366B0E8A825EF8F65E33CD330E42BDC722BFA012E3447A7218F05FDD4A5AD855C1CA22DFA2F79838
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                            C:\Users\user\Desktop\cards_db

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\Desktop\NEVER OPEN!.exe
                                                                                                                                                                                                                                            File Type:SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):114688
                                                                                                                                                                                                                                            Entropy (8bit):0.9746603542602881
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
                                                                                                                                                                                                                                            MD5:780853CDDEAEE8DE70F28A4B255A600B
                                                                                                                                                                                                                                            SHA1:AD7A5DA33F7AD12946153C497E990720B09005ED
                                                                                                                                                                                                                                            SHA-256:1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
                                                                                                                                                                                                                                            SHA-512:E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                            C:\Users\user\Desktop\cookie_db

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\Desktop\NEVER OPEN!.exe
                                                                                                                                                                                                                                            File Type:SQLite 3.x database, last written using SQLite version 3042000, file counter 11, database pages 7, cookie 0x3, schema 4, UTF-8, version-valid-for 11
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):28672
                                                                                                                                                                                                                                            Entropy (8bit):2.5793180405395284
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:96:/xealJiylsMjLslk5nYPphZEhcR2hO2mOeVgN8tmKqWkh3qzRk4PeOhZ3hcR1hOI:/xGZR8wbtxq5uWRHKloIN7YItnb6Ggz
                                                                                                                                                                                                                                            MD5:41EA9A4112F057AE6BA17E2838AEAC26
                                                                                                                                                                                                                                            SHA1:F2B389103BFD1A1A050C4857A995B09FEAFE8903
                                                                                                                                                                                                                                            SHA-256:CE84656EAEFC842355D668E7141F84383D3A0C819AE01B26A04F9021EF0AC9DB
                                                                                                                                                                                                                                            SHA-512:29E848AD16D458F81D8C4F4E288094B4CFC103AD99B4511ED1A4846542F9128736A87AAC5F4BFFBEFE7DF99A05EB230911EDCE99FEE3877DEC130C2781962103
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                            C:\Users\user\Desktop\downloads_db

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\Desktop\NEVER OPEN!.exe
                                                                                                                                                                                                                                            File Type:SQLite 3.x database, last written using SQLite version 3035005, file counter 2, database pages 31, cookie 0x18, schema 4, UTF-8, version-valid-for 2
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):126976
                                                                                                                                                                                                                                            Entropy (8bit):0.47147045728725767
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:96:/WU+bDoYysX0uhnyTpvVjN9DLjGQLBE3u:/l+bDo3irhnyTpvVj3XBBE3u
                                                                                                                                                                                                                                            MD5:A2D1F4CF66465F9F0CAC61C4A95C7EDE
                                                                                                                                                                                                                                            SHA1:BA6A845E247B221AAEC96C4213E1FD3744B10A27
                                                                                                                                                                                                                                            SHA-256:B510DF8D67E38DCAE51FE97A3924228AD37CF823999FD3BC6BA44CA6535DE8FE
                                                                                                                                                                                                                                            SHA-512:C571E5125C005EAC0F0B72B5F132AE03783AF8D621BFA32B366B0E8A825EF8F65E33CD330E42BDC722BFA012E3447A7218F05FDD4A5AD855C1CA22DFA2F79838
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                            C:\Users\user\Desktop\login_db

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\Desktop\NEVER OPEN!.exe
                                                                                                                                                                                                                                            File Type:SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 1, database pages 24, cookie 0xe, schema 4, UTF-8, version-valid-for 1
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):49152
                                                                                                                                                                                                                                            Entropy (8bit):0.8180424350137764
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:96:uRMKLyeymwxCn8MZyFlSynlbiXyKwt8hG:uRkxGOXnlbibhG
                                                                                                                                                                                                                                            MD5:349E6EB110E34A08924D92F6B334801D
                                                                                                                                                                                                                                            SHA1:BDFB289DAFF51890CC71697B6322AA4B35EC9169
                                                                                                                                                                                                                                            SHA-256:C9FD7BE4579E4AA942E8C2B44AB10115FA6C2FE6AFD0C584865413D9D53F3B2A
                                                                                                                                                                                                                                            SHA-512:2A635B815A5E117EA181EE79305EE1BAF591459427ACC5210D8C6C7E447BE3513EAD871C605EB3D32E4AB4111B2A335F26520D0EF8C1245A4AF44E1FAEC44574
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                            C:\Users\user\Desktop\vault.zip

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\Desktop\NEVER OPEN!.exe
                                                                                                                                                                                                                                            File Type:Zip archive data, at least v2.0 to extract, compression method=store
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):5016
                                                                                                                                                                                                                                            Entropy (8bit):5.976789160658679
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:96:QEJMpoO2gFcRqFZL2L+yLstv3pPDYReynqsbCw4R2cks1dmUwEmDaDKymDEDKymm:tFFRiNEUdz5VTL
                                                                                                                                                                                                                                            MD5:B54B2DE8784FC1F041C95BFEB155B0CB
                                                                                                                                                                                                                                            SHA1:D2C1013047344FD71F2A9A16A96443EBA2A7389B
                                                                                                                                                                                                                                            SHA-256:94C016F81B7D27A04D0729E88B76090BDE39C345D8CECFDCE8E71D43D2EC0C22
                                                                                                                                                                                                                                            SHA-512:3A6C9E45727AF721CFB6BE35BF74C4F4797939E0045E5C8726FC57FDE2F070373F7C31D9D851259E81C43E213476F916B2D3038800FFB769A6AF67E4FF54E8E9
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:PK.........&oY.<..............cookies.txt.google.com.TRUE./.FALSE.13356618603686193.NID.511=j8SQUTltnVU5cOAeyzqSxW-qHOakRuBHDQGLTGeceC9Z5rRzk5trMKb4CuZC_CFmc7KFwQcRJL-qGz8MvkkzMZmElvXAFWLO-TPZ9PMqBYA78ZAuaepnXIRHe-TAolVoW6Z7dQnqpgyX0m-TmS72bebAgoqZv5GkpRFUcZIw1Kk..support.microsoft.com.TRUE./.TRUE.13340887435186329..AspNetCore.AuthProvider.True..support.microsoft.com.TRUE./signin-oidc.TRUE.13340887735359381..AspNetCore.Correlation.mdRqPJxLbpyv7vX0eK9YkTR-xwcrW3VBLE4Y3HEvxuU.N..support.microsoft.com.TRUE./signin-oidc.TRUE.13340887735359334..AspNetCore.OpenIdConnect.Nonce.CfDJ8Kiuy_B5JgFMo7PeP95NLhqwcJ8koDy5pXkfoWsb5SbbU2hVCbsH2qt9GF_OVCqFkLEwhvzeADNQOF5RSmkDfh5RqfqlOkx5QWo4Lltvwb0CvwBFD8ujlm3BAglOeGca3ZatkLMUkHB6alahUr8qJ7G_3AejtooymTWCzyO89hshJeX8Gh78kohbIw0IQY4v6LZriT4P2fGeBSMjrvqODB4H_bs2nbfsSfL7aN-SiX4Yyn3iFo5fv-Rsj0cGE-FFrP1uXNT7Y1VSMOfm-L0RnS8.N..support.office.com.TRUE./.TRUE.13372509232238068.EXPID.8e067c40-5461-4aef-885f-2c92ce6a5474...microsoft.com.TRUE./.FALSE.133724228370176

                                                                                                                                                                                                                                            C:\Users\user\Desktop\vault\cookies.txt

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\Desktop\NEVER OPEN!.exe
                                                                                                                                                                                                                                            File Type:ASCII text, with very long lines (522), with CRLF line terminators
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):3343
                                                                                                                                                                                                                                            Entropy (8bit):5.859453163399709
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:96:jJMpoO2gFcRqFZL2L+yLstv3pPDYReynqsbCw4R2cksy:NFFRiNEUdC
                                                                                                                                                                                                                                            MD5:3A53152A5A407F6FFC00ACCAF475ACA7
                                                                                                                                                                                                                                            SHA1:535A984DD89A56CA94FC1E77D4EC8B5E5F6AD6F5
                                                                                                                                                                                                                                            SHA-256:8DF02145633200812938312EE054F6686D60CC7C11B3C17E2492AAE545907A2C
                                                                                                                                                                                                                                            SHA-512:85A269B5BDF1C8B6CBBAA79756A9BCECCF18A3EE76518D7DC77223689B9FE9D48E0C079A87AB7F3EAD8A8FD35091E2C3F6EB83E66C3F61F83F57A262273904FA
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:.google.com.TRUE./.FALSE.13356618603686193.NID.511=j8SQUTltnVU5cOAeyzqSxW-qHOakRuBHDQGLTGeceC9Z5rRzk5trMKb4CuZC_CFmc7KFwQcRJL-qGz8MvkkzMZmElvXAFWLO-TPZ9PMqBYA78ZAuaepnXIRHe-TAolVoW6Z7dQnqpgyX0m-TmS72bebAgoqZv5GkpRFUcZIw1Kk..support.microsoft.com.TRUE./.TRUE.13340887435186329..AspNetCore.AuthProvider.True..support.microsoft.com.TRUE./signin-oidc.TRUE.13340887735359381..AspNetCore.Correlation.mdRqPJxLbpyv7vX0eK9YkTR-xwcrW3VBLE4Y3HEvxuU.N..support.microsoft.com.TRUE./signin-oidc.TRUE.13340887735359334..AspNetCore.OpenIdConnect.Nonce.CfDJ8Kiuy_B5JgFMo7PeP95NLhqwcJ8koDy5pXkfoWsb5SbbU2hVCbsH2qt9GF_OVCqFkLEwhvzeADNQOF5RSmkDfh5RqfqlOkx5QWo4Lltvwb0CvwBFD8ujlm3BAglOeGca3ZatkLMUkHB6alahUr8qJ7G_3AejtooymTWCzyO89hshJeX8Gh78kohbIw0IQY4v6LZriT4P2fGeBSMjrvqODB4H_bs2nbfsSfL7aN-SiX4Yyn3iFo5fv-Rsj0cGE-FFrP1uXNT7Y1VSMOfm-L0RnS8.N..support.office.com.TRUE./.TRUE.13372509232238068.EXPID.8e067c40-5461-4aef-885f-2c92ce6a5474...microsoft.com.TRUE./.FALSE.13372422837017624.MC1.GUID=749eee6039c5489b9db3000c7ab3f

                                                                                                                                                                                                                                            C:\Users\user\Desktop\vault\web_history.txt

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\Desktop\NEVER OPEN!.exe
                                                                                                                                                                                                                                            File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):1447
                                                                                                                                                                                                                                            Entropy (8bit):5.2939251835731485
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:24:2rTKOmoLwoh9wWEZOmoLwpjRmZDKJLOmoLwpjRSpDKJLOmoLrTscOWzoGwoPpAcP:SdmSTwEmSYVcDKJymSYVuDKJymSrV3PZ
                                                                                                                                                                                                                                            MD5:7C745F9B4F4CBDFB228CE16681A339F3
                                                                                                                                                                                                                                            SHA1:4EDA1565D42EAC4D7EF8674EC49AF2ADEBF3C0CD
                                                                                                                                                                                                                                            SHA-256:750CE5E82DF5E393FF5B3D116006A5967D0D9DD97A07DB7AAC5D8F4C42EA8EAF
                                                                                                                                                                                                                                            SHA-512:CC93E8D4A8BC5B0C7CB2B8ECCC0859D190992246905928D581417053185BA7AB98289294C9B74152FBAECB226C25819457CCFEE31F4301012A76F557E7211075
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:https://go.microsoft.com/fwlink/?linkid=851546.Examples of Office product keys - Microsoft Support.13340808471256388..https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016.Examples of Office product keys - Microsoft Support.13340808471256388..https://support.microsoft.com/en-us/office/7d48285b-20e8-4b9b-91ad-216e34163bad?wt.mc_id=enterpk2016&ui=en-us&rs=en-us&ad=us.Examples of Office product keys - Microsoft Support.13340808471256388..https://support.microsoft.com/en-us/office/examples-of-office-product-keys-7d48285b-20e8-4b9b-91ad-216e34163bad?wt.mc_id=enterpk2016&ui=en-us&rs=en-us&ad=us.Examples of Office product keys - Microsoft Support.13340808471256388..https://go.microsoft.com/fwlink/?LinkId=2106243.Install the English Language Pack for 32-bit Office - Microsoft Support.13340886879459830..https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17.Install the English Language Pack for 32-bit Office - Microsoft Support.13340886879

                                                                                                                                                                                                                                            C:\Users\user\Desktop\web_history_db

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\Desktop\NEVER OPEN!.exe
                                                                                                                                                                                                                                            File Type:SQLite 3.x database, last written using SQLite version 3035005, file counter 2, database pages 31, cookie 0x18, schema 4, UTF-8, version-valid-for 2
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):126976
                                                                                                                                                                                                                                            Entropy (8bit):0.47147045728725767
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:96:/WU+bDoYysX0uhnyTpvVjN9DLjGQLBE3u:/l+bDo3irhnyTpvVj3XBBE3u
                                                                                                                                                                                                                                            MD5:A2D1F4CF66465F9F0CAC61C4A95C7EDE
                                                                                                                                                                                                                                            SHA1:BA6A845E247B221AAEC96C4213E1FD3744B10A27
                                                                                                                                                                                                                                            SHA-256:B510DF8D67E38DCAE51FE97A3924228AD37CF823999FD3BC6BA44CA6535DE8FE
                                                                                                                                                                                                                                            SHA-512:C571E5125C005EAC0F0B72B5F132AE03783AF8D621BFA32B366B0E8A825EF8F65E33CD330E42BDC722BFA012E3447A7218F05FDD4A5AD855C1CA22DFA2F79838
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                            \Device\Null

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Windows\System32\reg.exe
                                                                                                                                                                                                                                            File Type:ASCII text, with CRLF, CR line terminators
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):40
                                                                                                                                                                                                                                            Entropy (8bit):4.237326145256008
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:3:bqX4LxGT82AGN8cyn:bqX4E8NGN8Rn
                                                                                                                                                                                                                                            MD5:13015015DD907D28996153DF14881252
                                                                                                                                                                                                                                            SHA1:532C595BAAE0A027D02D1B28D7B83D57350A310E
                                                                                                                                                                                                                                            SHA-256:4499283166530CE395CBC12677FEF2BD52759EACDCC5BDDE56C039B1A2E99C0B
                                                                                                                                                                                                                                            SHA-512:B81FB62AB27E7722BFCB386766FFA1D1EBA05B8B03CD5D2160BB2570F87568381D923AC75017D785E1DEC1685769023727F4280E27C2A69CDE69772CA62E2A92
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:The operation completed successfully....

                                                                                                                                                                                                                                            Static File Info

                                                                                                                                                                                                                                            General

                                                                                                                                                                                                                                            File type:PE32+ executable (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                            Entropy (8bit):7.997981196444236
                                                                                                                                                                                                                                            TrID:
                                                                                                                                                                                                                                            • Win64 Executable GUI (202006/5) 92.65%
                                                                                                                                                                                                                                            • Win64 Executable (generic) (12005/4) 5.51%
                                                                                                                                                                                                                                            • Generic Win/DOS Executable (2004/3) 0.92%
                                                                                                                                                                                                                                            • DOS Executable Generic (2002/1) 0.92%
                                                                                                                                                                                                                                            • Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
                                                                                                                                                                                                                                            File name:NEVER OPEN!.exe
                                                                                                                                                                                                                                            File size:18'752'296 bytes
                                                                                                                                                                                                                                            MD5:61b5a3066bcf661f69b9e362ef1a1f8c
                                                                                                                                                                                                                                            SHA1:bc6701f2a76cb5db3ea27371240b7e295382d29c
                                                                                                                                                                                                                                            SHA256:2949df50691624e3a64635fbf690527e245d5c83dd3bd8f000f34447a6386ba2
                                                                                                                                                                                                                                            SHA512:641aacd33f4d73f5d488d1799159832b423c0025b9916ac3c5a484b57fa4da1ce270d7cc5f7d428ab03d1aa9791995a86af496f68417612a55bb5ad6e06b14b0
                                                                                                                                                                                                                                            SSDEEP:393216:dqPnLFXlrzQMDOETgsvfGjg+lPvEny38cdwAqo:kPLFXNzQRECJlUFc8o
                                                                                                                                                                                                                                            TLSH:561733F0625809A6E8E6553E5C0F8C6B0177FD4623A4DCCE83B099388FA37556D7AF90
                                                                                                                                                                                                                                            File Content Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......................@.......@...-...@.........H.............................@...............................Rich............PE..d..

                                                                                                                                                                                                                                            File Icon

                                                                                                                                                                                                                                            Icon Hash:4a464cd47461e179

                                                                                                                                                                                                                                            Static PE Info

                                                                                                                                                                                                                                            General

                                                                                                                                                                                                                                            Entrypoint:0x14000afa0
                                                                                                                                                                                                                                            Entrypoint Section:.text
                                                                                                                                                                                                                                            Digitally signed:false
                                                                                                                                                                                                                                            Imagebase:0x140000000
                                                                                                                                                                                                                                            Subsystem:windows gui
                                                                                                                                                                                                                                            Image File Characteristics:EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE
                                                                                                                                                                                                                                            DLL Characteristics:HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, GUARD_CF, TERMINAL_SERVER_AWARE
                                                                                                                                                                                                                                            Time Stamp:0x673658CD [Thu Nov 14 20:08:45 2024 UTC]
                                                                                                                                                                                                                                            TLS Callbacks:
                                                                                                                                                                                                                                            CLR (.Net) Version:
                                                                                                                                                                                                                                            OS Version Major:5
                                                                                                                                                                                                                                            OS Version Minor:2
                                                                                                                                                                                                                                            File Version Major:5
                                                                                                                                                                                                                                            File Version Minor:2
                                                                                                                                                                                                                                            Subsystem Version Major:5
                                                                                                                                                                                                                                            Subsystem Version Minor:2
                                                                                                                                                                                                                                            Import Hash:1e92fd54d65284238a0e3b74b2715062

                                                                                                                                                                                                                                            Entrypoint Preview

                                                                                                                                                                                                                                            Instruction
                                                                                                                                                                                                                                            dec eax
                                                                                                                                                                                                                                            sub esp, 28h
                                                                                                                                                                                                                                            call 00007F565CEA9BACh
                                                                                                                                                                                                                                            dec eax
                                                                                                                                                                                                                                            add esp, 28h
                                                                                                                                                                                                                                            jmp 00007F565CEA951Fh
                                                                                                                                                                                                                                            int3
                                                                                                                                                                                                                                            int3
                                                                                                                                                                                                                                            inc eax
                                                                                                                                                                                                                                            push ebx
                                                                                                                                                                                                                                            dec eax
                                                                                                                                                                                                                                            sub esp, 20h
                                                                                                                                                                                                                                            dec eax
                                                                                                                                                                                                                                            mov ebx, ecx
                                                                                                                                                                                                                                            xor ecx, ecx
                                                                                                                                                                                                                                            call dword ptr [0001F20Bh]
                                                                                                                                                                                                                                            dec eax
                                                                                                                                                                                                                                            mov ecx, ebx
                                                                                                                                                                                                                                            call dword ptr [0001F1FAh]
                                                                                                                                                                                                                                            call dword ptr [0001F174h]
                                                                                                                                                                                                                                            dec eax
                                                                                                                                                                                                                                            mov ecx, eax
                                                                                                                                                                                                                                            mov edx, C0000409h
                                                                                                                                                                                                                                            dec eax
                                                                                                                                                                                                                                            add esp, 20h
                                                                                                                                                                                                                                            pop ebx
                                                                                                                                                                                                                                            dec eax
                                                                                                                                                                                                                                            jmp dword ptr [0001F1F0h]
                                                                                                                                                                                                                                            int3
                                                                                                                                                                                                                                            int3
                                                                                                                                                                                                                                            int3
                                                                                                                                                                                                                                            int3
                                                                                                                                                                                                                                            int3
                                                                                                                                                                                                                                            int3
                                                                                                                                                                                                                                            int3
                                                                                                                                                                                                                                            int3
                                                                                                                                                                                                                                            dec eax
                                                                                                                                                                                                                                            mov dword ptr [esp+08h], ecx
                                                                                                                                                                                                                                            dec eax
                                                                                                                                                                                                                                            sub esp, 38h
                                                                                                                                                                                                                                            mov ecx, 00000017h
                                                                                                                                                                                                                                            call dword ptr [0001F1DCh]
                                                                                                                                                                                                                                            test eax, eax
                                                                                                                                                                                                                                            je 00007F565CEA96A9h
                                                                                                                                                                                                                                            mov ecx, 00000002h
                                                                                                                                                                                                                                            int 29h
                                                                                                                                                                                                                                            dec eax
                                                                                                                                                                                                                                            lea ecx, dword ptr [0004107Ah]
                                                                                                                                                                                                                                            call 00007F565CEA986Eh
                                                                                                                                                                                                                                            dec eax
                                                                                                                                                                                                                                            mov eax, dword ptr [esp+38h]
                                                                                                                                                                                                                                            dec eax
                                                                                                                                                                                                                                            mov dword ptr [00041161h], eax
                                                                                                                                                                                                                                            dec eax
                                                                                                                                                                                                                                            lea eax, dword ptr [esp+38h]
                                                                                                                                                                                                                                            dec eax
                                                                                                                                                                                                                                            add eax, 08h
                                                                                                                                                                                                                                            dec eax
                                                                                                                                                                                                                                            mov dword ptr [000410F1h], eax
                                                                                                                                                                                                                                            dec eax
                                                                                                                                                                                                                                            mov eax, dword ptr [0004114Ah]
                                                                                                                                                                                                                                            dec eax
                                                                                                                                                                                                                                            mov dword ptr [00040FBBh], eax
                                                                                                                                                                                                                                            dec eax
                                                                                                                                                                                                                                            mov eax, dword ptr [esp+40h]
                                                                                                                                                                                                                                            dec eax
                                                                                                                                                                                                                                            mov dword ptr [000410BFh], eax
                                                                                                                                                                                                                                            mov dword ptr [00040F95h], C0000409h
                                                                                                                                                                                                                                            mov dword ptr [00040F8Fh], 00000001h
                                                                                                                                                                                                                                            mov dword ptr [00000099h], 00000000h

                                                                                                                                                                                                                                            Data Directories

                                                                                                                                                                                                                                            NameVirtual AddressVirtual Size Is in Section
                                                                                                                                                                                                                                            IMAGE_DIRECTORY_ENTRY_EXPORT0x00x0
                                                                                                                                                                                                                                            IMAGE_DIRECTORY_ENTRY_IMPORT0x3ba240x78.rdata
                                                                                                                                                                                                                                            IMAGE_DIRECTORY_ENTRY_RESOURCE0x520000xf498.rsrc
                                                                                                                                                                                                                                            IMAGE_DIRECTORY_ENTRY_EXCEPTION0x4e0000x20a0.pdata
                                                                                                                                                                                                                                            IMAGE_DIRECTORY_ENTRY_SECURITY0x00x0
                                                                                                                                                                                                                                            IMAGE_DIRECTORY_ENTRY_BASERELOC0x620000x754.reloc
                                                                                                                                                                                                                                            IMAGE_DIRECTORY_ENTRY_DEBUG0x393e00x1c.rdata
                                                                                                                                                                                                                                            IMAGE_DIRECTORY_ENTRY_COPYRIGHT0x00x0
                                                                                                                                                                                                                                            IMAGE_DIRECTORY_ENTRY_GLOBALPTR0x00x0
                                                                                                                                                                                                                                            IMAGE_DIRECTORY_ENTRY_TLS0x00x0
                                                                                                                                                                                                                                            IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG0x392a00x140.rdata
                                                                                                                                                                                                                                            IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT0x00x0
                                                                                                                                                                                                                                            IMAGE_DIRECTORY_ENTRY_IAT0x2a0000x418.rdata
                                                                                                                                                                                                                                            IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT0x00x0
                                                                                                                                                                                                                                            IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR0x00x0
                                                                                                                                                                                                                                            IMAGE_DIRECTORY_ENTRY_RESERVED0x00x0

                                                                                                                                                                                                                                            Sections

                                                                                                                                                                                                                                            NameVirtual AddressVirtual SizeRaw SizeMD5Xored PEZLIB ComplexityFile TypeEntropyCharacteristics
                                                                                                                                                                                                                                            .text0x10000x287100x28800e4f89af1ba6511882cb4cd14d9f6eca0False0.5585214120370371data6.48667752666415IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
                                                                                                                                                                                                                                            .rdata0x2a0000x1282e0x12a0029cfdb771ac5a0e8dad7691c1dab8e10False0.5137111996644296data5.813033106784007IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
                                                                                                                                                                                                                                            .data0x3d0000x103e80xe008197d15b5af8fff7ec6022f8809b64c8False0.13058035714285715data1.801142684063006IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
                                                                                                                                                                                                                                            .pdata0x4e0000x20a00x220077e2f2d72516a8aa1832e8298e54381fFalse0.47598805147058826data5.325748796775067IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
                                                                                                                                                                                                                                            _RDATA0x510000x15c0x2000ed86077474ad8a4a0621ecbc29cb84cFalse0.38671875data2.757915683398695IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
                                                                                                                                                                                                                                            .rsrc0x520000xf4980xf600ac8c7cbe6626a5ff9e2bb1338d967035False0.8035759654471545data7.555572206814068IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
                                                                                                                                                                                                                                            .reloc0x620000x7540x8007fed9a3addc55d51107d5af5a380ab8eFalse0.5439453125data5.239333644236171IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

                                                                                                                                                                                                                                            Resources

                                                                                                                                                                                                                                            NameRVASizeTypeLanguageCountryZLIB Complexity
                                                                                                                                                                                                                                            RT_ICON0x522080xea8Device independent bitmap graphic, 48 x 96 x 8, image size 00.585820895522388
                                                                                                                                                                                                                                            RT_ICON0x530b00x8a8Device independent bitmap graphic, 32 x 64 x 8, image size 00.7360108303249098
                                                                                                                                                                                                                                            RT_ICON0x539580x568Device independent bitmap graphic, 16 x 32 x 8, image size 00.755057803468208
                                                                                                                                                                                                                                            RT_ICON0x53ec00x952cPNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced0.9975384937676757
                                                                                                                                                                                                                                            RT_ICON0x5d3ec0x25a8Device independent bitmap graphic, 48 x 96 x 32, image size 00.3887966804979253
                                                                                                                                                                                                                                            RT_ICON0x5f9940x10a8Device independent bitmap graphic, 32 x 64 x 32, image size 00.49530956848030017
                                                                                                                                                                                                                                            RT_ICON0x60a3c0x468Device independent bitmap graphic, 16 x 32 x 32, image size 00.7207446808510638
                                                                                                                                                                                                                                            RT_GROUP_ICON0x60ea40x68data0.7019230769230769
                                                                                                                                                                                                                                            RT_MANIFEST0x60f0c0x589XML 1.0 document, ASCII text, with CRLF line terminators0.4453069865913903

                                                                                                                                                                                                                                            Imports

                                                                                                                                                                                                                                            DLLImport
                                                                                                                                                                                                                                            USER32.dllCreateWindowExW, MessageBoxW, MessageBoxA, SystemParametersInfoW, DestroyIcon, SetWindowLongPtrW, GetWindowLongPtrW, GetClientRect, InvalidateRect, ReleaseDC, GetDC, DrawTextW, GetDialogBaseUnits, EndDialog, DialogBoxIndirectParamW, MoveWindow, SendMessageW
                                                                                                                                                                                                                                            COMCTL32.dll
                                                                                                                                                                                                                                            KERNEL32.dllIsValidCodePage, GetStringTypeW, GetFileAttributesExW, HeapReAlloc, FlushFileBuffers, GetCurrentDirectoryW, GetACP, GetOEMCP, GetModuleHandleW, MulDiv, GetLastError, SetDllDirectoryW, GetModuleFileNameW, GetProcAddress, GetCommandLineW, GetCPInfo, SetEnvironmentVariableW, ExpandEnvironmentStringsW, CreateDirectoryW, GetTempPathW, WaitForSingleObject, Sleep, GetExitCodeProcess, CreateProcessW, GetStartupInfoW, FreeLibrary, LoadLibraryExW, FindClose, FindFirstFileExW, CloseHandle, GetCurrentProcess, LocalFree, FormatMessageW, MultiByteToWideChar, WideCharToMultiByte, GetEnvironmentStringsW, FreeEnvironmentStringsW, GetProcessHeap, GetTimeZoneInformation, HeapSize, WriteConsoleW, SetEndOfFile, GetEnvironmentVariableW, RtlCaptureContext, RtlLookupFunctionEntry, RtlVirtualUnwind, UnhandledExceptionFilter, SetUnhandledExceptionFilter, TerminateProcess, IsProcessorFeaturePresent, QueryPerformanceCounter, GetCurrentProcessId, GetCurrentThreadId, GetSystemTimeAsFileTime, InitializeSListHead, IsDebuggerPresent, RtlUnwindEx, SetLastError, EnterCriticalSection, LeaveCriticalSection, DeleteCriticalSection, InitializeCriticalSectionAndSpinCount, TlsAlloc, TlsGetValue, TlsSetValue, TlsFree, EncodePointer, RaiseException, RtlPcToFileHeader, GetCommandLineA, CreateFileW, GetDriveTypeW, GetFileInformationByHandle, GetFileType, PeekNamedPipe, SystemTimeToTzSpecificLocalTime, FileTimeToSystemTime, GetFullPathNameW, RemoveDirectoryW, FindNextFileW, SetStdHandle, SetConsoleCtrlHandler, DeleteFileW, ReadFile, GetStdHandle, WriteFile, ExitProcess, GetModuleHandleExW, HeapFree, GetConsoleMode, ReadConsoleW, SetFilePointerEx, GetConsoleOutputCP, GetFileSizeEx, HeapAlloc, FlsAlloc, FlsGetValue, FlsSetValue, FlsFree, CompareStringW, LCMapStringW
                                                                                                                                                                                                                                            ADVAPI32.dllOpenProcessToken, GetTokenInformation, ConvertStringSecurityDescriptorToSecurityDescriptorW, ConvertSidToStringSidW
                                                                                                                                                                                                                                            GDI32.dllSelectObject, DeleteObject, CreateFontIndirectW

                                                                                                                                                                                                                                            Network Behavior

                                                                                                                                                                                                                                            Network Port Distribution

                                                                                                                                                                                                                                            TCP Packets

                                                                                                                                                                                                                                            TimestampSource PortDest PortSource IPDest IP
                                                                                                                                                                                                                                            Nov 15, 2024 10:48:08.439357042 CET49731443192.168.2.4104.26.9.44
                                                                                                                                                                                                                                            Nov 15, 2024 10:48:08.439450979 CET44349731104.26.9.44192.168.2.4
                                                                                                                                                                                                                                            Nov 15, 2024 10:48:08.439528942 CET49731443192.168.2.4104.26.9.44
                                                                                                                                                                                                                                            Nov 15, 2024 10:48:08.528796911 CET49731443192.168.2.4104.26.9.44
                                                                                                                                                                                                                                            Nov 15, 2024 10:48:08.528883934 CET44349731104.26.9.44192.168.2.4
                                                                                                                                                                                                                                            Nov 15, 2024 10:48:09.289207935 CET44349731104.26.9.44192.168.2.4
                                                                                                                                                                                                                                            Nov 15, 2024 10:48:09.289699078 CET49731443192.168.2.4104.26.9.44
                                                                                                                                                                                                                                            Nov 15, 2024 10:48:09.289748907 CET44349731104.26.9.44192.168.2.4
                                                                                                                                                                                                                                            Nov 15, 2024 10:48:09.291917086 CET44349731104.26.9.44192.168.2.4
                                                                                                                                                                                                                                            Nov 15, 2024 10:48:09.292032957 CET49731443192.168.2.4104.26.9.44
                                                                                                                                                                                                                                            Nov 15, 2024 10:48:09.292531967 CET49731443192.168.2.4104.26.9.44
                                                                                                                                                                                                                                            Nov 15, 2024 10:48:09.292671919 CET49731443192.168.2.4104.26.9.44
                                                                                                                                                                                                                                            Nov 15, 2024 10:48:09.513334990 CET49732443192.168.2.4162.159.137.232
                                                                                                                                                                                                                                            Nov 15, 2024 10:48:09.513370991 CET44349732162.159.137.232192.168.2.4
                                                                                                                                                                                                                                            Nov 15, 2024 10:48:09.513870955 CET49732443192.168.2.4162.159.137.232
                                                                                                                                                                                                                                            Nov 15, 2024 10:48:09.530512094 CET49732443192.168.2.4162.159.137.232
                                                                                                                                                                                                                                            Nov 15, 2024 10:48:09.530534029 CET44349732162.159.137.232192.168.2.4
                                                                                                                                                                                                                                            Nov 15, 2024 10:48:10.169418097 CET44349732162.159.137.232192.168.2.4
                                                                                                                                                                                                                                            Nov 15, 2024 10:48:10.169893026 CET49732443192.168.2.4162.159.137.232
                                                                                                                                                                                                                                            Nov 15, 2024 10:48:10.169914007 CET44349732162.159.137.232192.168.2.4
                                                                                                                                                                                                                                            Nov 15, 2024 10:48:10.171372890 CET44349732162.159.137.232192.168.2.4
                                                                                                                                                                                                                                            Nov 15, 2024 10:48:10.171447992 CET49732443192.168.2.4162.159.137.232
                                                                                                                                                                                                                                            Nov 15, 2024 10:48:10.172060966 CET49732443192.168.2.4162.159.137.232
                                                                                                                                                                                                                                            Nov 15, 2024 10:48:10.172218084 CET49732443192.168.2.4162.159.137.232
                                                                                                                                                                                                                                            Nov 15, 2024 10:48:12.249712944 CET49733443192.168.2.4185.199.110.133
                                                                                                                                                                                                                                            Nov 15, 2024 10:48:12.249809980 CET44349733185.199.110.133192.168.2.4
                                                                                                                                                                                                                                            Nov 15, 2024 10:48:12.249898911 CET49733443192.168.2.4185.199.110.133
                                                                                                                                                                                                                                            Nov 15, 2024 10:48:12.260857105 CET49733443192.168.2.4185.199.110.133
                                                                                                                                                                                                                                            Nov 15, 2024 10:48:12.260895014 CET44349733185.199.110.133192.168.2.4
                                                                                                                                                                                                                                            Nov 15, 2024 10:48:12.873447895 CET44349733185.199.110.133192.168.2.4
                                                                                                                                                                                                                                            Nov 15, 2024 10:48:12.873783112 CET49733443192.168.2.4185.199.110.133
                                                                                                                                                                                                                                            Nov 15, 2024 10:48:12.873816967 CET44349733185.199.110.133192.168.2.4
                                                                                                                                                                                                                                            Nov 15, 2024 10:48:12.875282049 CET44349733185.199.110.133192.168.2.4
                                                                                                                                                                                                                                            Nov 15, 2024 10:48:12.875343084 CET49733443192.168.2.4185.199.110.133
                                                                                                                                                                                                                                            Nov 15, 2024 10:48:12.875802040 CET49733443192.168.2.4185.199.110.133
                                                                                                                                                                                                                                            Nov 15, 2024 10:48:12.875916004 CET49733443192.168.2.4185.199.110.133
                                                                                                                                                                                                                                            Nov 15, 2024 10:48:17.643629074 CET49735443192.168.2.4104.16.124.96
                                                                                                                                                                                                                                            Nov 15, 2024 10:48:17.643675089 CET44349735104.16.124.96192.168.2.4
                                                                                                                                                                                                                                            Nov 15, 2024 10:48:17.643851995 CET49735443192.168.2.4104.16.124.96
                                                                                                                                                                                                                                            Nov 15, 2024 10:48:17.657783985 CET49735443192.168.2.4104.16.124.96
                                                                                                                                                                                                                                            Nov 15, 2024 10:48:17.657795906 CET44349735104.16.124.96192.168.2.4
                                                                                                                                                                                                                                            Nov 15, 2024 10:48:18.264971018 CET44349735104.16.124.96192.168.2.4
                                                                                                                                                                                                                                            Nov 15, 2024 10:48:18.265836954 CET49735443192.168.2.4104.16.124.96
                                                                                                                                                                                                                                            Nov 15, 2024 10:48:18.265862942 CET44349735104.16.124.96192.168.2.4
                                                                                                                                                                                                                                            Nov 15, 2024 10:48:18.267255068 CET44349735104.16.124.96192.168.2.4
                                                                                                                                                                                                                                            Nov 15, 2024 10:48:18.267371893 CET49735443192.168.2.4104.16.124.96
                                                                                                                                                                                                                                            Nov 15, 2024 10:48:18.268106937 CET49735443192.168.2.4104.16.124.96
                                                                                                                                                                                                                                            Nov 15, 2024 10:48:18.268332005 CET44349735104.16.124.96192.168.2.4
                                                                                                                                                                                                                                            Nov 15, 2024 10:48:18.268593073 CET49735443192.168.2.4104.16.124.96
                                                                                                                                                                                                                                            Nov 15, 2024 10:48:18.268814087 CET49735443192.168.2.4104.16.124.96
                                                                                                                                                                                                                                            Nov 15, 2024 10:48:31.102101088 CET49742443192.168.2.4104.26.9.44
                                                                                                                                                                                                                                            Nov 15, 2024 10:48:31.102155924 CET44349742104.26.9.44192.168.2.4
                                                                                                                                                                                                                                            Nov 15, 2024 10:48:31.102247953 CET49742443192.168.2.4104.26.9.44
                                                                                                                                                                                                                                            Nov 15, 2024 10:48:31.114285946 CET49742443192.168.2.4104.26.9.44
                                                                                                                                                                                                                                            Nov 15, 2024 10:48:31.114300966 CET44349742104.26.9.44192.168.2.4
                                                                                                                                                                                                                                            Nov 15, 2024 10:48:31.844444990 CET44349742104.26.9.44192.168.2.4
                                                                                                                                                                                                                                            Nov 15, 2024 10:48:31.857414007 CET49742443192.168.2.4104.26.9.44
                                                                                                                                                                                                                                            Nov 15, 2024 10:48:31.857487917 CET44349742104.26.9.44192.168.2.4
                                                                                                                                                                                                                                            Nov 15, 2024 10:48:31.858689070 CET44349742104.26.9.44192.168.2.4
                                                                                                                                                                                                                                            Nov 15, 2024 10:48:31.858773947 CET49742443192.168.2.4104.26.9.44
                                                                                                                                                                                                                                            Nov 15, 2024 10:48:31.859812021 CET49742443192.168.2.4104.26.9.44
                                                                                                                                                                                                                                            Nov 15, 2024 10:48:31.860008955 CET49742443192.168.2.4104.26.9.44
                                                                                                                                                                                                                                            Nov 15, 2024 10:48:31.860012054 CET44349742104.26.9.44192.168.2.4
                                                                                                                                                                                                                                            Nov 15, 2024 10:48:31.860094070 CET49742443192.168.2.4104.26.9.44
                                                                                                                                                                                                                                            Nov 15, 2024 10:48:32.590434074 CET49743443192.168.2.4162.159.137.232
                                                                                                                                                                                                                                            Nov 15, 2024 10:48:32.590490103 CET44349743162.159.137.232192.168.2.4
                                                                                                                                                                                                                                            Nov 15, 2024 10:48:32.590624094 CET49743443192.168.2.4162.159.137.232
                                                                                                                                                                                                                                            Nov 15, 2024 10:48:32.609607935 CET49743443192.168.2.4162.159.137.232
                                                                                                                                                                                                                                            Nov 15, 2024 10:48:32.609646082 CET44349743162.159.137.232192.168.2.4
                                                                                                                                                                                                                                            Nov 15, 2024 10:48:33.229218006 CET44349743162.159.137.232192.168.2.4
                                                                                                                                                                                                                                            Nov 15, 2024 10:48:33.229640961 CET49743443192.168.2.4162.159.137.232
                                                                                                                                                                                                                                            Nov 15, 2024 10:48:33.229674101 CET44349743162.159.137.232192.168.2.4
                                                                                                                                                                                                                                            Nov 15, 2024 10:48:33.232901096 CET44349743162.159.137.232192.168.2.4
                                                                                                                                                                                                                                            Nov 15, 2024 10:48:33.232978106 CET49743443192.168.2.4162.159.137.232
                                                                                                                                                                                                                                            Nov 15, 2024 10:48:33.233428955 CET49743443192.168.2.4162.159.137.232
                                                                                                                                                                                                                                            Nov 15, 2024 10:48:33.233589888 CET49743443192.168.2.4162.159.137.232
                                                                                                                                                                                                                                            Nov 15, 2024 10:48:35.899167061 CET49744443192.168.2.4185.199.110.133
                                                                                                                                                                                                                                            Nov 15, 2024 10:48:35.899238110 CET44349744185.199.110.133192.168.2.4
                                                                                                                                                                                                                                            Nov 15, 2024 10:48:35.899321079 CET49744443192.168.2.4185.199.110.133
                                                                                                                                                                                                                                            Nov 15, 2024 10:48:35.909529924 CET49744443192.168.2.4185.199.110.133
                                                                                                                                                                                                                                            Nov 15, 2024 10:48:35.909555912 CET44349744185.199.110.133192.168.2.4
                                                                                                                                                                                                                                            Nov 15, 2024 10:48:36.716387033 CET44349744185.199.110.133192.168.2.4
                                                                                                                                                                                                                                            Nov 15, 2024 10:48:36.716882944 CET49744443192.168.2.4185.199.110.133
                                                                                                                                                                                                                                            Nov 15, 2024 10:48:36.716916084 CET44349744185.199.110.133192.168.2.4
                                                                                                                                                                                                                                            Nov 15, 2024 10:48:36.720546007 CET44349744185.199.110.133192.168.2.4
                                                                                                                                                                                                                                            Nov 15, 2024 10:48:36.720628977 CET49744443192.168.2.4185.199.110.133
                                                                                                                                                                                                                                            Nov 15, 2024 10:48:36.721225977 CET49744443192.168.2.4185.199.110.133
                                                                                                                                                                                                                                            Nov 15, 2024 10:48:36.721431017 CET49744443192.168.2.4185.199.110.133
                                                                                                                                                                                                                                            Nov 15, 2024 10:48:41.430165052 CET49746443192.168.2.4104.26.9.44
                                                                                                                                                                                                                                            Nov 15, 2024 10:48:41.430205107 CET44349746104.26.9.44192.168.2.4
                                                                                                                                                                                                                                            Nov 15, 2024 10:48:41.430326939 CET49746443192.168.2.4104.26.9.44
                                                                                                                                                                                                                                            Nov 15, 2024 10:48:41.448781013 CET49746443192.168.2.4104.26.9.44
                                                                                                                                                                                                                                            Nov 15, 2024 10:48:41.448798895 CET44349746104.26.9.44192.168.2.4
                                                                                                                                                                                                                                            Nov 15, 2024 10:48:42.187714100 CET44349746104.26.9.44192.168.2.4
                                                                                                                                                                                                                                            Nov 15, 2024 10:48:42.188215971 CET49746443192.168.2.4104.26.9.44
                                                                                                                                                                                                                                            Nov 15, 2024 10:48:42.188251019 CET44349746104.26.9.44192.168.2.4
                                                                                                                                                                                                                                            Nov 15, 2024 10:48:42.189769030 CET44349746104.26.9.44192.168.2.4
                                                                                                                                                                                                                                            Nov 15, 2024 10:48:42.189843893 CET49746443192.168.2.4104.26.9.44
                                                                                                                                                                                                                                            Nov 15, 2024 10:48:42.198266029 CET49746443192.168.2.4104.26.9.44
                                                                                                                                                                                                                                            Nov 15, 2024 10:48:42.198482037 CET49746443192.168.2.4104.26.9.44
                                                                                                                                                                                                                                            Nov 15, 2024 10:48:42.264038086 CET49747443192.168.2.4162.159.137.232
                                                                                                                                                                                                                                            Nov 15, 2024 10:48:42.264097929 CET44349747162.159.137.232192.168.2.4
                                                                                                                                                                                                                                            Nov 15, 2024 10:48:42.264162064 CET49747443192.168.2.4162.159.137.232
                                                                                                                                                                                                                                            Nov 15, 2024 10:48:42.276490927 CET49747443192.168.2.4162.159.137.232
                                                                                                                                                                                                                                            Nov 15, 2024 10:48:42.276521921 CET44349747162.159.137.232192.168.2.4
                                                                                                                                                                                                                                            Nov 15, 2024 10:48:42.922631025 CET44349747162.159.137.232192.168.2.4
                                                                                                                                                                                                                                            Nov 15, 2024 10:48:42.923352957 CET49747443192.168.2.4162.159.137.232
                                                                                                                                                                                                                                            Nov 15, 2024 10:48:42.923417091 CET44349747162.159.137.232192.168.2.4
                                                                                                                                                                                                                                            Nov 15, 2024 10:48:42.924932003 CET44349747162.159.137.232192.168.2.4
                                                                                                                                                                                                                                            Nov 15, 2024 10:48:42.925005913 CET49747443192.168.2.4162.159.137.232
                                                                                                                                                                                                                                            Nov 15, 2024 10:48:42.925434113 CET49747443192.168.2.4162.159.137.232
                                                                                                                                                                                                                                            Nov 15, 2024 10:48:42.925582886 CET49747443192.168.2.4162.159.137.232
                                                                                                                                                                                                                                            Nov 15, 2024 10:48:43.285465956 CET49748443192.168.2.4104.16.124.96
                                                                                                                                                                                                                                            Nov 15, 2024 10:48:43.285507917 CET44349748104.16.124.96192.168.2.4
                                                                                                                                                                                                                                            Nov 15, 2024 10:48:43.287091017 CET49748443192.168.2.4104.16.124.96
                                                                                                                                                                                                                                            Nov 15, 2024 10:48:43.297801018 CET49748443192.168.2.4104.16.124.96
                                                                                                                                                                                                                                            Nov 15, 2024 10:48:43.297827005 CET44349748104.16.124.96192.168.2.4
                                                                                                                                                                                                                                            Nov 15, 2024 10:48:43.917821884 CET44349748104.16.124.96192.168.2.4
                                                                                                                                                                                                                                            Nov 15, 2024 10:48:43.918669939 CET49748443192.168.2.4104.16.124.96
                                                                                                                                                                                                                                            Nov 15, 2024 10:48:43.918689013 CET44349748104.16.124.96192.168.2.4
                                                                                                                                                                                                                                            Nov 15, 2024 10:48:43.922262907 CET44349748104.16.124.96192.168.2.4
                                                                                                                                                                                                                                            Nov 15, 2024 10:48:43.922338963 CET49748443192.168.2.4104.16.124.96
                                                                                                                                                                                                                                            Nov 15, 2024 10:48:43.923051119 CET49748443192.168.2.4104.16.124.96
                                                                                                                                                                                                                                            Nov 15, 2024 10:48:43.923051119 CET49748443192.168.2.4104.16.124.96
                                                                                                                                                                                                                                            Nov 15, 2024 10:48:46.289957047 CET49749443192.168.2.4185.199.110.133
                                                                                                                                                                                                                                            Nov 15, 2024 10:48:46.290067911 CET44349749185.199.110.133192.168.2.4
                                                                                                                                                                                                                                            Nov 15, 2024 10:48:46.290226936 CET49749443192.168.2.4185.199.110.133
                                                                                                                                                                                                                                            Nov 15, 2024 10:48:46.305861950 CET49749443192.168.2.4185.199.110.133
                                                                                                                                                                                                                                            Nov 15, 2024 10:48:46.305951118 CET44349749185.199.110.133192.168.2.4
                                                                                                                                                                                                                                            Nov 15, 2024 10:48:46.925005913 CET44349749185.199.110.133192.168.2.4
                                                                                                                                                                                                                                            Nov 15, 2024 10:48:46.925582886 CET49749443192.168.2.4185.199.110.133
                                                                                                                                                                                                                                            Nov 15, 2024 10:48:46.925643921 CET44349749185.199.110.133192.168.2.4
                                                                                                                                                                                                                                            Nov 15, 2024 10:48:46.926687002 CET44349749185.199.110.133192.168.2.4
                                                                                                                                                                                                                                            Nov 15, 2024 10:48:46.926789045 CET49749443192.168.2.4185.199.110.133
                                                                                                                                                                                                                                            Nov 15, 2024 10:48:46.927411079 CET49749443192.168.2.4185.199.110.133
                                                                                                                                                                                                                                            Nov 15, 2024 10:48:46.927536964 CET49749443192.168.2.4185.199.110.133
                                                                                                                                                                                                                                            Nov 15, 2024 10:48:52.800990105 CET57195443192.168.2.4104.16.124.96
                                                                                                                                                                                                                                            Nov 15, 2024 10:48:52.801042080 CET44357195104.16.124.96192.168.2.4
                                                                                                                                                                                                                                            Nov 15, 2024 10:48:52.801132917 CET57195443192.168.2.4104.16.124.96
                                                                                                                                                                                                                                            Nov 15, 2024 10:48:52.811853886 CET57195443192.168.2.4104.16.124.96
                                                                                                                                                                                                                                            Nov 15, 2024 10:48:52.811871052 CET44357195104.16.124.96192.168.2.4
                                                                                                                                                                                                                                            Nov 15, 2024 10:48:53.425821066 CET44357195104.16.124.96192.168.2.4
                                                                                                                                                                                                                                            Nov 15, 2024 10:48:53.426716089 CET57195443192.168.2.4104.16.124.96
                                                                                                                                                                                                                                            Nov 15, 2024 10:48:53.426743031 CET44357195104.16.124.96192.168.2.4
                                                                                                                                                                                                                                            Nov 15, 2024 10:48:53.427753925 CET44357195104.16.124.96192.168.2.4
                                                                                                                                                                                                                                            Nov 15, 2024 10:48:53.427815914 CET57195443192.168.2.4104.16.124.96
                                                                                                                                                                                                                                            Nov 15, 2024 10:48:53.428376913 CET57195443192.168.2.4104.16.124.96
                                                                                                                                                                                                                                            Nov 15, 2024 10:48:53.428512096 CET44357195104.16.124.96192.168.2.4
                                                                                                                                                                                                                                            Nov 15, 2024 10:48:53.428528070 CET57195443192.168.2.4104.16.124.96
                                                                                                                                                                                                                                            Nov 15, 2024 10:48:53.428561926 CET57195443192.168.2.4104.16.124.96

                                                                                                                                                                                                                                            UDP Packets

                                                                                                                                                                                                                                            TimestampSource PortDest PortSource IPDest IP
                                                                                                                                                                                                                                            Nov 15, 2024 10:48:08.407689095 CET5194053192.168.2.41.1.1.1
                                                                                                                                                                                                                                            Nov 15, 2024 10:48:08.416260004 CET53519401.1.1.1192.168.2.4
                                                                                                                                                                                                                                            Nov 15, 2024 10:48:09.505464077 CET5080053192.168.2.41.1.1.1
                                                                                                                                                                                                                                            Nov 15, 2024 10:48:09.512577057 CET53508001.1.1.1192.168.2.4
                                                                                                                                                                                                                                            Nov 15, 2024 10:48:12.241525888 CET4929353192.168.2.41.1.1.1
                                                                                                                                                                                                                                            Nov 15, 2024 10:48:12.248785019 CET53492931.1.1.1192.168.2.4
                                                                                                                                                                                                                                            Nov 15, 2024 10:48:17.635457993 CET5509453192.168.2.41.1.1.1
                                                                                                                                                                                                                                            Nov 15, 2024 10:48:17.642698050 CET53550941.1.1.1192.168.2.4
                                                                                                                                                                                                                                            Nov 15, 2024 10:48:46.482528925 CET5352571162.159.36.2192.168.2.4
                                                                                                                                                                                                                                            Nov 15, 2024 10:48:47.204001904 CET53585051.1.1.1192.168.2.4

                                                                                                                                                                                                                                            DNS Queries

                                                                                                                                                                                                                                            TimestampSource IPDest IPTrans IDOP CodeNameTypeClassDNS over HTTPS
                                                                                                                                                                                                                                            Nov 15, 2024 10:48:08.407689095 CET192.168.2.41.1.1.10xe4c7Standard query (0)ipapi.coA (IP address)IN (0x0001)false
                                                                                                                                                                                                                                            Nov 15, 2024 10:48:09.505464077 CET192.168.2.41.1.1.10x7f1Standard query (0)discord.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                                            Nov 15, 2024 10:48:12.241525888 CET192.168.2.41.1.1.10x7454Standard query (0)raw.githubusercontent.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                                            Nov 15, 2024 10:48:17.635457993 CET192.168.2.41.1.1.10x9efeStandard query (0)www.cloudflare.comA (IP address)IN (0x0001)false

                                                                                                                                                                                                                                            DNS Answers

                                                                                                                                                                                                                                            TimestampSource IPDest IPTrans IDReply CodeNameCNameAddressTypeClassDNS over HTTPS
                                                                                                                                                                                                                                            Nov 15, 2024 10:48:08.416260004 CET1.1.1.1192.168.2.40xe4c7No error (0)ipapi.co104.26.9.44A (IP address)IN (0x0001)false
                                                                                                                                                                                                                                            Nov 15, 2024 10:48:08.416260004 CET1.1.1.1192.168.2.40xe4c7No error (0)ipapi.co104.26.8.44A (IP address)IN (0x0001)false
                                                                                                                                                                                                                                            Nov 15, 2024 10:48:08.416260004 CET1.1.1.1192.168.2.40xe4c7No error (0)ipapi.co172.67.69.226A (IP address)IN (0x0001)false
                                                                                                                                                                                                                                            Nov 15, 2024 10:48:09.512577057 CET1.1.1.1192.168.2.40x7f1No error (0)discord.com162.159.137.232A (IP address)IN (0x0001)false
                                                                                                                                                                                                                                            Nov 15, 2024 10:48:09.512577057 CET1.1.1.1192.168.2.40x7f1No error (0)discord.com162.159.128.233A (IP address)IN (0x0001)false
                                                                                                                                                                                                                                            Nov 15, 2024 10:48:09.512577057 CET1.1.1.1192.168.2.40x7f1No error (0)discord.com162.159.136.232A (IP address)IN (0x0001)false
                                                                                                                                                                                                                                            Nov 15, 2024 10:48:09.512577057 CET1.1.1.1192.168.2.40x7f1No error (0)discord.com162.159.135.232A (IP address)IN (0x0001)false
                                                                                                                                                                                                                                            Nov 15, 2024 10:48:09.512577057 CET1.1.1.1192.168.2.40x7f1No error (0)discord.com162.159.138.232A (IP address)IN (0x0001)false
                                                                                                                                                                                                                                            Nov 15, 2024 10:48:12.248785019 CET1.1.1.1192.168.2.40x7454No error (0)raw.githubusercontent.com185.199.110.133A (IP address)IN (0x0001)false
                                                                                                                                                                                                                                            Nov 15, 2024 10:48:12.248785019 CET1.1.1.1192.168.2.40x7454No error (0)raw.githubusercontent.com185.199.111.133A (IP address)IN (0x0001)false
                                                                                                                                                                                                                                            Nov 15, 2024 10:48:12.248785019 CET1.1.1.1192.168.2.40x7454No error (0)raw.githubusercontent.com185.199.108.133A (IP address)IN (0x0001)false
                                                                                                                                                                                                                                            Nov 15, 2024 10:48:12.248785019 CET1.1.1.1192.168.2.40x7454No error (0)raw.githubusercontent.com185.199.109.133A (IP address)IN (0x0001)false
                                                                                                                                                                                                                                            Nov 15, 2024 10:48:17.642698050 CET1.1.1.1192.168.2.40x9efeNo error (0)www.cloudflare.com104.16.124.96A (IP address)IN (0x0001)false
                                                                                                                                                                                                                                            Nov 15, 2024 10:48:17.642698050 CET1.1.1.1192.168.2.40x9efeNo error (0)www.cloudflare.com104.16.123.96A (IP address)IN (0x0001)false
                                                                                                                                                                                                                                            Nov 15, 2024 10:48:19.087367058 CET1.1.1.1192.168.2.40xa0f8No error (0)bg.microsoft.map.fastly.net199.232.214.172A (IP address)IN (0x0001)false
                                                                                                                                                                                                                                            Nov 15, 2024 10:48:19.087367058 CET1.1.1.1192.168.2.40xa0f8No error (0)bg.microsoft.map.fastly.net199.232.210.172A (IP address)IN (0x0001)false

                                                                                                                                                                                                                                            Statistics

                                                                                                                                                                                                                                            CPU Usage

                                                                                                                                                                                                                                            Click to jump to process

                                                                                                                                                                                                                                            Memory Usage

                                                                                                                                                                                                                                            Click to jump to process

                                                                                                                                                                                                                                            High Level Behavior Distribution

                                                                                                                                                                                                                                            Click to dive into process behavior distribution

                                                                                                                                                                                                                                            Behavior

                                                                                                                                                                                                                                            Click to jump to process

                                                                                                                                                                                                                                            System Behavior

                                                                                                                                                                                                                                            General

                                                                                                                                                                                                                                            Target ID:0
                                                                                                                                                                                                                                            Start time:04:48:02
                                                                                                                                                                                                                                            Start date:15/11/2024
                                                                                                                                                                                                                                            Path:C:\Users\user\Desktop\NEVER OPEN!.exe
                                                                                                                                                                                                                                            Wow64 process (32bit):false
                                                                                                                                                                                                                                            Commandline:"C:\Users\user\Desktop\NEVER OPEN!.exe"
                                                                                                                                                                                                                                            Imagebase:0x7ff619bc0000
                                                                                                                                                                                                                                            File size:18'752'296 bytes
                                                                                                                                                                                                                                            MD5 hash:61B5A3066BCF661F69B9E362EF1A1F8C
                                                                                                                                                                                                                                            Has elevated privileges:true
                                                                                                                                                                                                                                            Has administrator privileges:true
                                                                                                                                                                                                                                            Programmed in:C, C++ or other language
                                                                                                                                                                                                                                            Reputation:low
                                                                                                                                                                                                                                            Has exited:true

                                                                                                                                                                                                                                            General

                                                                                                                                                                                                                                            Target ID:1
                                                                                                                                                                                                                                            Start time:04:48:05
                                                                                                                                                                                                                                            Start date:15/11/2024
                                                                                                                                                                                                                                            Path:C:\Users\user\Desktop\NEVER OPEN!.exe
                                                                                                                                                                                                                                            Wow64 process (32bit):false
                                                                                                                                                                                                                                            Commandline:"C:\Users\user\Desktop\NEVER OPEN!.exe"
                                                                                                                                                                                                                                            Imagebase:0x7ff619bc0000
                                                                                                                                                                                                                                            File size:18'752'296 bytes
                                                                                                                                                                                                                                            MD5 hash:61B5A3066BCF661F69B9E362EF1A1F8C
                                                                                                                                                                                                                                            Has elevated privileges:true
                                                                                                                                                                                                                                            Has administrator privileges:true
                                                                                                                                                                                                                                            Programmed in:C, C++ or other language
                                                                                                                                                                                                                                            Reputation:low
                                                                                                                                                                                                                                            Has exited:true

                                                                                                                                                                                                                                            General

                                                                                                                                                                                                                                            Target ID:2
                                                                                                                                                                                                                                            Start time:04:48:06
                                                                                                                                                                                                                                            Start date:15/11/2024
                                                                                                                                                                                                                                            Path:C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                                            Wow64 process (32bit):false
                                                                                                                                                                                                                                            Commandline:C:\Windows\system32\cmd.exe /c "ver"
                                                                                                                                                                                                                                            Imagebase:0x7ff676be0000
                                                                                                                                                                                                                                            File size:289'792 bytes
                                                                                                                                                                                                                                            MD5 hash:8A2122E8162DBEF04694B9C3E0B6CDEE
                                                                                                                                                                                                                                            Has elevated privileges:true
                                                                                                                                                                                                                                            Has administrator privileges:true
                                                                                                                                                                                                                                            Programmed in:C, C++ or other language
                                                                                                                                                                                                                                            Reputation:high
                                                                                                                                                                                                                                            Has exited:true

                                                                                                                                                                                                                                            General

                                                                                                                                                                                                                                            Target ID:3
                                                                                                                                                                                                                                            Start time:04:48:06
                                                                                                                                                                                                                                            Start date:15/11/2024
                                                                                                                                                                                                                                            Path:C:\Windows\System32\conhost.exe
                                                                                                                                                                                                                                            Wow64 process (32bit):false
                                                                                                                                                                                                                                            Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                            Imagebase:0x7ff7699e0000
                                                                                                                                                                                                                                            File size:862'208 bytes
                                                                                                                                                                                                                                            MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                                                                                                                                                                                                            Has elevated privileges:true
                                                                                                                                                                                                                                            Has administrator privileges:true
                                                                                                                                                                                                                                            Programmed in:C, C++ or other language
                                                                                                                                                                                                                                            Reputation:high
                                                                                                                                                                                                                                            Has exited:true

                                                                                                                                                                                                                                            General

                                                                                                                                                                                                                                            Target ID:5
                                                                                                                                                                                                                                            Start time:04:48:12
                                                                                                                                                                                                                                            Start date:15/11/2024
                                                                                                                                                                                                                                            Path:C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                                            Wow64 process (32bit):false
                                                                                                                                                                                                                                            Commandline:C:\Windows\system32\cmd.exe /c "reg delete HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v empyrean /f"
                                                                                                                                                                                                                                            Imagebase:0x7ff676be0000
                                                                                                                                                                                                                                            File size:289'792 bytes
                                                                                                                                                                                                                                            MD5 hash:8A2122E8162DBEF04694B9C3E0B6CDEE
                                                                                                                                                                                                                                            Has elevated privileges:true
                                                                                                                                                                                                                                            Has administrator privileges:true
                                                                                                                                                                                                                                            Programmed in:C, C++ or other language
                                                                                                                                                                                                                                            Reputation:high
                                                                                                                                                                                                                                            Has exited:true

                                                                                                                                                                                                                                            General

                                                                                                                                                                                                                                            Target ID:6
                                                                                                                                                                                                                                            Start time:04:48:12
                                                                                                                                                                                                                                            Start date:15/11/2024
                                                                                                                                                                                                                                            Path:C:\Windows\System32\conhost.exe
                                                                                                                                                                                                                                            Wow64 process (32bit):false
                                                                                                                                                                                                                                            Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                            Imagebase:0x7ff7699e0000
                                                                                                                                                                                                                                            File size:862'208 bytes
                                                                                                                                                                                                                                            MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                                                                                                                                                                                                            Has elevated privileges:true
                                                                                                                                                                                                                                            Has administrator privileges:true
                                                                                                                                                                                                                                            Programmed in:C, C++ or other language
                                                                                                                                                                                                                                            Reputation:high
                                                                                                                                                                                                                                            Has exited:true

                                                                                                                                                                                                                                            General

                                                                                                                                                                                                                                            Target ID:7
                                                                                                                                                                                                                                            Start time:04:48:12
                                                                                                                                                                                                                                            Start date:15/11/2024
                                                                                                                                                                                                                                            Path:C:\Windows\System32\reg.exe
                                                                                                                                                                                                                                            Wow64 process (32bit):false
                                                                                                                                                                                                                                            Commandline:reg delete HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v empyrean /f
                                                                                                                                                                                                                                            Imagebase:0x7ff762b20000
                                                                                                                                                                                                                                            File size:77'312 bytes
                                                                                                                                                                                                                                            MD5 hash:227F63E1D9008B36BDBCC4B397780BE4
                                                                                                                                                                                                                                            Has elevated privileges:true
                                                                                                                                                                                                                                            Has administrator privileges:true
                                                                                                                                                                                                                                            Programmed in:C, C++ or other language
                                                                                                                                                                                                                                            Reputation:moderate
                                                                                                                                                                                                                                            Has exited:true

                                                                                                                                                                                                                                            General

                                                                                                                                                                                                                                            Target ID:8
                                                                                                                                                                                                                                            Start time:04:48:13
                                                                                                                                                                                                                                            Start date:15/11/2024
                                                                                                                                                                                                                                            Path:C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                                            Wow64 process (32bit):false
                                                                                                                                                                                                                                            Commandline:C:\Windows\system32\cmd.exe /c "reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v empyrean /t REG_SZ /d C:\Users\user\AppData\Roaming\empyrean\run.bat /f"
                                                                                                                                                                                                                                            Imagebase:0x7ff676be0000
                                                                                                                                                                                                                                            File size:289'792 bytes
                                                                                                                                                                                                                                            MD5 hash:8A2122E8162DBEF04694B9C3E0B6CDEE
                                                                                                                                                                                                                                            Has elevated privileges:true
                                                                                                                                                                                                                                            Has administrator privileges:true
                                                                                                                                                                                                                                            Programmed in:C, C++ or other language
                                                                                                                                                                                                                                            Reputation:high
                                                                                                                                                                                                                                            Has exited:true

                                                                                                                                                                                                                                            General

                                                                                                                                                                                                                                            Target ID:9
                                                                                                                                                                                                                                            Start time:04:48:13
                                                                                                                                                                                                                                            Start date:15/11/2024
                                                                                                                                                                                                                                            Path:C:\Windows\System32\conhost.exe
                                                                                                                                                                                                                                            Wow64 process (32bit):false
                                                                                                                                                                                                                                            Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                            Imagebase:0x7ff7699e0000
                                                                                                                                                                                                                                            File size:862'208 bytes
                                                                                                                                                                                                                                            MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                                                                                                                                                                                                            Has elevated privileges:true
                                                                                                                                                                                                                                            Has administrator privileges:true
                                                                                                                                                                                                                                            Programmed in:C, C++ or other language
                                                                                                                                                                                                                                            Reputation:high
                                                                                                                                                                                                                                            Has exited:true

                                                                                                                                                                                                                                            General

                                                                                                                                                                                                                                            Target ID:10
                                                                                                                                                                                                                                            Start time:04:48:13
                                                                                                                                                                                                                                            Start date:15/11/2024
                                                                                                                                                                                                                                            Path:C:\Windows\System32\reg.exe
                                                                                                                                                                                                                                            Wow64 process (32bit):false
                                                                                                                                                                                                                                            Commandline:reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v empyrean /t REG_SZ /d C:\Users\user\AppData\Roaming\empyrean\run.bat /f
                                                                                                                                                                                                                                            Imagebase:0x7ff762b20000
                                                                                                                                                                                                                                            File size:77'312 bytes
                                                                                                                                                                                                                                            MD5 hash:227F63E1D9008B36BDBCC4B397780BE4
                                                                                                                                                                                                                                            Has elevated privileges:true
                                                                                                                                                                                                                                            Has administrator privileges:true
                                                                                                                                                                                                                                            Programmed in:C, C++ or other language
                                                                                                                                                                                                                                            Reputation:moderate
                                                                                                                                                                                                                                            Has exited:true

                                                                                                                                                                                                                                            General

                                                                                                                                                                                                                                            Target ID:11
                                                                                                                                                                                                                                            Start time:04:48:13
                                                                                                                                                                                                                                            Start date:15/11/2024
                                                                                                                                                                                                                                            Path:C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                                            Wow64 process (32bit):false
                                                                                                                                                                                                                                            Commandline:C:\Windows\system32\cmd.exe /c "C:\Windows\System32\wbem\WMIC.exe csproduct get uuid"
                                                                                                                                                                                                                                            Imagebase:0x7ff676be0000
                                                                                                                                                                                                                                            File size:289'792 bytes
                                                                                                                                                                                                                                            MD5 hash:8A2122E8162DBEF04694B9C3E0B6CDEE
                                                                                                                                                                                                                                            Has elevated privileges:true
                                                                                                                                                                                                                                            Has administrator privileges:true
                                                                                                                                                                                                                                            Programmed in:C, C++ or other language
                                                                                                                                                                                                                                            Reputation:high
                                                                                                                                                                                                                                            Has exited:true

                                                                                                                                                                                                                                            General

                                                                                                                                                                                                                                            Target ID:12
                                                                                                                                                                                                                                            Start time:04:48:13
                                                                                                                                                                                                                                            Start date:15/11/2024
                                                                                                                                                                                                                                            Path:C:\Windows\System32\conhost.exe
                                                                                                                                                                                                                                            Wow64 process (32bit):false
                                                                                                                                                                                                                                            Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                            Imagebase:0x7ff7699e0000
                                                                                                                                                                                                                                            File size:862'208 bytes
                                                                                                                                                                                                                                            MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                                                                                                                                                                                                            Has elevated privileges:true
                                                                                                                                                                                                                                            Has administrator privileges:true
                                                                                                                                                                                                                                            Programmed in:C, C++ or other language
                                                                                                                                                                                                                                            Has exited:true

                                                                                                                                                                                                                                            General

                                                                                                                                                                                                                                            Target ID:13
                                                                                                                                                                                                                                            Start time:04:48:13
                                                                                                                                                                                                                                            Start date:15/11/2024
                                                                                                                                                                                                                                            Path:C:\Windows\System32\wbem\WMIC.exe
                                                                                                                                                                                                                                            Wow64 process (32bit):false
                                                                                                                                                                                                                                            Commandline:C:\Windows\System32\wbem\WMIC.exe csproduct get uuid
                                                                                                                                                                                                                                            Imagebase:0x7ff69e6c0000
                                                                                                                                                                                                                                            File size:576'000 bytes
                                                                                                                                                                                                                                            MD5 hash:C37F2F4F4B3CD128BDABCAEB2266A785
                                                                                                                                                                                                                                            Has elevated privileges:true
                                                                                                                                                                                                                                            Has administrator privileges:true
                                                                                                                                                                                                                                            Programmed in:C, C++ or other language
                                                                                                                                                                                                                                            Has exited:true

                                                                                                                                                                                                                                            General

                                                                                                                                                                                                                                            Target ID:14
                                                                                                                                                                                                                                            Start time:04:48:14
                                                                                                                                                                                                                                            Start date:15/11/2024
                                                                                                                                                                                                                                            Path:C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                                            Wow64 process (32bit):false
                                                                                                                                                                                                                                            Commandline:C:\Windows\system32\cmd.exe /c "C:\Windows\System32\wbem\WMIC.exe csproduct get uuid"
                                                                                                                                                                                                                                            Imagebase:0x7ff676be0000
                                                                                                                                                                                                                                            File size:289'792 bytes
                                                                                                                                                                                                                                            MD5 hash:8A2122E8162DBEF04694B9C3E0B6CDEE
                                                                                                                                                                                                                                            Has elevated privileges:true
                                                                                                                                                                                                                                            Has administrator privileges:true
                                                                                                                                                                                                                                            Programmed in:C, C++ or other language
                                                                                                                                                                                                                                            Has exited:true

                                                                                                                                                                                                                                            General

                                                                                                                                                                                                                                            Target ID:15
                                                                                                                                                                                                                                            Start time:04:48:14
                                                                                                                                                                                                                                            Start date:15/11/2024
                                                                                                                                                                                                                                            Path:C:\Windows\System32\conhost.exe
                                                                                                                                                                                                                                            Wow64 process (32bit):false
                                                                                                                                                                                                                                            Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                            Imagebase:0x7ff7699e0000
                                                                                                                                                                                                                                            File size:862'208 bytes
                                                                                                                                                                                                                                            MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                                                                                                                                                                                                            Has elevated privileges:true
                                                                                                                                                                                                                                            Has administrator privileges:true
                                                                                                                                                                                                                                            Programmed in:C, C++ or other language
                                                                                                                                                                                                                                            Has exited:true

                                                                                                                                                                                                                                            General

                                                                                                                                                                                                                                            Target ID:16
                                                                                                                                                                                                                                            Start time:04:48:14
                                                                                                                                                                                                                                            Start date:15/11/2024
                                                                                                                                                                                                                                            Path:C:\Windows\System32\wbem\WMIC.exe
                                                                                                                                                                                                                                            Wow64 process (32bit):false
                                                                                                                                                                                                                                            Commandline:C:\Windows\System32\wbem\WMIC.exe csproduct get uuid
                                                                                                                                                                                                                                            Imagebase:0x7ff69e6c0000
                                                                                                                                                                                                                                            File size:576'000 bytes
                                                                                                                                                                                                                                            MD5 hash:C37F2F4F4B3CD128BDABCAEB2266A785
                                                                                                                                                                                                                                            Has elevated privileges:true
                                                                                                                                                                                                                                            Has administrator privileges:true
                                                                                                                                                                                                                                            Programmed in:C, C++ or other language
                                                                                                                                                                                                                                            Has exited:true

                                                                                                                                                                                                                                            General

                                                                                                                                                                                                                                            Target ID:17
                                                                                                                                                                                                                                            Start time:04:48:15
                                                                                                                                                                                                                                            Start date:15/11/2024
                                                                                                                                                                                                                                            Path:C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                                            Wow64 process (32bit):false
                                                                                                                                                                                                                                            Commandline:C:\Windows\system32\cmd.exe /c "C:\Windows\System32\wbem\WMIC.exe csproduct get uuid"
                                                                                                                                                                                                                                            Imagebase:0x7ff676be0000
                                                                                                                                                                                                                                            File size:289'792 bytes
                                                                                                                                                                                                                                            MD5 hash:8A2122E8162DBEF04694B9C3E0B6CDEE
                                                                                                                                                                                                                                            Has elevated privileges:true
                                                                                                                                                                                                                                            Has administrator privileges:true
                                                                                                                                                                                                                                            Programmed in:C, C++ or other language
                                                                                                                                                                                                                                            Has exited:true

                                                                                                                                                                                                                                            General

                                                                                                                                                                                                                                            Target ID:18
                                                                                                                                                                                                                                            Start time:04:48:15
                                                                                                                                                                                                                                            Start date:15/11/2024
                                                                                                                                                                                                                                            Path:C:\Windows\System32\conhost.exe
                                                                                                                                                                                                                                            Wow64 process (32bit):false
                                                                                                                                                                                                                                            Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                            Imagebase:0x7ff7699e0000
                                                                                                                                                                                                                                            File size:862'208 bytes
                                                                                                                                                                                                                                            MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                                                                                                                                                                                                            Has elevated privileges:true
                                                                                                                                                                                                                                            Has administrator privileges:true
                                                                                                                                                                                                                                            Programmed in:C, C++ or other language
                                                                                                                                                                                                                                            Has exited:true

                                                                                                                                                                                                                                            General

                                                                                                                                                                                                                                            Target ID:19
                                                                                                                                                                                                                                            Start time:04:48:15
                                                                                                                                                                                                                                            Start date:15/11/2024
                                                                                                                                                                                                                                            Path:C:\Windows\System32\wbem\WMIC.exe
                                                                                                                                                                                                                                            Wow64 process (32bit):false
                                                                                                                                                                                                                                            Commandline:C:\Windows\System32\wbem\WMIC.exe csproduct get uuid
                                                                                                                                                                                                                                            Imagebase:0x7ff69e6c0000
                                                                                                                                                                                                                                            File size:576'000 bytes
                                                                                                                                                                                                                                            MD5 hash:C37F2F4F4B3CD128BDABCAEB2266A785
                                                                                                                                                                                                                                            Has elevated privileges:true
                                                                                                                                                                                                                                            Has administrator privileges:true
                                                                                                                                                                                                                                            Programmed in:C, C++ or other language
                                                                                                                                                                                                                                            Has exited:true

                                                                                                                                                                                                                                            General

                                                                                                                                                                                                                                            Target ID:23
                                                                                                                                                                                                                                            Start time:04:48:23
                                                                                                                                                                                                                                            Start date:15/11/2024
                                                                                                                                                                                                                                            Path:C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                                            Wow64 process (32bit):false
                                                                                                                                                                                                                                            Commandline:C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\Roaming\empyrean\run.bat" "
                                                                                                                                                                                                                                            Imagebase:0x7ff676be0000
                                                                                                                                                                                                                                            File size:289'792 bytes
                                                                                                                                                                                                                                            MD5 hash:8A2122E8162DBEF04694B9C3E0B6CDEE
                                                                                                                                                                                                                                            Has elevated privileges:false
                                                                                                                                                                                                                                            Has administrator privileges:false
                                                                                                                                                                                                                                            Programmed in:C, C++ or other language
                                                                                                                                                                                                                                            Has exited:true

                                                                                                                                                                                                                                            General

                                                                                                                                                                                                                                            Target ID:24
                                                                                                                                                                                                                                            Start time:04:48:23
                                                                                                                                                                                                                                            Start date:15/11/2024
                                                                                                                                                                                                                                            Path:C:\Windows\System32\conhost.exe
                                                                                                                                                                                                                                            Wow64 process (32bit):false
                                                                                                                                                                                                                                            Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                            Imagebase:0x7ff7699e0000
                                                                                                                                                                                                                                            File size:862'208 bytes
                                                                                                                                                                                                                                            MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                                                                                                                                                                                                            Has elevated privileges:false
                                                                                                                                                                                                                                            Has administrator privileges:false
                                                                                                                                                                                                                                            Programmed in:C, C++ or other language
                                                                                                                                                                                                                                            Has exited:true

                                                                                                                                                                                                                                            General

                                                                                                                                                                                                                                            Target ID:25
                                                                                                                                                                                                                                            Start time:04:48:23
                                                                                                                                                                                                                                            Start date:15/11/2024
                                                                                                                                                                                                                                            Path:C:\Users\user\AppData\Roaming\empyrean\dat.txt
                                                                                                                                                                                                                                            Wow64 process (32bit):false
                                                                                                                                                                                                                                            Commandline:C:\Users\user\AppData\Roaming\empyrean\dat.txt
                                                                                                                                                                                                                                            Imagebase:0x7ff670a70000
                                                                                                                                                                                                                                            File size:18'752'296 bytes
                                                                                                                                                                                                                                            MD5 hash:61B5A3066BCF661F69B9E362EF1A1F8C
                                                                                                                                                                                                                                            Has elevated privileges:false
                                                                                                                                                                                                                                            Has administrator privileges:false
                                                                                                                                                                                                                                            Programmed in:C, C++ or other language
                                                                                                                                                                                                                                            Yara matches:
                                                                                                                                                                                                                                            • Rule: JoeSecurity_DiscordTokenStealer_1, Description: Yara detected Discord Token Stealer, Source: C:\Users\user\AppData\Roaming\empyrean\dat.txt, Author: Joe Security
                                                                                                                                                                                                                                            Has exited:true

                                                                                                                                                                                                                                            General

                                                                                                                                                                                                                                            Target ID:26
                                                                                                                                                                                                                                            Start time:04:48:26
                                                                                                                                                                                                                                            Start date:15/11/2024
                                                                                                                                                                                                                                            Path:C:\Users\user\AppData\Roaming\empyrean\dat.txt
                                                                                                                                                                                                                                            Wow64 process (32bit):false
                                                                                                                                                                                                                                            Commandline:C:\Users\user\AppData\Roaming\empyrean\dat.txt
                                                                                                                                                                                                                                            Imagebase:0x7ff670a70000
                                                                                                                                                                                                                                            File size:18'752'296 bytes
                                                                                                                                                                                                                                            MD5 hash:61B5A3066BCF661F69B9E362EF1A1F8C
                                                                                                                                                                                                                                            Has elevated privileges:false
                                                                                                                                                                                                                                            Has administrator privileges:false
                                                                                                                                                                                                                                            Programmed in:C, C++ or other language
                                                                                                                                                                                                                                            Yara matches:
                                                                                                                                                                                                                                            • Rule: JoeSecurity_Empyrean, Description: Yara detected Empyrean, Source: 0000001A.00000002.2151057596.0000013317E10000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
                                                                                                                                                                                                                                            Has exited:true

                                                                                                                                                                                                                                            General

                                                                                                                                                                                                                                            Target ID:27
                                                                                                                                                                                                                                            Start time:04:48:27
                                                                                                                                                                                                                                            Start date:15/11/2024
                                                                                                                                                                                                                                            Path:C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                                            Wow64 process (32bit):false
                                                                                                                                                                                                                                            Commandline:C:\Windows\system32\cmd.exe /c "ver"
                                                                                                                                                                                                                                            Imagebase:0x7ff676be0000
                                                                                                                                                                                                                                            File size:289'792 bytes
                                                                                                                                                                                                                                            MD5 hash:8A2122E8162DBEF04694B9C3E0B6CDEE
                                                                                                                                                                                                                                            Has elevated privileges:false
                                                                                                                                                                                                                                            Has administrator privileges:false
                                                                                                                                                                                                                                            Programmed in:C, C++ or other language
                                                                                                                                                                                                                                            Has exited:true

                                                                                                                                                                                                                                            General

                                                                                                                                                                                                                                            Target ID:28
                                                                                                                                                                                                                                            Start time:04:48:27
                                                                                                                                                                                                                                            Start date:15/11/2024
                                                                                                                                                                                                                                            Path:C:\Windows\System32\conhost.exe
                                                                                                                                                                                                                                            Wow64 process (32bit):false
                                                                                                                                                                                                                                            Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                            Imagebase:0x7ff7699e0000
                                                                                                                                                                                                                                            File size:862'208 bytes
                                                                                                                                                                                                                                            MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                                                                                                                                                                                                            Has elevated privileges:false
                                                                                                                                                                                                                                            Has administrator privileges:false
                                                                                                                                                                                                                                            Programmed in:C, C++ or other language
                                                                                                                                                                                                                                            Has exited:true

                                                                                                                                                                                                                                            General

                                                                                                                                                                                                                                            Target ID:29
                                                                                                                                                                                                                                            Start time:04:48:31
                                                                                                                                                                                                                                            Start date:15/11/2024
                                                                                                                                                                                                                                            Path:C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                                            Wow64 process (32bit):false
                                                                                                                                                                                                                                            Commandline:C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\Roaming\empyrean\run.bat" "
                                                                                                                                                                                                                                            Imagebase:0x7ff676be0000
                                                                                                                                                                                                                                            File size:289'792 bytes
                                                                                                                                                                                                                                            MD5 hash:8A2122E8162DBEF04694B9C3E0B6CDEE
                                                                                                                                                                                                                                            Has elevated privileges:false
                                                                                                                                                                                                                                            Has administrator privileges:false
                                                                                                                                                                                                                                            Programmed in:C, C++ or other language
                                                                                                                                                                                                                                            Has exited:true

                                                                                                                                                                                                                                            General

                                                                                                                                                                                                                                            Target ID:30
                                                                                                                                                                                                                                            Start time:04:48:31
                                                                                                                                                                                                                                            Start date:15/11/2024
                                                                                                                                                                                                                                            Path:C:\Windows\System32\conhost.exe
                                                                                                                                                                                                                                            Wow64 process (32bit):false
                                                                                                                                                                                                                                            Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                            Imagebase:0x7ff7699e0000
                                                                                                                                                                                                                                            File size:862'208 bytes
                                                                                                                                                                                                                                            MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                                                                                                                                                                                                            Has elevated privileges:false
                                                                                                                                                                                                                                            Has administrator privileges:false
                                                                                                                                                                                                                                            Programmed in:C, C++ or other language
                                                                                                                                                                                                                                            Has exited:true

                                                                                                                                                                                                                                            General

                                                                                                                                                                                                                                            Target ID:31
                                                                                                                                                                                                                                            Start time:04:48:31
                                                                                                                                                                                                                                            Start date:15/11/2024
                                                                                                                                                                                                                                            Path:C:\Users\user\AppData\Roaming\empyrean\dat.txt
                                                                                                                                                                                                                                            Wow64 process (32bit):false
                                                                                                                                                                                                                                            Commandline:C:\Users\user\AppData\Roaming\empyrean\dat.txt
                                                                                                                                                                                                                                            Imagebase:0x7ff670a70000
                                                                                                                                                                                                                                            File size:18'752'296 bytes
                                                                                                                                                                                                                                            MD5 hash:61B5A3066BCF661F69B9E362EF1A1F8C
                                                                                                                                                                                                                                            Has elevated privileges:false
                                                                                                                                                                                                                                            Has administrator privileges:false
                                                                                                                                                                                                                                            Programmed in:C, C++ or other language
                                                                                                                                                                                                                                            Has exited:true

                                                                                                                                                                                                                                            General

                                                                                                                                                                                                                                            Target ID:32
                                                                                                                                                                                                                                            Start time:04:48:35
                                                                                                                                                                                                                                            Start date:15/11/2024
                                                                                                                                                                                                                                            Path:C:\Users\user\AppData\Roaming\empyrean\dat.txt
                                                                                                                                                                                                                                            Wow64 process (32bit):false
                                                                                                                                                                                                                                            Commandline:C:\Users\user\AppData\Roaming\empyrean\dat.txt
                                                                                                                                                                                                                                            Imagebase:0x7ff670a70000
                                                                                                                                                                                                                                            File size:18'752'296 bytes
                                                                                                                                                                                                                                            MD5 hash:61B5A3066BCF661F69B9E362EF1A1F8C
                                                                                                                                                                                                                                            Has elevated privileges:false
                                                                                                                                                                                                                                            Has administrator privileges:false
                                                                                                                                                                                                                                            Programmed in:C, C++ or other language
                                                                                                                                                                                                                                            Yara matches:
                                                                                                                                                                                                                                            • Rule: JoeSecurity_Empyrean, Description: Yara detected Empyrean, Source: 00000020.00000002.2233150692.000001A88A4E0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
                                                                                                                                                                                                                                            Has exited:true

                                                                                                                                                                                                                                            General

                                                                                                                                                                                                                                            Target ID:33
                                                                                                                                                                                                                                            Start time:04:48:36
                                                                                                                                                                                                                                            Start date:15/11/2024
                                                                                                                                                                                                                                            Path:C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                                            Wow64 process (32bit):false
                                                                                                                                                                                                                                            Commandline:C:\Windows\system32\cmd.exe /c "C:\Windows\System32\wbem\WMIC.exe csproduct get uuid"
                                                                                                                                                                                                                                            Imagebase:0x7ff676be0000
                                                                                                                                                                                                                                            File size:289'792 bytes
                                                                                                                                                                                                                                            MD5 hash:8A2122E8162DBEF04694B9C3E0B6CDEE
                                                                                                                                                                                                                                            Has elevated privileges:false
                                                                                                                                                                                                                                            Has administrator privileges:false
                                                                                                                                                                                                                                            Programmed in:C, C++ or other language
                                                                                                                                                                                                                                            Has exited:true

                                                                                                                                                                                                                                            General

                                                                                                                                                                                                                                            Target ID:34
                                                                                                                                                                                                                                            Start time:04:48:36
                                                                                                                                                                                                                                            Start date:15/11/2024
                                                                                                                                                                                                                                            Path:C:\Windows\System32\conhost.exe
                                                                                                                                                                                                                                            Wow64 process (32bit):false
                                                                                                                                                                                                                                            Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                            Imagebase:0x7ff7699e0000
                                                                                                                                                                                                                                            File size:862'208 bytes
                                                                                                                                                                                                                                            MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                                                                                                                                                                                                            Has elevated privileges:false
                                                                                                                                                                                                                                            Has administrator privileges:false
                                                                                                                                                                                                                                            Programmed in:C, C++ or other language
                                                                                                                                                                                                                                            Has exited:true

                                                                                                                                                                                                                                            General

                                                                                                                                                                                                                                            Target ID:35
                                                                                                                                                                                                                                            Start time:04:48:36
                                                                                                                                                                                                                                            Start date:15/11/2024
                                                                                                                                                                                                                                            Path:C:\Windows\System32\wbem\WMIC.exe
                                                                                                                                                                                                                                            Wow64 process (32bit):false
                                                                                                                                                                                                                                            Commandline:C:\Windows\System32\wbem\WMIC.exe csproduct get uuid
                                                                                                                                                                                                                                            Imagebase:0x7ff69e6c0000
                                                                                                                                                                                                                                            File size:576'000 bytes
                                                                                                                                                                                                                                            MD5 hash:C37F2F4F4B3CD128BDABCAEB2266A785
                                                                                                                                                                                                                                            Has elevated privileges:false
                                                                                                                                                                                                                                            Has administrator privileges:false
                                                                                                                                                                                                                                            Programmed in:C, C++ or other language
                                                                                                                                                                                                                                            Has exited:true

                                                                                                                                                                                                                                            General

                                                                                                                                                                                                                                            Target ID:36
                                                                                                                                                                                                                                            Start time:04:48:37
                                                                                                                                                                                                                                            Start date:15/11/2024
                                                                                                                                                                                                                                            Path:C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                                            Wow64 process (32bit):false
                                                                                                                                                                                                                                            Commandline:C:\Windows\system32\cmd.exe /c "ver"
                                                                                                                                                                                                                                            Imagebase:0x7ff676be0000
                                                                                                                                                                                                                                            File size:289'792 bytes
                                                                                                                                                                                                                                            MD5 hash:8A2122E8162DBEF04694B9C3E0B6CDEE
                                                                                                                                                                                                                                            Has elevated privileges:false
                                                                                                                                                                                                                                            Has administrator privileges:false
                                                                                                                                                                                                                                            Programmed in:C, C++ or other language
                                                                                                                                                                                                                                            Has exited:true

                                                                                                                                                                                                                                            General

                                                                                                                                                                                                                                            Target ID:37
                                                                                                                                                                                                                                            Start time:04:48:37
                                                                                                                                                                                                                                            Start date:15/11/2024
                                                                                                                                                                                                                                            Path:C:\Windows\System32\conhost.exe
                                                                                                                                                                                                                                            Wow64 process (32bit):false
                                                                                                                                                                                                                                            Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                            Imagebase:0x7ff7699e0000
                                                                                                                                                                                                                                            File size:862'208 bytes
                                                                                                                                                                                                                                            MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                                                                                                                                                                                                            Has elevated privileges:false
                                                                                                                                                                                                                                            Has administrator privileges:false
                                                                                                                                                                                                                                            Programmed in:C, C++ or other language
                                                                                                                                                                                                                                            Has exited:true

                                                                                                                                                                                                                                            General

                                                                                                                                                                                                                                            Target ID:38
                                                                                                                                                                                                                                            Start time:04:48:38
                                                                                                                                                                                                                                            Start date:15/11/2024
                                                                                                                                                                                                                                            Path:C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                                            Wow64 process (32bit):false
                                                                                                                                                                                                                                            Commandline:C:\Windows\system32\cmd.exe /c "C:\Windows\System32\wbem\WMIC.exe csproduct get uuid"
                                                                                                                                                                                                                                            Imagebase:0x7ff676be0000
                                                                                                                                                                                                                                            File size:289'792 bytes
                                                                                                                                                                                                                                            MD5 hash:8A2122E8162DBEF04694B9C3E0B6CDEE
                                                                                                                                                                                                                                            Has elevated privileges:false
                                                                                                                                                                                                                                            Has administrator privileges:false
                                                                                                                                                                                                                                            Programmed in:C, C++ or other language
                                                                                                                                                                                                                                            Has exited:true

                                                                                                                                                                                                                                            General

                                                                                                                                                                                                                                            Target ID:39
                                                                                                                                                                                                                                            Start time:04:48:38
                                                                                                                                                                                                                                            Start date:15/11/2024
                                                                                                                                                                                                                                            Path:C:\Windows\System32\conhost.exe
                                                                                                                                                                                                                                            Wow64 process (32bit):false
                                                                                                                                                                                                                                            Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                            Imagebase:0x7ff7699e0000
                                                                                                                                                                                                                                            File size:862'208 bytes
                                                                                                                                                                                                                                            MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                                                                                                                                                                                                            Has elevated privileges:false
                                                                                                                                                                                                                                            Has administrator privileges:false
                                                                                                                                                                                                                                            Programmed in:C, C++ or other language
                                                                                                                                                                                                                                            Has exited:true

                                                                                                                                                                                                                                            General

                                                                                                                                                                                                                                            Target ID:40
                                                                                                                                                                                                                                            Start time:04:48:38
                                                                                                                                                                                                                                            Start date:15/11/2024
                                                                                                                                                                                                                                            Path:C:\Windows\System32\wbem\WMIC.exe
                                                                                                                                                                                                                                            Wow64 process (32bit):false
                                                                                                                                                                                                                                            Commandline:C:\Windows\System32\wbem\WMIC.exe csproduct get uuid
                                                                                                                                                                                                                                            Imagebase:0x7ff69e6c0000
                                                                                                                                                                                                                                            File size:576'000 bytes
                                                                                                                                                                                                                                            MD5 hash:C37F2F4F4B3CD128BDABCAEB2266A785
                                                                                                                                                                                                                                            Has elevated privileges:false
                                                                                                                                                                                                                                            Has administrator privileges:false
                                                                                                                                                                                                                                            Programmed in:C, C++ or other language
                                                                                                                                                                                                                                            Has exited:true

                                                                                                                                                                                                                                            General

                                                                                                                                                                                                                                            Target ID:41
                                                                                                                                                                                                                                            Start time:04:48:40
                                                                                                                                                                                                                                            Start date:15/11/2024
                                                                                                                                                                                                                                            Path:C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                                            Wow64 process (32bit):false
                                                                                                                                                                                                                                            Commandline:C:\Windows\system32\cmd.exe /c "C:\Windows\System32\wbem\WMIC.exe csproduct get uuid"
                                                                                                                                                                                                                                            Imagebase:0x7ff676be0000
                                                                                                                                                                                                                                            File size:289'792 bytes
                                                                                                                                                                                                                                            MD5 hash:8A2122E8162DBEF04694B9C3E0B6CDEE
                                                                                                                                                                                                                                            Has elevated privileges:false
                                                                                                                                                                                                                                            Has administrator privileges:false
                                                                                                                                                                                                                                            Programmed in:C, C++ or other language
                                                                                                                                                                                                                                            Has exited:true

                                                                                                                                                                                                                                            General

                                                                                                                                                                                                                                            Target ID:42
                                                                                                                                                                                                                                            Start time:04:48:40
                                                                                                                                                                                                                                            Start date:15/11/2024
                                                                                                                                                                                                                                            Path:C:\Windows\System32\conhost.exe
                                                                                                                                                                                                                                            Wow64 process (32bit):false
                                                                                                                                                                                                                                            Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                            Imagebase:0x7ff7699e0000
                                                                                                                                                                                                                                            File size:862'208 bytes
                                                                                                                                                                                                                                            MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                                                                                                                                                                                                            Has elevated privileges:false
                                                                                                                                                                                                                                            Has administrator privileges:false
                                                                                                                                                                                                                                            Programmed in:C, C++ or other language
                                                                                                                                                                                                                                            Has exited:true

                                                                                                                                                                                                                                            General

                                                                                                                                                                                                                                            Target ID:43
                                                                                                                                                                                                                                            Start time:04:48:40
                                                                                                                                                                                                                                            Start date:15/11/2024
                                                                                                                                                                                                                                            Path:C:\Windows\System32\wbem\WMIC.exe
                                                                                                                                                                                                                                            Wow64 process (32bit):false
                                                                                                                                                                                                                                            Commandline:C:\Windows\System32\wbem\WMIC.exe csproduct get uuid
                                                                                                                                                                                                                                            Imagebase:0x7ff69e6c0000
                                                                                                                                                                                                                                            File size:576'000 bytes
                                                                                                                                                                                                                                            MD5 hash:C37F2F4F4B3CD128BDABCAEB2266A785
                                                                                                                                                                                                                                            Has elevated privileges:false
                                                                                                                                                                                                                                            Has administrator privileges:false
                                                                                                                                                                                                                                            Programmed in:C, C++ or other language
                                                                                                                                                                                                                                            Has exited:true

                                                                                                                                                                                                                                            General

                                                                                                                                                                                                                                            Target ID:44
                                                                                                                                                                                                                                            Start time:04:48:46
                                                                                                                                                                                                                                            Start date:15/11/2024
                                                                                                                                                                                                                                            Path:C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                                            Wow64 process (32bit):false
                                                                                                                                                                                                                                            Commandline:C:\Windows\system32\cmd.exe /c "C:\Windows\System32\wbem\WMIC.exe csproduct get uuid"
                                                                                                                                                                                                                                            Imagebase:0x7ff676be0000
                                                                                                                                                                                                                                            File size:289'792 bytes
                                                                                                                                                                                                                                            MD5 hash:8A2122E8162DBEF04694B9C3E0B6CDEE
                                                                                                                                                                                                                                            Has elevated privileges:false
                                                                                                                                                                                                                                            Has administrator privileges:false
                                                                                                                                                                                                                                            Programmed in:C, C++ or other language
                                                                                                                                                                                                                                            Has exited:true

                                                                                                                                                                                                                                            General

                                                                                                                                                                                                                                            Target ID:45
                                                                                                                                                                                                                                            Start time:04:48:46
                                                                                                                                                                                                                                            Start date:15/11/2024
                                                                                                                                                                                                                                            Path:C:\Windows\System32\conhost.exe
                                                                                                                                                                                                                                            Wow64 process (32bit):false
                                                                                                                                                                                                                                            Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                            Imagebase:0x7ff7699e0000
                                                                                                                                                                                                                                            File size:862'208 bytes
                                                                                                                                                                                                                                            MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                                                                                                                                                                                                            Has elevated privileges:false
                                                                                                                                                                                                                                            Has administrator privileges:false
                                                                                                                                                                                                                                            Programmed in:C, C++ or other language
                                                                                                                                                                                                                                            Has exited:true

                                                                                                                                                                                                                                            General

                                                                                                                                                                                                                                            Target ID:46
                                                                                                                                                                                                                                            Start time:04:48:46
                                                                                                                                                                                                                                            Start date:15/11/2024
                                                                                                                                                                                                                                            Path:C:\Windows\System32\wbem\WMIC.exe
                                                                                                                                                                                                                                            Wow64 process (32bit):false
                                                                                                                                                                                                                                            Commandline:C:\Windows\System32\wbem\WMIC.exe csproduct get uuid
                                                                                                                                                                                                                                            Imagebase:0x7ff69e6c0000
                                                                                                                                                                                                                                            File size:576'000 bytes
                                                                                                                                                                                                                                            MD5 hash:C37F2F4F4B3CD128BDABCAEB2266A785
                                                                                                                                                                                                                                            Has elevated privileges:false
                                                                                                                                                                                                                                            Has administrator privileges:false
                                                                                                                                                                                                                                            Programmed in:C, C++ or other language
                                                                                                                                                                                                                                            Has exited:true

                                                                                                                                                                                                                                            General

                                                                                                                                                                                                                                            Target ID:47
                                                                                                                                                                                                                                            Start time:04:48:48
                                                                                                                                                                                                                                            Start date:15/11/2024
                                                                                                                                                                                                                                            Path:C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                                            Wow64 process (32bit):false
                                                                                                                                                                                                                                            Commandline:C:\Windows\system32\cmd.exe /c "C:\Windows\System32\wbem\WMIC.exe csproduct get uuid"
                                                                                                                                                                                                                                            Imagebase:0x7ff676be0000
                                                                                                                                                                                                                                            File size:289'792 bytes
                                                                                                                                                                                                                                            MD5 hash:8A2122E8162DBEF04694B9C3E0B6CDEE
                                                                                                                                                                                                                                            Has elevated privileges:false
                                                                                                                                                                                                                                            Has administrator privileges:false
                                                                                                                                                                                                                                            Programmed in:C, C++ or other language
                                                                                                                                                                                                                                            Has exited:true

                                                                                                                                                                                                                                            General

                                                                                                                                                                                                                                            Target ID:48
                                                                                                                                                                                                                                            Start time:04:48:48
                                                                                                                                                                                                                                            Start date:15/11/2024
                                                                                                                                                                                                                                            Path:C:\Windows\System32\conhost.exe
                                                                                                                                                                                                                                            Wow64 process (32bit):false
                                                                                                                                                                                                                                            Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                            Imagebase:0x7ff7699e0000
                                                                                                                                                                                                                                            File size:862'208 bytes
                                                                                                                                                                                                                                            MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                                                                                                                                                                                                            Has elevated privileges:false
                                                                                                                                                                                                                                            Has administrator privileges:false
                                                                                                                                                                                                                                            Programmed in:C, C++ or other language
                                                                                                                                                                                                                                            Has exited:true

                                                                                                                                                                                                                                            General

                                                                                                                                                                                                                                            Target ID:49
                                                                                                                                                                                                                                            Start time:04:48:48
                                                                                                                                                                                                                                            Start date:15/11/2024
                                                                                                                                                                                                                                            Path:C:\Windows\System32\wbem\WMIC.exe
                                                                                                                                                                                                                                            Wow64 process (32bit):false
                                                                                                                                                                                                                                            Commandline:C:\Windows\System32\wbem\WMIC.exe csproduct get uuid
                                                                                                                                                                                                                                            Imagebase:0x7ff69e6c0000
                                                                                                                                                                                                                                            File size:576'000 bytes
                                                                                                                                                                                                                                            MD5 hash:C37F2F4F4B3CD128BDABCAEB2266A785
                                                                                                                                                                                                                                            Has elevated privileges:false
                                                                                                                                                                                                                                            Has administrator privileges:false
                                                                                                                                                                                                                                            Programmed in:C, C++ or other language
                                                                                                                                                                                                                                            Has exited:true

                                                                                                                                                                                                                                            General

                                                                                                                                                                                                                                            Target ID:50
                                                                                                                                                                                                                                            Start time:04:48:50
                                                                                                                                                                                                                                            Start date:15/11/2024
                                                                                                                                                                                                                                            Path:C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                                            Wow64 process (32bit):false
                                                                                                                                                                                                                                            Commandline:C:\Windows\system32\cmd.exe /c "C:\Windows\System32\wbem\WMIC.exe csproduct get uuid"
                                                                                                                                                                                                                                            Imagebase:0x7ff676be0000
                                                                                                                                                                                                                                            File size:289'792 bytes
                                                                                                                                                                                                                                            MD5 hash:8A2122E8162DBEF04694B9C3E0B6CDEE
                                                                                                                                                                                                                                            Has elevated privileges:false
                                                                                                                                                                                                                                            Has administrator privileges:false
                                                                                                                                                                                                                                            Programmed in:C, C++ or other language
                                                                                                                                                                                                                                            Has exited:true

                                                                                                                                                                                                                                            General

                                                                                                                                                                                                                                            Target ID:51
                                                                                                                                                                                                                                            Start time:04:48:50
                                                                                                                                                                                                                                            Start date:15/11/2024
                                                                                                                                                                                                                                            Path:C:\Windows\System32\conhost.exe
                                                                                                                                                                                                                                            Wow64 process (32bit):false
                                                                                                                                                                                                                                            Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                            Imagebase:0x7ff7699e0000
                                                                                                                                                                                                                                            File size:862'208 bytes
                                                                                                                                                                                                                                            MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                                                                                                                                                                                                            Has elevated privileges:false
                                                                                                                                                                                                                                            Has administrator privileges:false
                                                                                                                                                                                                                                            Programmed in:C, C++ or other language
                                                                                                                                                                                                                                            Has exited:true

                                                                                                                                                                                                                                            General

                                                                                                                                                                                                                                            Target ID:52
                                                                                                                                                                                                                                            Start time:04:48:50
                                                                                                                                                                                                                                            Start date:15/11/2024
                                                                                                                                                                                                                                            Path:C:\Windows\System32\wbem\WMIC.exe
                                                                                                                                                                                                                                            Wow64 process (32bit):false
                                                                                                                                                                                                                                            Commandline:C:\Windows\System32\wbem\WMIC.exe csproduct get uuid
                                                                                                                                                                                                                                            Imagebase:0x7ff69e6c0000
                                                                                                                                                                                                                                            File size:576'000 bytes
                                                                                                                                                                                                                                            MD5 hash:C37F2F4F4B3CD128BDABCAEB2266A785
                                                                                                                                                                                                                                            Has elevated privileges:false
                                                                                                                                                                                                                                            Has administrator privileges:false
                                                                                                                                                                                                                                            Programmed in:C, C++ or other language
                                                                                                                                                                                                                                            Has exited:true

                                                                                                                                                                                                                                            Disassembly

                                                                                                                                                                                                                                            Reset < >

                                                                                                                                                                                                                                              Execution Graph

                                                                                                                                                                                                                                              Execution Coverage:11.5%
                                                                                                                                                                                                                                              Dynamic/Decrypted Code Coverage:0%
                                                                                                                                                                                                                                              Signature Coverage:14.3%
                                                                                                                                                                                                                                              Total number of Nodes:2000
                                                                                                                                                                                                                                              Total number of Limit Nodes:52
                                                                                                                                                                                                                                              execution_graph 17815 7ff619be93fc 17816 7ff619be940c 17815->17816 17819 7ff619bd40a8 LeaveCriticalSection 17816->17819 14867 7ff619bc9610 14868 7ff619bc963e 14867->14868 14869 7ff619bc9625 14867->14869 14869->14868 14872 7ff619bdce50 14869->14872 14873 7ff619bdce9b 14872->14873 14878 7ff619bdce5f _get_daylight 14872->14878 14874 7ff619bd41f4 _get_daylight 11 API calls 14873->14874 14876 7ff619bc969c 14874->14876 14875 7ff619bdce82 HeapAlloc 14875->14876 14875->14878 14877 7ff619be29c0 _get_daylight 2 API calls 14877->14878 14878->14873 14878->14875 14878->14877 14879 7ff619bd8b11 14891 7ff619bd9438 14879->14891 14896 7ff619bda960 GetLastError 14891->14896 14897 7ff619bda984 FlsGetValue 14896->14897 14898 7ff619bda9a1 FlsSetValue 14896->14898 14899 7ff619bda99b 14897->14899 14916 7ff619bda991 14897->14916 14900 7ff619bda9b3 14898->14900 14898->14916 14899->14898 14902 7ff619bde0e0 _get_daylight 11 API calls 14900->14902 14901 7ff619bdaa0d SetLastError 14903 7ff619bd9441 14901->14903 14904 7ff619bdaa2d 14901->14904 14905 7ff619bda9c2 14902->14905 14918 7ff619bd956c 14903->14918 14906 7ff619bd956c __GetCurrentState 38 API calls 14904->14906 14907 7ff619bda9e0 FlsSetValue 14905->14907 14908 7ff619bda9d0 FlsSetValue 14905->14908 14911 7ff619bdaa32 14906->14911 14909 7ff619bda9fe 14907->14909 14910 7ff619bda9ec FlsSetValue 14907->14910 14912 7ff619bda9d9 14908->14912 14913 7ff619bda710 _get_daylight 11 API calls 14909->14913 14910->14912 14914 7ff619bda168 __free_lconv_mon 11 API calls 14912->14914 14915 7ff619bdaa06 14913->14915 14914->14916 14917 7ff619bda168 __free_lconv_mon 11 API calls 14915->14917 14916->14901 14917->14901 14927 7ff619bd6e28 14918->14927 14953 7ff619bd6d00 14927->14953 14958 7ff619bdfac8 EnterCriticalSection 14953->14958 14664 7ff619bd64a4 14665 7ff619bd64d2 14664->14665 14666 7ff619bd650b 14664->14666 14744 7ff619bd41f4 14665->14744 14666->14665 14668 7ff619bd6510 FindFirstFileExW 14666->14668 14670 7ff619bd6532 GetLastError 14668->14670 14671 7ff619bd6579 14668->14671 14674 7ff619bd654c 14670->14674 14675 7ff619bd653d 14670->14675 14724 7ff619bd6714 14671->14724 14677 7ff619bd41f4 _get_daylight 11 API calls 14674->14677 14676 7ff619bd6569 14675->14676 14680 7ff619bd6547 14675->14680 14681 7ff619bd6559 14675->14681 14682 7ff619bd41f4 _get_daylight 11 API calls 14676->14682 14678 7ff619bd64e2 14677->14678 14749 7ff619bcacc0 14678->14749 14680->14674 14680->14676 14684 7ff619bd41f4 _get_daylight 11 API calls 14681->14684 14682->14678 14683 7ff619bd6714 _wfindfirst32i64 10 API calls 14686 7ff619bd659f 14683->14686 14684->14678 14687 7ff619bd6714 _wfindfirst32i64 10 API calls 14686->14687 14689 7ff619bd65ad 14687->14689 14731 7ff619bdfc64 14689->14731 14692 7ff619bd65d7 14740 7ff619bda120 IsProcessorFeaturePresent 14692->14740 14725 7ff619bd6732 FileTimeToSystemTime 14724->14725 14726 7ff619bd672c 14724->14726 14727 7ff619bd6741 SystemTimeToTzSpecificLocalTime 14725->14727 14728 7ff619bd6757 14725->14728 14726->14725 14726->14728 14727->14728 14729 7ff619bcacc0 _wfindfirst32i64 8 API calls 14728->14729 14730 7ff619bd6591 14729->14730 14730->14683 14732 7ff619bdfc7b 14731->14732 14733 7ff619bdfc71 14731->14733 14734 7ff619bd41f4 _get_daylight 11 API calls 14732->14734 14733->14732 14737 7ff619bdfc97 14733->14737 14739 7ff619bdfc83 14734->14739 14735 7ff619bda100 _invalid_parameter_noinfo 37 API calls 14736 7ff619bd65cb 14735->14736 14736->14678 14736->14692 14737->14736 14738 7ff619bd41f4 _get_daylight 11 API calls 14737->14738 14738->14739 14739->14735 14741 7ff619bda133 14740->14741 14758 7ff619bd9e30 14741->14758 14766 7ff619bdaad8 GetLastError 14744->14766 14746 7ff619bd41fd 14747 7ff619bda100 14746->14747 14824 7ff619bd9f94 14747->14824 14750 7ff619bcacc9 14749->14750 14751 7ff619bcacd4 14750->14751 14752 7ff619bcaff0 IsProcessorFeaturePresent 14750->14752 14753 7ff619bcb008 14752->14753 14862 7ff619bcb1e4 RtlCaptureContext 14753->14862 14759 7ff619bd9e6a _wfindfirst32i64 memcpy_s 14758->14759 14760 7ff619bd9e92 RtlCaptureContext RtlLookupFunctionEntry 14759->14760 14761 7ff619bd9f02 IsDebuggerPresent SetUnhandledExceptionFilter UnhandledExceptionFilter 14760->14761 14762 7ff619bd9ecc RtlVirtualUnwind 14760->14762 14763 7ff619bd9f54 _wfindfirst32i64 14761->14763 14762->14761 14764 7ff619bcacc0 _wfindfirst32i64 8 API calls 14763->14764 14765 7ff619bd9f73 GetCurrentProcess TerminateProcess 14764->14765 14767 7ff619bdab19 FlsSetValue 14766->14767 14772 7ff619bdaafc 14766->14772 14768 7ff619bdab2b 14767->14768 14773 7ff619bdab09 SetLastError 14767->14773 14783 7ff619bde0e0 14768->14783 14772->14767 14772->14773 14773->14746 14774 7ff619bdab58 FlsSetValue 14777 7ff619bdab64 FlsSetValue 14774->14777 14778 7ff619bdab76 14774->14778 14775 7ff619bdab48 FlsSetValue 14776 7ff619bdab51 14775->14776 14790 7ff619bda168 14776->14790 14777->14776 14796 7ff619bda710 14778->14796 14788 7ff619bde0f1 _get_daylight 14783->14788 14784 7ff619bde126 HeapAlloc 14786 7ff619bdab3a 14784->14786 14784->14788 14785 7ff619bde142 14787 7ff619bd41f4 _get_daylight 10 API calls 14785->14787 14786->14774 14786->14775 14787->14786 14788->14784 14788->14785 14801 7ff619be29c0 14788->14801 14791 7ff619bda16d RtlFreeHeap 14790->14791 14795 7ff619bda19c 14790->14795 14792 7ff619bda188 GetLastError 14791->14792 14791->14795 14793 7ff619bda195 __free_lconv_mon 14792->14793 14794 7ff619bd41f4 _get_daylight 9 API calls 14793->14794 14794->14795 14795->14773 14810 7ff619bda5e8 14796->14810 14804 7ff619be29fc 14801->14804 14809 7ff619bdfac8 EnterCriticalSection 14804->14809 14822 7ff619bdfac8 EnterCriticalSection 14810->14822 14825 7ff619bd9fbf 14824->14825 14828 7ff619bda030 14825->14828 14827 7ff619bd9fe6 14836 7ff619bd9d78 14828->14836 14833 7ff619bda120 _wfindfirst32i64 17 API calls 14835 7ff619bda0fe 14833->14835 14834 7ff619bda06b 14834->14827 14837 7ff619bd9d94 GetLastError 14836->14837 14838 7ff619bd9dcf 14836->14838 14839 7ff619bd9da4 14837->14839 14838->14834 14842 7ff619bd9de4 14838->14842 14845 7ff619bdaba0 14839->14845 14843 7ff619bd9e00 GetLastError SetLastError 14842->14843 14844 7ff619bd9e18 14842->14844 14843->14844 14844->14833 14844->14834 14846 7ff619bdabbf FlsGetValue 14845->14846 14847 7ff619bdabda FlsSetValue 14845->14847 14848 7ff619bdabd4 14846->14848 14850 7ff619bd9dbf SetLastError 14846->14850 14849 7ff619bdabe7 14847->14849 14847->14850 14848->14847 14851 7ff619bde0e0 _get_daylight 11 API calls 14849->14851 14850->14838 14852 7ff619bdabf6 14851->14852 14853 7ff619bdac14 FlsSetValue 14852->14853 14854 7ff619bdac04 FlsSetValue 14852->14854 14855 7ff619bdac32 14853->14855 14856 7ff619bdac20 FlsSetValue 14853->14856 14857 7ff619bdac0d 14854->14857 14858 7ff619bda710 _get_daylight 11 API calls 14855->14858 14856->14857 14859 7ff619bda168 __free_lconv_mon 11 API calls 14857->14859 14860 7ff619bdac3a 14858->14860 14859->14850 14861 7ff619bda168 __free_lconv_mon 11 API calls 14860->14861 14861->14850 14863 7ff619bcb1fe RtlLookupFunctionEntry 14862->14863 14864 7ff619bcb214 RtlVirtualUnwind 14863->14864 14865 7ff619bcb01b 14863->14865 14864->14863 14864->14865 14866 7ff619bcafb4 SetUnhandledExceptionFilter UnhandledExceptionFilter GetCurrentProcess TerminateProcess 14865->14866 17832 7ff619be0b20 17843 7ff619be6680 17832->17843 17844 7ff619be668d 17843->17844 17845 7ff619bda168 __free_lconv_mon 11 API calls 17844->17845 17846 7ff619be66a9 17844->17846 17845->17844 17847 7ff619bda168 __free_lconv_mon 11 API calls 17846->17847 17848 7ff619be0b29 17846->17848 17847->17846 17849 7ff619bdfac8 EnterCriticalSection 17848->17849 18518 7ff619be6eb0 18521 7ff619be1a60 18518->18521 18522 7ff619be1a6d 18521->18522 18523 7ff619be1ab2 18521->18523 18527 7ff619bdaa34 18522->18527 18528 7ff619bdaa45 FlsGetValue 18527->18528 18529 7ff619bdaa60 FlsSetValue 18527->18529 18530 7ff619bdaa52 18528->18530 18531 7ff619bdaa5a 18528->18531 18529->18530 18532 7ff619bdaa6d 18529->18532 18533 7ff619bd956c __GetCurrentState 45 API calls 18530->18533 18536 7ff619bdaa58 18530->18536 18531->18529 18534 7ff619bde0e0 _get_daylight 11 API calls 18532->18534 18537 7ff619bdaad5 18533->18537 18535 7ff619bdaa7c 18534->18535 18538 7ff619bdaa9a FlsSetValue 18535->18538 18539 7ff619bdaa8a FlsSetValue 18535->18539 18547 7ff619be1738 18536->18547 18541 7ff619bdaaa6 FlsSetValue 18538->18541 18542 7ff619bdaab8 18538->18542 18540 7ff619bdaa93 18539->18540 18543 7ff619bda168 __free_lconv_mon 11 API calls 18540->18543 18541->18540 18544 7ff619bda710 _get_daylight 11 API calls 18542->18544 18543->18530 18545 7ff619bdaac0 18544->18545 18546 7ff619bda168 __free_lconv_mon 11 API calls 18545->18546 18546->18536 18570 7ff619be19a8 18547->18570 18549 7ff619be176d 18585 7ff619be1438 18549->18585 18552 7ff619be178a 18552->18523 18553 7ff619bdce50 _fread_nolock 12 API calls 18554 7ff619be179b 18553->18554 18555 7ff619be17a3 18554->18555 18557 7ff619be17b2 18554->18557 18556 7ff619bda168 __free_lconv_mon 11 API calls 18555->18556 18556->18552 18557->18557 18592 7ff619be1adc 18557->18592 18560 7ff619be18ae 18561 7ff619bd41f4 _get_daylight 11 API calls 18560->18561 18562 7ff619be18b3 18561->18562 18566 7ff619bda168 __free_lconv_mon 11 API calls 18562->18566 18563 7ff619be1909 18565 7ff619be1970 18563->18565 18603 7ff619be1268 18563->18603 18564 7ff619be18c8 18564->18563 18567 7ff619bda168 __free_lconv_mon 11 API calls 18564->18567 18569 7ff619bda168 __free_lconv_mon 11 API calls 18565->18569 18566->18552 18567->18563 18569->18552 18571 7ff619be19cb 18570->18571 18572 7ff619be19d5 18571->18572 18618 7ff619bdfac8 EnterCriticalSection 18571->18618 18574 7ff619be1a47 18572->18574 18576 7ff619bd956c __GetCurrentState 45 API calls 18572->18576 18574->18549 18579 7ff619be1a5f 18576->18579 18580 7ff619be1ab2 18579->18580 18582 7ff619bdaa34 50 API calls 18579->18582 18580->18549 18583 7ff619be1a9c 18582->18583 18584 7ff619be1738 65 API calls 18583->18584 18584->18580 18586 7ff619bd47cc 45 API calls 18585->18586 18587 7ff619be144c 18586->18587 18588 7ff619be146a 18587->18588 18589 7ff619be1458 GetOEMCP 18587->18589 18590 7ff619be147f 18588->18590 18591 7ff619be146f GetACP 18588->18591 18589->18590 18590->18552 18590->18553 18591->18590 18593 7ff619be1438 47 API calls 18592->18593 18594 7ff619be1b09 18593->18594 18596 7ff619be1b46 IsValidCodePage 18594->18596 18601 7ff619be1b89 memcpy_s 18594->18601 18595 7ff619bcacc0 _wfindfirst32i64 8 API calls 18597 7ff619be18a5 18595->18597 18598 7ff619be1b57 18596->18598 18596->18601 18597->18560 18597->18564 18599 7ff619be1b8e GetCPInfo 18598->18599 18602 7ff619be1b60 memcpy_s 18598->18602 18599->18601 18599->18602 18601->18595 18619 7ff619be1550 18602->18619 18687 7ff619bdfac8 EnterCriticalSection 18603->18687 18620 7ff619be158d GetCPInfo 18619->18620 18629 7ff619be1683 18619->18629 18626 7ff619be15a0 18620->18626 18620->18629 18621 7ff619bcacc0 _wfindfirst32i64 8 API calls 18622 7ff619be1722 18621->18622 18622->18601 18630 7ff619be2268 18626->18630 18628 7ff619be6e10 54 API calls 18628->18629 18629->18621 18631 7ff619bd47cc 45 API calls 18630->18631 18632 7ff619be22aa 18631->18632 18633 7ff619bdeb84 _fread_nolock MultiByteToWideChar 18632->18633 18635 7ff619be22e0 18633->18635 18634 7ff619be22e7 18637 7ff619bcacc0 _wfindfirst32i64 8 API calls 18634->18637 18635->18634 18636 7ff619bdce50 _fread_nolock 12 API calls 18635->18636 18638 7ff619be23ae 18635->18638 18641 7ff619be2310 memcpy_s 18635->18641 18636->18641 18639 7ff619be1617 18637->18639 18638->18634 18640 7ff619bda168 __free_lconv_mon 11 API calls 18638->18640 18645 7ff619be6e10 18639->18645 18640->18634 18641->18638 18642 7ff619bdeb84 _fread_nolock MultiByteToWideChar 18641->18642 18643 7ff619be2389 18642->18643 18643->18638 18644 7ff619be2394 GetStringTypeW 18643->18644 18644->18638 18646 7ff619bd47cc 45 API calls 18645->18646 18647 7ff619be6e35 18646->18647 18650 7ff619be6af0 18647->18650 18651 7ff619be6b32 18650->18651 18652 7ff619bdeb84 _fread_nolock MultiByteToWideChar 18651->18652 18656 7ff619be6b7c 18652->18656 18653 7ff619be6de7 18654 7ff619bcacc0 _wfindfirst32i64 8 API calls 18653->18654 18655 7ff619be164a 18654->18655 18655->18628 18656->18653 18657 7ff619bdce50 _fread_nolock 12 API calls 18656->18657 18658 7ff619be6cb4 18656->18658 18660 7ff619be6bb2 18656->18660 18657->18660 18658->18653 18659 7ff619bda168 __free_lconv_mon 11 API calls 18658->18659 18659->18653 18660->18658 18661 7ff619bdeb84 _fread_nolock MultiByteToWideChar 18660->18661 18662 7ff619be6c22 18661->18662 18662->18658 18678 7ff619bde530 18662->18678 18665 7ff619be6cc3 18665->18658 18667 7ff619bdce50 _fread_nolock 12 API calls 18665->18667 18669 7ff619be6ce1 18665->18669 18666 7ff619be6c71 18666->18658 18668 7ff619bde530 __crtLCMapStringW 6 API calls 18666->18668 18667->18669 18668->18658 18669->18658 18670 7ff619bde530 __crtLCMapStringW 6 API calls 18669->18670 18673 7ff619be6d5e 18670->18673 18671 7ff619be6d93 18671->18658 18672 7ff619bda168 __free_lconv_mon 11 API calls 18671->18672 18672->18658 18673->18671 18674 7ff619bdf424 WideCharToMultiByte 18673->18674 18675 7ff619be6d8d 18674->18675 18675->18671 18676 7ff619be6dba 18675->18676 18676->18658 18677 7ff619bda168 __free_lconv_mon 11 API calls 18676->18677 18677->18658 18679 7ff619bde158 __crtLCMapStringW 5 API calls 18678->18679 18680 7ff619bde56e 18679->18680 18681 7ff619bde576 18680->18681 18684 7ff619bde61c 18680->18684 18681->18658 18681->18665 18681->18666 18683 7ff619bde5df LCMapStringW 18683->18681 18685 7ff619bde158 __crtLCMapStringW 5 API calls 18684->18685 18686 7ff619bde64a __crtLCMapStringW 18685->18686 18686->18683 18688 7ff619bd8db0 18691 7ff619bd8d34 18688->18691 18698 7ff619bdfac8 EnterCriticalSection 18691->18698 15016 7ff619bcae2c 15037 7ff619bcb29c 15016->15037 15019 7ff619bcaf78 15139 7ff619bcb5cc IsProcessorFeaturePresent 15019->15139 15021 7ff619bcae48 __scrt_acquire_startup_lock 15022 7ff619bcaf82 15021->15022 15029 7ff619bcae66 __scrt_release_startup_lock 15021->15029 15023 7ff619bcb5cc 7 API calls 15022->15023 15025 7ff619bcaf8d __GetCurrentState 15023->15025 15024 7ff619bcae8b 15026 7ff619bcaf11 15043 7ff619bcb718 15026->15043 15028 7ff619bcaf16 15046 7ff619bc1000 15028->15046 15029->15024 15029->15026 15128 7ff619bd8ce8 15029->15128 15034 7ff619bcaf39 15034->15025 15135 7ff619bcb430 15034->15135 15146 7ff619bcb89c 15037->15146 15040 7ff619bcb2cb __scrt_initialize_crt 15041 7ff619bcae40 15040->15041 15148 7ff619bcc9f8 15040->15148 15041->15019 15041->15021 15175 7ff619bcc140 15043->15175 15047 7ff619bc100b 15046->15047 15177 7ff619bc7560 15047->15177 15049 7ff619bc101d 15184 7ff619bd4cc8 15049->15184 15051 7ff619bc365b 15191 7ff619bc1af0 15051->15191 15055 7ff619bcacc0 _wfindfirst32i64 8 API calls 15056 7ff619bc378e 15055->15056 15133 7ff619bcb75c GetModuleHandleW 15056->15133 15057 7ff619bc3679 15120 7ff619bc377a 15057->15120 15207 7ff619bc3b00 15057->15207 15059 7ff619bc36ab 15059->15120 15210 7ff619bc6950 15059->15210 15061 7ff619bc36c7 15062 7ff619bc3713 15061->15062 15064 7ff619bc6950 61 API calls 15061->15064 15225 7ff619bc6ef0 15062->15225 15068 7ff619bc36e8 __std_exception_destroy 15064->15068 15065 7ff619bc3728 15229 7ff619bc19d0 15065->15229 15068->15062 15072 7ff619bc6ef0 58 API calls 15068->15072 15069 7ff619bc381d 15070 7ff619bc3848 15069->15070 15362 7ff619bc3260 15069->15362 15079 7ff619bc388b 15070->15079 15240 7ff619bc7990 15070->15240 15071 7ff619bc19d0 121 API calls 15075 7ff619bc375e 15071->15075 15072->15062 15077 7ff619bc37a0 15075->15077 15078 7ff619bc3762 15075->15078 15076 7ff619bc3868 15080 7ff619bc387e SetDllDirectoryW 15076->15080 15081 7ff619bc386d 15076->15081 15077->15069 15339 7ff619bc3c90 15077->15339 15326 7ff619bc2770 15078->15326 15254 7ff619bc5e20 15079->15254 15080->15079 15084 7ff619bc2770 59 API calls 15081->15084 15084->15120 15088 7ff619bc38e6 15095 7ff619bc39a6 15088->15095 15102 7ff619bc38f9 15088->15102 15089 7ff619bc37c2 15094 7ff619bc2770 59 API calls 15089->15094 15092 7ff619bc38a8 15092->15088 15376 7ff619bc5620 15092->15376 15093 7ff619bc37f0 15093->15069 15096 7ff619bc37f5 15093->15096 15094->15120 15258 7ff619bc30f0 15095->15258 15358 7ff619bcf1c8 15096->15358 15109 7ff619bc3945 15102->15109 15470 7ff619bc1b30 15102->15470 15103 7ff619bc38bd 15396 7ff619bc55b0 15103->15396 15104 7ff619bc38dc 15108 7ff619bc5870 FreeLibrary 15104->15108 15108->15088 15109->15120 15474 7ff619bc3090 15109->15474 15110 7ff619bc38c7 15110->15104 15112 7ff619bc38cb 15110->15112 15111 7ff619bc39db 15113 7ff619bc6950 61 API calls 15111->15113 15464 7ff619bc5c70 15112->15464 15118 7ff619bc39e7 15113->15118 15116 7ff619bc3981 15119 7ff619bc5870 FreeLibrary 15116->15119 15118->15120 15275 7ff619bc6f30 15118->15275 15119->15120 15120->15055 15129 7ff619bd8cff 15128->15129 15130 7ff619bd8d20 15128->15130 15129->15026 15131 7ff619bd9438 45 API calls 15130->15131 15132 7ff619bd8d25 15131->15132 15134 7ff619bcb76d 15133->15134 15134->15034 15136 7ff619bcb441 15135->15136 15137 7ff619bcaf50 15136->15137 15138 7ff619bcc9f8 __scrt_initialize_crt 7 API calls 15136->15138 15137->15024 15138->15137 15140 7ff619bcb5f2 _wfindfirst32i64 memcpy_s 15139->15140 15141 7ff619bcb611 RtlCaptureContext RtlLookupFunctionEntry 15140->15141 15142 7ff619bcb63a RtlVirtualUnwind 15141->15142 15143 7ff619bcb676 memcpy_s 15141->15143 15142->15143 15144 7ff619bcb6a8 IsDebuggerPresent SetUnhandledExceptionFilter UnhandledExceptionFilter 15143->15144 15145 7ff619bcb6fa _wfindfirst32i64 15144->15145 15145->15022 15147 7ff619bcb2be __scrt_dllmain_crt_thread_attach 15146->15147 15147->15040 15147->15041 15149 7ff619bcca00 15148->15149 15150 7ff619bcca0a 15148->15150 15154 7ff619bccd74 15149->15154 15150->15041 15155 7ff619bccd83 15154->15155 15156 7ff619bcca05 15154->15156 15162 7ff619bccfb0 15155->15162 15158 7ff619bccde0 15156->15158 15159 7ff619bcce0b 15158->15159 15160 7ff619bccdee DeleteCriticalSection 15159->15160 15161 7ff619bcce0f 15159->15161 15160->15159 15161->15150 15166 7ff619bcce18 15162->15166 15167 7ff619bccf32 TlsFree 15166->15167 15172 7ff619bcce5c __vcrt_FlsAlloc 15166->15172 15168 7ff619bcce8a LoadLibraryExW 15170 7ff619bccf01 15168->15170 15171 7ff619bcceab GetLastError 15168->15171 15169 7ff619bccf21 GetProcAddress 15169->15167 15170->15169 15173 7ff619bccf18 FreeLibrary 15170->15173 15171->15172 15172->15167 15172->15168 15172->15169 15174 7ff619bccecd LoadLibraryExW 15172->15174 15173->15169 15174->15170 15174->15172 15176 7ff619bcb72f GetStartupInfoW 15175->15176 15176->15028 15180 7ff619bc757f 15177->15180 15178 7ff619bc75d0 WideCharToMultiByte 15178->15180 15181 7ff619bc7678 15178->15181 15179 7ff619bc7587 __std_exception_destroy 15179->15049 15180->15178 15180->15179 15180->15181 15182 7ff619bc7626 WideCharToMultiByte 15180->15182 15515 7ff619bc2620 15181->15515 15182->15180 15182->15181 15187 7ff619bdef9c 15184->15187 15185 7ff619bdefef 15186 7ff619bda030 _invalid_parameter_noinfo 37 API calls 15185->15186 15190 7ff619bdf018 15186->15190 15187->15185 15188 7ff619bdf045 15187->15188 15866 7ff619bdee74 15188->15866 15190->15051 15192 7ff619bc1b05 15191->15192 15194 7ff619bc1b20 15192->15194 15874 7ff619bc24d0 15192->15874 15194->15120 15195 7ff619bc3b80 15194->15195 15196 7ff619bcacf0 15195->15196 15197 7ff619bc3b8c GetModuleFileNameW 15196->15197 15198 7ff619bc3bd2 15197->15198 15199 7ff619bc3bbb 15197->15199 15914 7ff619bc7aa0 15198->15914 15200 7ff619bc2620 57 API calls 15199->15200 15206 7ff619bc3bce 15200->15206 15203 7ff619bcacc0 _wfindfirst32i64 8 API calls 15205 7ff619bc3c0f 15203->15205 15204 7ff619bc2770 59 API calls 15204->15206 15205->15057 15206->15203 15208 7ff619bc1b30 49 API calls 15207->15208 15209 7ff619bc3b1d 15208->15209 15209->15059 15211 7ff619bc695a 15210->15211 15212 7ff619bc7990 57 API calls 15211->15212 15213 7ff619bc697c GetEnvironmentVariableW 15212->15213 15214 7ff619bc6994 ExpandEnvironmentStringsW 15213->15214 15215 7ff619bc69e6 15213->15215 15217 7ff619bc7aa0 59 API calls 15214->15217 15216 7ff619bcacc0 _wfindfirst32i64 8 API calls 15215->15216 15218 7ff619bc69f8 15216->15218 15219 7ff619bc69bc 15217->15219 15218->15061 15219->15215 15220 7ff619bc69c6 15219->15220 15925 7ff619bd946c 15220->15925 15223 7ff619bcacc0 _wfindfirst32i64 8 API calls 15224 7ff619bc69de 15223->15224 15224->15061 15226 7ff619bc7990 57 API calls 15225->15226 15227 7ff619bc6f07 SetEnvironmentVariableW 15226->15227 15228 7ff619bc6f1f __std_exception_destroy 15227->15228 15228->15065 15230 7ff619bc1b30 49 API calls 15229->15230 15231 7ff619bc1a00 15230->15231 15232 7ff619bc1b30 49 API calls 15231->15232 15239 7ff619bc1a7a 15231->15239 15233 7ff619bc1a22 15232->15233 15234 7ff619bc3b00 49 API calls 15233->15234 15233->15239 15235 7ff619bc1a3b 15234->15235 15932 7ff619bc17b0 15235->15932 15238 7ff619bcf1c8 74 API calls 15238->15239 15239->15069 15239->15071 15241 7ff619bc79b1 MultiByteToWideChar 15240->15241 15242 7ff619bc7a37 MultiByteToWideChar 15240->15242 15243 7ff619bc79d7 15241->15243 15244 7ff619bc79fc 15241->15244 15245 7ff619bc7a7f 15242->15245 15246 7ff619bc7a5a 15242->15246 15248 7ff619bc2620 55 API calls 15243->15248 15244->15242 15251 7ff619bc7a12 15244->15251 15245->15076 15247 7ff619bc2620 55 API calls 15246->15247 15249 7ff619bc7a6d 15247->15249 15250 7ff619bc79ea 15248->15250 15249->15076 15250->15076 15252 7ff619bc2620 55 API calls 15251->15252 15253 7ff619bc7a25 15252->15253 15253->15076 15255 7ff619bc5e35 15254->15255 15256 7ff619bc3890 15255->15256 15257 7ff619bc24d0 59 API calls 15255->15257 15256->15088 15366 7ff619bc5ac0 15256->15366 15257->15256 15259 7ff619bc31a4 15258->15259 15265 7ff619bc3163 15258->15265 15260 7ff619bc31e3 15259->15260 15261 7ff619bc1ab0 74 API calls 15259->15261 15262 7ff619bcacc0 _wfindfirst32i64 8 API calls 15260->15262 15261->15259 15263 7ff619bc31f5 15262->15263 15263->15120 15268 7ff619bc6e80 15263->15268 15265->15259 16005 7ff619bc1440 15265->16005 16039 7ff619bc2990 15265->16039 16093 7ff619bc1780 15265->16093 15269 7ff619bc7990 57 API calls 15268->15269 15270 7ff619bc6e9f 15269->15270 15271 7ff619bc7990 57 API calls 15270->15271 15272 7ff619bc6eaf 15271->15272 15273 7ff619bd6444 38 API calls 15272->15273 15274 7ff619bc6ebd __std_exception_destroy 15273->15274 15274->15111 15276 7ff619bc6f40 15275->15276 15277 7ff619bc7990 57 API calls 15276->15277 15278 7ff619bc6f71 15277->15278 16952 7ff619bd70f8 15278->16952 15281 7ff619bd70f8 14 API calls 15282 7ff619bc6f8a 15281->15282 15283 7ff619bd70f8 14 API calls 15282->15283 15284 7ff619bc6f94 15283->15284 15285 7ff619bd70f8 14 API calls 15284->15285 15286 7ff619bc6f9e GetStartupInfoW 15285->15286 15287 7ff619bc6feb 15286->15287 16969 7ff619bd94e4 15287->16969 15327 7ff619bc2790 15326->15327 15328 7ff619bd3994 49 API calls 15327->15328 15329 7ff619bc27dd memcpy_s 15328->15329 15330 7ff619bc7990 57 API calls 15329->15330 15331 7ff619bc280a 15330->15331 15332 7ff619bc280f 15331->15332 15333 7ff619bc2849 MessageBoxA 15331->15333 15334 7ff619bc7990 57 API calls 15332->15334 15335 7ff619bc2863 15333->15335 15336 7ff619bc2829 MessageBoxW 15334->15336 15337 7ff619bcacc0 _wfindfirst32i64 8 API calls 15335->15337 15336->15335 15338 7ff619bc2873 15337->15338 15338->15120 15340 7ff619bc3c9c 15339->15340 15341 7ff619bc7990 57 API calls 15340->15341 15342 7ff619bc3cc7 15341->15342 15343 7ff619bc7990 57 API calls 15342->15343 15344 7ff619bc3cda 15343->15344 17026 7ff619bd5278 15344->17026 15347 7ff619bcacc0 _wfindfirst32i64 8 API calls 15348 7ff619bc37ba 15347->15348 15348->15089 15349 7ff619bc7160 15348->15349 15350 7ff619bc7184 15349->15350 15351 7ff619bcf830 73 API calls 15350->15351 15356 7ff619bc725b __std_exception_destroy 15350->15356 15352 7ff619bc719e 15351->15352 15352->15356 17405 7ff619bd7c94 15352->17405 15354 7ff619bcf830 73 API calls 15357 7ff619bc71b3 15354->15357 15355 7ff619bcf518 _fread_nolock 53 API calls 15355->15357 15356->15093 15357->15354 15357->15355 15357->15356 15359 7ff619bcf1f8 15358->15359 17420 7ff619bcefa8 15359->17420 15361 7ff619bcf211 15361->15089 15363 7ff619bc3277 15362->15363 15364 7ff619bc32a0 15362->15364 15363->15364 15365 7ff619bc1780 59 API calls 15363->15365 15364->15070 15365->15363 15367 7ff619bc5b11 15366->15367 15371 7ff619bc5ae4 15366->15371 15375 7ff619bc5b07 memcpy_s __std_exception_destroy 15367->15375 17457 7ff619bc3d10 15367->17457 15368 7ff619bc5b0c 17431 7ff619bc12b0 15368->17431 15369 7ff619bc1780 59 API calls 15369->15371 15371->15367 15371->15368 15371->15369 15371->15375 15373 7ff619bc5b77 15374 7ff619bc2770 59 API calls 15373->15374 15373->15375 15374->15375 15375->15092 15382 7ff619bc563a memcpy_s 15376->15382 15378 7ff619bc575f 15380 7ff619bc3d10 49 API calls 15378->15380 15379 7ff619bc577b 15381 7ff619bc2770 59 API calls 15379->15381 15383 7ff619bc57d8 15380->15383 15387 7ff619bc5771 __std_exception_destroy 15381->15387 15382->15378 15382->15379 15382->15382 15384 7ff619bc3d10 49 API calls 15382->15384 15385 7ff619bc5740 15382->15385 15392 7ff619bc1440 161 API calls 15382->15392 15394 7ff619bc5761 15382->15394 17460 7ff619bc1650 15382->17460 15386 7ff619bc3d10 49 API calls 15383->15386 15384->15382 15385->15378 15388 7ff619bc3d10 49 API calls 15385->15388 15391 7ff619bc5808 15386->15391 15389 7ff619bcacc0 _wfindfirst32i64 8 API calls 15387->15389 15388->15378 15390 7ff619bc38b9 15389->15390 15390->15103 15390->15104 15393 7ff619bc3d10 49 API calls 15391->15393 15392->15382 15393->15387 15395 7ff619bc2770 59 API calls 15394->15395 15395->15387 17465 7ff619bc7110 15396->17465 15398 7ff619bc55c2 15399 7ff619bc7110 58 API calls 15398->15399 15400 7ff619bc55d5 15399->15400 15401 7ff619bc55fa 15400->15401 15402 7ff619bc55ed GetProcAddress 15400->15402 15403 7ff619bc2770 59 API calls 15401->15403 15406 7ff619bc5f7c GetProcAddress 15402->15406 15414 7ff619bc5f59 15402->15414 15405 7ff619bc5606 15403->15405 15405->15110 15407 7ff619bc5fa1 GetProcAddress 15406->15407 15406->15414 15408 7ff619bc5fc6 GetProcAddress 15407->15408 15407->15414 15410 7ff619bc5fee GetProcAddress 15408->15410 15408->15414 15409 7ff619bc2620 57 API calls 15411 7ff619bc5f6c 15409->15411 15412 7ff619bc6016 GetProcAddress 15410->15412 15410->15414 15411->15110 15413 7ff619bc603e GetProcAddress 15412->15413 15412->15414 15415 7ff619bc6066 GetProcAddress 15413->15415 15416 7ff619bc605a 15413->15416 15414->15409 15417 7ff619bc608e GetProcAddress 15415->15417 15418 7ff619bc6082 15415->15418 15416->15415 15419 7ff619bc60b6 GetProcAddress 15417->15419 15420 7ff619bc60aa 15417->15420 15418->15417 15421 7ff619bc60de GetProcAddress 15419->15421 15422 7ff619bc60d2 15419->15422 15420->15419 15423 7ff619bc6106 GetProcAddress 15421->15423 15424 7ff619bc60fa 15421->15424 15422->15421 15425 7ff619bc612e GetProcAddress 15423->15425 15426 7ff619bc6122 15423->15426 15424->15423 15427 7ff619bc6156 GetProcAddress 15425->15427 15428 7ff619bc614a 15425->15428 15426->15425 15428->15427 15465 7ff619bc5c94 15464->15465 15466 7ff619bc2770 59 API calls 15465->15466 15469 7ff619bc38da 15465->15469 15467 7ff619bc5cee 15466->15467 15468 7ff619bc5870 FreeLibrary 15467->15468 15468->15469 15469->15088 15471 7ff619bc1b55 15470->15471 15472 7ff619bd3994 49 API calls 15471->15472 15473 7ff619bc1b78 15472->15473 15473->15109 17469 7ff619bc4940 15474->17469 15477 7ff619bc30dd 15477->15116 15479 7ff619bc30b4 15479->15477 17525 7ff619bc46c0 15479->17525 15481 7ff619bc30c0 15481->15477 17535 7ff619bc4820 15481->17535 15483 7ff619bc30cc 15483->15477 15484 7ff619bc3307 15483->15484 15485 7ff619bc331c 15483->15485 15486 7ff619bc2770 59 API calls 15484->15486 15487 7ff619bc333c 15485->15487 15498 7ff619bc3352 __std_exception_destroy 15485->15498 15510 7ff619bc3313 __std_exception_destroy 15486->15510 15491 7ff619bc12b0 122 API calls 15491->15498 15492 7ff619bc1780 59 API calls 15492->15498 15493 7ff619bc1b30 49 API calls 15493->15498 15494 7ff619bc35eb 15496 7ff619bc35c5 15498->15491 15498->15492 15498->15493 15498->15494 15498->15496 15499 7ff619bc34b6 15498->15499 15498->15510 15534 7ff619bcacf0 15515->15534 15518 7ff619bc2669 15536 7ff619bd3994 15518->15536 15523 7ff619bc1b30 49 API calls 15524 7ff619bc26c8 memcpy_s 15523->15524 15525 7ff619bc7990 54 API calls 15524->15525 15526 7ff619bc26f5 15525->15526 15527 7ff619bc2734 MessageBoxA 15526->15527 15528 7ff619bc26fa 15526->15528 15530 7ff619bc274e 15527->15530 15529 7ff619bc7990 54 API calls 15528->15529 15531 7ff619bc2714 MessageBoxW 15529->15531 15532 7ff619bcacc0 _wfindfirst32i64 8 API calls 15530->15532 15531->15530 15533 7ff619bc275e 15532->15533 15533->15179 15535 7ff619bc263c GetLastError 15534->15535 15535->15518 15540 7ff619bd39ee 15536->15540 15537 7ff619bd3a13 15538 7ff619bda030 _invalid_parameter_noinfo 37 API calls 15537->15538 15542 7ff619bd3a3d 15538->15542 15539 7ff619bd3a4f 15566 7ff619bd1ca0 15539->15566 15540->15537 15540->15539 15544 7ff619bcacc0 _wfindfirst32i64 8 API calls 15542->15544 15543 7ff619bd3b2c 15545 7ff619bda168 __free_lconv_mon 11 API calls 15543->15545 15547 7ff619bc2699 15544->15547 15545->15542 15554 7ff619bc7410 15547->15554 15548 7ff619bd3b50 15548->15543 15549 7ff619bd3b5a 15548->15549 15552 7ff619bda168 __free_lconv_mon 11 API calls 15549->15552 15550 7ff619bda168 __free_lconv_mon 11 API calls 15550->15542 15551 7ff619bd3af8 15551->15543 15553 7ff619bd3b01 15551->15553 15552->15542 15553->15550 15555 7ff619bc741c 15554->15555 15556 7ff619bc7437 GetLastError 15555->15556 15557 7ff619bc743d FormatMessageW 15555->15557 15556->15557 15558 7ff619bc7470 15557->15558 15559 7ff619bc748c WideCharToMultiByte 15557->15559 15562 7ff619bc2620 54 API calls 15558->15562 15560 7ff619bc7483 15559->15560 15561 7ff619bc74c6 15559->15561 15564 7ff619bcacc0 _wfindfirst32i64 8 API calls 15560->15564 15563 7ff619bc2620 54 API calls 15561->15563 15562->15560 15563->15560 15565 7ff619bc26a0 15564->15565 15565->15523 15567 7ff619bd1cd7 15566->15567 15568 7ff619bd1cc7 15566->15568 15569 7ff619bd1cdd 15567->15569 15578 7ff619bd1d0d 15567->15578 15570 7ff619bda030 _invalid_parameter_noinfo 37 API calls 15568->15570 15571 7ff619bda030 _invalid_parameter_noinfo 37 API calls 15569->15571 15572 7ff619bd1d05 15570->15572 15571->15572 15572->15543 15572->15548 15572->15551 15572->15553 15575 7ff619bd1fc6 15577 7ff619bda030 _invalid_parameter_noinfo 37 API calls 15575->15577 15577->15568 15578->15568 15578->15572 15578->15575 15580 7ff619bd2618 15578->15580 15605 7ff619bd22e8 15578->15605 15634 7ff619bd1b80 15578->15634 15637 7ff619bd37d0 15578->15637 15581 7ff619bd265e 15580->15581 15582 7ff619bd26bb 15580->15582 15583 7ff619bd271e 15581->15583 15595 7ff619bd2664 15581->15595 15584 7ff619bd26bf 15582->15584 15585 7ff619bd272b 15582->15585 15665 7ff619bd0c38 15583->15665 15584->15583 15588 7ff619bd2717 15584->15588 15589 7ff619bd26c7 15584->15589 15672 7ff619bd2f34 15585->15672 15587 7ff619bd2696 15604 7ff619bd2734 15587->15604 15643 7ff619bd33e0 15587->15643 15661 7ff619bd3568 15588->15661 15592 7ff619bd26cb 15589->15592 15593 7ff619bd26f7 15589->15593 15592->15583 15601 7ff619bd26b1 15592->15601 15603 7ff619bd26a5 15592->15603 15654 7ff619bd0864 15593->15654 15595->15585 15595->15587 15598 7ff619bd268a 15595->15598 15595->15601 15595->15603 15595->15604 15597 7ff619bcacc0 _wfindfirst32i64 8 API calls 15599 7ff619bd29c6 15597->15599 15598->15585 15598->15587 15598->15603 15599->15578 15601->15604 15647 7ff619bd100c 15601->15647 15603->15604 15682 7ff619bddda0 15603->15682 15604->15597 15606 7ff619bd22f3 15605->15606 15607 7ff619bd2309 15605->15607 15609 7ff619bd265e 15606->15609 15610 7ff619bd26bb 15606->15610 15615 7ff619bd2347 15606->15615 15608 7ff619bda030 _invalid_parameter_noinfo 37 API calls 15607->15608 15607->15615 15608->15615 15611 7ff619bd271e 15609->15611 15624 7ff619bd2664 15609->15624 15612 7ff619bd26bf 15610->15612 15613 7ff619bd272b 15610->15613 15619 7ff619bd0c38 38 API calls 15611->15619 15612->15611 15617 7ff619bd2717 15612->15617 15618 7ff619bd26c7 15612->15618 15614 7ff619bd2f34 47 API calls 15613->15614 15632 7ff619bd26a5 15614->15632 15615->15578 15616 7ff619bd2696 15623 7ff619bd33e0 47 API calls 15616->15623 15633 7ff619bd2734 15616->15633 15620 7ff619bd3568 37 API calls 15617->15620 15621 7ff619bd26cb 15618->15621 15622 7ff619bd26f7 15618->15622 15619->15632 15620->15632 15621->15611 15630 7ff619bd26b1 15621->15630 15621->15632 15625 7ff619bd0864 38 API calls 15622->15625 15623->15632 15624->15613 15624->15616 15627 7ff619bd268a 15624->15627 15624->15630 15624->15632 15624->15633 15625->15632 15626 7ff619bcacc0 _wfindfirst32i64 8 API calls 15628 7ff619bd29c6 15626->15628 15627->15613 15627->15616 15627->15632 15628->15578 15629 7ff619bd100c 38 API calls 15629->15632 15630->15629 15630->15633 15631 7ff619bddda0 47 API calls 15631->15632 15632->15631 15632->15633 15633->15626 15825 7ff619bcfe5c 15634->15825 15638 7ff619bd37e7 15637->15638 15842 7ff619bdcee4 15638->15842 15644 7ff619bd33f4 15643->15644 15646 7ff619bd3453 15643->15646 15645 7ff619bddda0 47 API calls 15644->15645 15644->15646 15645->15646 15646->15603 15648 7ff619bd1032 15647->15648 15649 7ff619bd105c 15648->15649 15651 7ff619bd1113 15648->15651 15653 7ff619bd1098 15649->15653 15692 7ff619bcfcc8 15649->15692 15652 7ff619bda030 _invalid_parameter_noinfo 37 API calls 15651->15652 15652->15653 15653->15603 15655 7ff619bd088a 15654->15655 15656 7ff619bd08b4 15655->15656 15658 7ff619bd096b 15655->15658 15657 7ff619bcfcc8 12 API calls 15656->15657 15660 7ff619bd08f0 15656->15660 15657->15660 15659 7ff619bda030 _invalid_parameter_noinfo 37 API calls 15658->15659 15659->15660 15660->15603 15664 7ff619bd3587 15661->15664 15662 7ff619bda030 _invalid_parameter_noinfo 37 API calls 15663 7ff619bd35b8 15662->15663 15663->15603 15664->15662 15664->15663 15666 7ff619bd0c5e 15665->15666 15667 7ff619bd0c88 15666->15667 15669 7ff619bd0d3f 15666->15669 15668 7ff619bcfcc8 12 API calls 15667->15668 15671 7ff619bd0cc4 15667->15671 15668->15671 15670 7ff619bda030 _invalid_parameter_noinfo 37 API calls 15669->15670 15670->15671 15671->15603 15673 7ff619bd2f56 15672->15673 15674 7ff619bcfcc8 12 API calls 15673->15674 15675 7ff619bd2fa0 15674->15675 15700 7ff619bddab8 15675->15700 15678 7ff619bd37d0 45 API calls 15679 7ff619bd308c 15678->15679 15680 7ff619bd37d0 45 API calls 15679->15680 15681 7ff619bd3115 15679->15681 15680->15681 15681->15603 15684 7ff619bdddc8 15682->15684 15683 7ff619bdde0d 15688 7ff619bdddcd memcpy_s 15683->15688 15691 7ff619bdddf6 memcpy_s 15683->15691 15822 7ff619bdf424 15683->15822 15684->15683 15685 7ff619bd37d0 45 API calls 15684->15685 15684->15688 15684->15691 15685->15683 15686 7ff619bda030 _invalid_parameter_noinfo 37 API calls 15686->15688 15688->15603 15691->15686 15691->15688 15693 7ff619bcfcff 15692->15693 15699 7ff619bcfcee 15692->15699 15694 7ff619bdce50 _fread_nolock 12 API calls 15693->15694 15693->15699 15695 7ff619bcfd2c 15694->15695 15696 7ff619bcfd40 15695->15696 15697 7ff619bda168 __free_lconv_mon 11 API calls 15695->15697 15698 7ff619bda168 __free_lconv_mon 11 API calls 15696->15698 15697->15696 15698->15699 15699->15653 15701 7ff619bddad5 15700->15701 15702 7ff619bddb08 15700->15702 15703 7ff619bda030 _invalid_parameter_noinfo 37 API calls 15701->15703 15702->15701 15705 7ff619bddb3a 15702->15705 15713 7ff619bd306a 15703->15713 15704 7ff619bddc4d 15706 7ff619bddd3f 15704->15706 15708 7ff619bddd05 15704->15708 15710 7ff619bddcd4 15704->15710 15712 7ff619bddc97 15704->15712 15714 7ff619bddc8d 15704->15714 15705->15704 15716 7ff619bddb82 15705->15716 15755 7ff619bdcf88 15706->15755 15748 7ff619bdd33c 15708->15748 15741 7ff619bdd61c 15710->15741 15731 7ff619bdd84c 15712->15731 15713->15678 15713->15679 15714->15708 15717 7ff619bddc92 15714->15717 15716->15713 15716->15716 15722 7ff619bd950c 15716->15722 15717->15710 15717->15712 15720 7ff619bda120 _wfindfirst32i64 17 API calls 15721 7ff619bddd9c 15720->15721 15723 7ff619bd9523 15722->15723 15724 7ff619bd9519 15722->15724 15725 7ff619bd41f4 _get_daylight 11 API calls 15723->15725 15724->15723 15729 7ff619bd953e 15724->15729 15726 7ff619bd952a 15725->15726 15727 7ff619bda100 _invalid_parameter_noinfo 37 API calls 15726->15727 15728 7ff619bd9536 15727->15728 15728->15713 15728->15720 15729->15728 15730 7ff619bd41f4 _get_daylight 11 API calls 15729->15730 15730->15726 15764 7ff619be314c 15731->15764 15735 7ff619bdd8f4 15736 7ff619bdd949 15735->15736 15738 7ff619bdd914 15735->15738 15740 7ff619bdd8f8 15735->15740 15811 7ff619bdd438 15736->15811 15738->15738 15807 7ff619bdd6f4 15738->15807 15740->15713 15742 7ff619be314c 38 API calls 15741->15742 15743 7ff619bdd666 15742->15743 15744 7ff619be2b38 37 API calls 15743->15744 15745 7ff619bdd6b6 15744->15745 15746 7ff619bdd6ba 15745->15746 15747 7ff619bdd6f4 45 API calls 15745->15747 15746->15713 15747->15746 15749 7ff619be314c 38 API calls 15748->15749 15750 7ff619bdd387 15749->15750 15751 7ff619be2b38 37 API calls 15750->15751 15752 7ff619bdd3df 15751->15752 15753 7ff619bdd3e3 15752->15753 15754 7ff619bdd438 45 API calls 15752->15754 15753->15713 15754->15753 15756 7ff619bdd000 15755->15756 15757 7ff619bdcfcd 15755->15757 15759 7ff619bdd01b 15756->15759 15761 7ff619bdd09f 15756->15761 15758 7ff619bda030 _invalid_parameter_noinfo 37 API calls 15757->15758 15763 7ff619bdcff9 memcpy_s 15758->15763 15760 7ff619bdd33c 46 API calls 15759->15760 15760->15763 15762 7ff619bd37d0 45 API calls 15761->15762 15761->15763 15762->15763 15763->15713 15765 7ff619be31a0 fegetenv 15764->15765 15766 7ff619be703c 37 API calls 15765->15766 15770 7ff619be31f4 15766->15770 15767 7ff619be32e3 15768 7ff619be7220 20 API calls 15767->15768 15786 7ff619be334e memcpy_s 15768->15786 15769 7ff619bd950c __std_exception_copy 37 API calls 15777 7ff619be32a1 15769->15777 15770->15767 15771 7ff619be32c0 15770->15771 15775 7ff619be3210 15770->15775 15773 7ff619bd950c __std_exception_copy 37 API calls 15771->15773 15772 7ff619be4376 15776 7ff619bda120 _wfindfirst32i64 17 API calls 15772->15776 15773->15777 15774 7ff619be3223 15774->15769 15775->15767 15775->15774 15778 7ff619be438b 15776->15778 15777->15772 15788 7ff619be32a9 15777->15788 15779 7ff619bcacc0 _wfindfirst32i64 8 API calls 15780 7ff619bdd899 15779->15780 15803 7ff619be2b38 15780->15803 15781 7ff619be36f7 memcpy_s 15782 7ff619be3a38 15783 7ff619be2cc0 37 API calls 15782->15783 15791 7ff619be414b 15783->15791 15784 7ff619be39e3 15784->15782 15787 7ff619be438c memcpy_s 37 API calls 15784->15787 15785 7ff619be338f memcpy_s 15796 7ff619be3cd1 memcpy_s 15785->15796 15800 7ff619be37eb memcpy_s 15785->15800 15786->15781 15786->15785 15789 7ff619bd41f4 _get_daylight 11 API calls 15786->15789 15787->15782 15788->15779 15790 7ff619be37c8 15789->15790 15792 7ff619bda100 _invalid_parameter_noinfo 37 API calls 15790->15792 15793 7ff619be438c memcpy_s 37 API calls 15791->15793 15802 7ff619be41a6 15791->15802 15792->15785 15793->15802 15794 7ff619bd41f4 11 API calls _get_daylight 15794->15796 15795 7ff619bd41f4 11 API calls _get_daylight 15795->15800 15796->15782 15796->15784 15796->15794 15798 7ff619bda100 37 API calls _invalid_parameter_noinfo 15796->15798 15797 7ff619be2cc0 37 API calls 15797->15802 15798->15796 15799 7ff619bda100 37 API calls _invalid_parameter_noinfo 15799->15800 15800->15784 15800->15795 15800->15799 15801 7ff619be438c memcpy_s 37 API calls 15801->15802 15802->15788 15802->15797 15802->15801 15804 7ff619be2b60 15803->15804 15805 7ff619bda030 _invalid_parameter_noinfo 37 API calls 15804->15805 15806 7ff619be2b8e memcpy_s 15804->15806 15805->15806 15806->15735 15808 7ff619bdd720 memcpy_s 15807->15808 15809 7ff619bd37d0 45 API calls 15808->15809 15810 7ff619bdd7da memcpy_s 15808->15810 15809->15810 15810->15740 15812 7ff619bdd473 15811->15812 15817 7ff619bdd4c0 memcpy_s 15811->15817 15813 7ff619bda030 _invalid_parameter_noinfo 37 API calls 15812->15813 15814 7ff619bdd49f 15813->15814 15814->15740 15815 7ff619bdd52b 15816 7ff619bd950c __std_exception_copy 37 API calls 15815->15816 15821 7ff619bdd56d memcpy_s 15816->15821 15817->15815 15818 7ff619bd37d0 45 API calls 15817->15818 15818->15815 15819 7ff619bda120 _wfindfirst32i64 17 API calls 15820 7ff619bdd618 15819->15820 15821->15819 15824 7ff619bdf447 WideCharToMultiByte 15822->15824 15826 7ff619bcfe8a 15825->15826 15827 7ff619bcfe9c 15825->15827 15828 7ff619bd41f4 _get_daylight 11 API calls 15826->15828 15830 7ff619bcfea9 15827->15830 15833 7ff619bcfee6 15827->15833 15829 7ff619bcfe8f 15828->15829 15831 7ff619bda100 _invalid_parameter_noinfo 37 API calls 15829->15831 15832 7ff619bda030 _invalid_parameter_noinfo 37 API calls 15830->15832 15840 7ff619bcfe9a 15831->15840 15832->15840 15834 7ff619bcff92 15833->15834 15835 7ff619bd41f4 _get_daylight 11 API calls 15833->15835 15836 7ff619bd41f4 _get_daylight 11 API calls 15834->15836 15834->15840 15837 7ff619bcff87 15835->15837 15839 7ff619bd003f 15836->15839 15838 7ff619bda100 _invalid_parameter_noinfo 37 API calls 15837->15838 15838->15834 15841 7ff619bda100 _invalid_parameter_noinfo 37 API calls 15839->15841 15840->15578 15841->15840 15843 7ff619bd380f 15842->15843 15844 7ff619bdcefd 15842->15844 15846 7ff619bdcf50 15843->15846 15844->15843 15850 7ff619be2738 15844->15850 15847 7ff619bd381f 15846->15847 15848 7ff619bdcf69 15846->15848 15847->15578 15848->15847 15863 7ff619be1ac0 15848->15863 15851 7ff619bda960 __GetCurrentState 45 API calls 15850->15851 15852 7ff619be2747 15851->15852 15853 7ff619be2792 15852->15853 15862 7ff619bdfac8 EnterCriticalSection 15852->15862 15853->15843 15864 7ff619bda960 __GetCurrentState 45 API calls 15863->15864 15865 7ff619be1ac9 15864->15865 15873 7ff619bd409c EnterCriticalSection 15866->15873 15875 7ff619bc24ec 15874->15875 15876 7ff619bd3994 49 API calls 15875->15876 15877 7ff619bc253f 15876->15877 15878 7ff619bd41f4 _get_daylight 11 API calls 15877->15878 15879 7ff619bc2544 15878->15879 15893 7ff619bd4214 15879->15893 15882 7ff619bc1b30 49 API calls 15883 7ff619bc2573 memcpy_s 15882->15883 15884 7ff619bc7990 57 API calls 15883->15884 15885 7ff619bc25a0 15884->15885 15886 7ff619bc25df MessageBoxA 15885->15886 15887 7ff619bc25a5 15885->15887 15889 7ff619bc25f9 15886->15889 15888 7ff619bc7990 57 API calls 15887->15888 15890 7ff619bc25bf MessageBoxW 15888->15890 15891 7ff619bcacc0 _wfindfirst32i64 8 API calls 15889->15891 15890->15889 15892 7ff619bc2609 15891->15892 15892->15194 15894 7ff619bdaad8 _get_daylight 11 API calls 15893->15894 15895 7ff619bd422b 15894->15895 15896 7ff619bc254b 15895->15896 15897 7ff619bd426b 15895->15897 15898 7ff619bde0e0 _get_daylight 11 API calls 15895->15898 15896->15882 15897->15896 15905 7ff619bde7b8 15897->15905 15899 7ff619bd4260 15898->15899 15901 7ff619bda168 __free_lconv_mon 11 API calls 15899->15901 15901->15897 15903 7ff619bda120 _wfindfirst32i64 17 API calls 15904 7ff619bd42b0 15903->15904 15908 7ff619bde7d5 15905->15908 15906 7ff619bde7da 15907 7ff619bd41f4 _get_daylight 11 API calls 15906->15907 15910 7ff619bd4291 15906->15910 15913 7ff619bde7e4 15907->15913 15908->15906 15908->15910 15911 7ff619bde824 15908->15911 15909 7ff619bda100 _invalid_parameter_noinfo 37 API calls 15909->15910 15910->15896 15910->15903 15911->15910 15912 7ff619bd41f4 _get_daylight 11 API calls 15911->15912 15912->15913 15913->15909 15915 7ff619bc7ac4 WideCharToMultiByte 15914->15915 15916 7ff619bc7b32 WideCharToMultiByte 15914->15916 15918 7ff619bc7aee 15915->15918 15919 7ff619bc7b05 15915->15919 15917 7ff619bc7b5f 15916->15917 15921 7ff619bc3be5 15916->15921 15920 7ff619bc2620 57 API calls 15917->15920 15922 7ff619bc2620 57 API calls 15918->15922 15919->15916 15923 7ff619bc7b1b 15919->15923 15920->15921 15921->15204 15921->15206 15922->15921 15924 7ff619bc2620 57 API calls 15923->15924 15924->15921 15926 7ff619bc69ce 15925->15926 15927 7ff619bd9483 15925->15927 15926->15223 15927->15926 15928 7ff619bd950c __std_exception_copy 37 API calls 15927->15928 15929 7ff619bd94b0 15928->15929 15929->15926 15930 7ff619bda120 _wfindfirst32i64 17 API calls 15929->15930 15931 7ff619bd94e0 15930->15931 15933 7ff619bc17e4 15932->15933 15934 7ff619bc17d4 15932->15934 15936 7ff619bc7160 83 API calls 15933->15936 15965 7ff619bc1842 15933->15965 15935 7ff619bc3c90 116 API calls 15934->15935 15935->15933 15937 7ff619bc1815 15936->15937 15937->15965 15966 7ff619bcf830 15937->15966 15939 7ff619bc182b 15941 7ff619bc182f 15939->15941 15942 7ff619bc184c 15939->15942 15940 7ff619bcacc0 _wfindfirst32i64 8 API calls 15943 7ff619bc19c0 15940->15943 15944 7ff619bc24d0 59 API calls 15941->15944 15970 7ff619bcf518 15942->15970 15943->15238 15943->15239 15944->15965 15947 7ff619bcf830 73 API calls 15949 7ff619bc18d1 15947->15949 15948 7ff619bc24d0 59 API calls 15948->15965 15950 7ff619bc18fe 15949->15950 15951 7ff619bc18e3 15949->15951 15953 7ff619bcf518 _fread_nolock 53 API calls 15950->15953 15952 7ff619bc24d0 59 API calls 15951->15952 15952->15965 15954 7ff619bc1913 15953->15954 15955 7ff619bc1925 15954->15955 15956 7ff619bc1867 15954->15956 15973 7ff619bcf28c 15955->15973 15956->15948 15959 7ff619bc193d 15961 7ff619bc2770 59 API calls 15959->15961 15960 7ff619bc1993 15963 7ff619bcf1c8 74 API calls 15960->15963 15960->15965 15961->15965 15962 7ff619bc1950 15962->15960 15964 7ff619bc2770 59 API calls 15962->15964 15963->15965 15964->15960 15965->15940 15967 7ff619bcf860 15966->15967 15979 7ff619bcf5e0 15967->15979 15969 7ff619bcf879 15969->15939 15991 7ff619bcf538 15970->15991 15974 7ff619bcf295 15973->15974 15975 7ff619bc1939 15973->15975 15976 7ff619bd41f4 _get_daylight 11 API calls 15974->15976 15975->15959 15975->15962 15977 7ff619bcf29a 15976->15977 15978 7ff619bda100 _invalid_parameter_noinfo 37 API calls 15977->15978 15978->15975 15980 7ff619bcf64a 15979->15980 15981 7ff619bcf60a 15979->15981 15980->15981 15983 7ff619bcf64f 15980->15983 15982 7ff619bda030 _invalid_parameter_noinfo 37 API calls 15981->15982 15989 7ff619bcf631 15982->15989 15990 7ff619bd409c EnterCriticalSection 15983->15990 15989->15969 15992 7ff619bcf562 15991->15992 16003 7ff619bc1861 15991->16003 15993 7ff619bcf5ae 15992->15993 15994 7ff619bcf571 memcpy_s 15992->15994 15992->16003 16004 7ff619bd409c EnterCriticalSection 15993->16004 15996 7ff619bd41f4 _get_daylight 11 API calls 15994->15996 15998 7ff619bcf586 15996->15998 16000 7ff619bda100 _invalid_parameter_noinfo 37 API calls 15998->16000 16000->16003 16003->15947 16003->15956 16097 7ff619bc66e0 16005->16097 16007 7ff619bc1454 16008 7ff619bc1459 16007->16008 16106 7ff619bc6a00 16007->16106 16008->15265 16011 7ff619bc14a7 16014 7ff619bc14e0 16011->16014 16017 7ff619bc3c90 116 API calls 16011->16017 16012 7ff619bc1487 16013 7ff619bc24d0 59 API calls 16012->16013 16016 7ff619bc149d 16013->16016 16015 7ff619bcf830 73 API calls 16014->16015 16019 7ff619bc14f2 16015->16019 16016->15265 16018 7ff619bc14bf 16017->16018 16018->16014 16020 7ff619bc14c7 16018->16020 16021 7ff619bc1516 16019->16021 16022 7ff619bc14f6 16019->16022 16023 7ff619bc2770 59 API calls 16020->16023 16025 7ff619bc1534 16021->16025 16026 7ff619bc151c 16021->16026 16024 7ff619bc24d0 59 API calls 16022->16024 16033 7ff619bc14d6 __std_exception_destroy 16023->16033 16024->16033 16028 7ff619bc1556 16025->16028 16038 7ff619bc1575 16025->16038 16126 7ff619bc1050 16026->16126 16030 7ff619bc24d0 59 API calls 16028->16030 16029 7ff619bc1624 16032 7ff619bcf1c8 74 API calls 16029->16032 16030->16033 16031 7ff619bcf1c8 74 API calls 16031->16029 16032->16016 16033->16029 16033->16031 16034 7ff619bcf518 _fread_nolock 53 API calls 16034->16038 16035 7ff619bc15d5 16037 7ff619bc24d0 59 API calls 16035->16037 16037->16033 16038->16033 16038->16034 16038->16035 16144 7ff619bcfc24 16038->16144 16040 7ff619bc29a6 16039->16040 16041 7ff619bc1b30 49 API calls 16040->16041 16043 7ff619bc29db 16041->16043 16042 7ff619bc2dc9 16043->16042 16044 7ff619bc3b00 49 API calls 16043->16044 16045 7ff619bc2a57 16044->16045 16710 7ff619bc2ff0 16045->16710 16048 7ff619bc2ae7 16050 7ff619bc66e0 98 API calls 16048->16050 16049 7ff619bc2ff0 75 API calls 16051 7ff619bc2ae3 16049->16051 16052 7ff619bc2aef 16050->16052 16051->16048 16053 7ff619bc2b55 16051->16053 16054 7ff619bc2b0c 16052->16054 16718 7ff619bc65c0 16052->16718 16055 7ff619bc2ff0 75 API calls 16053->16055 16058 7ff619bc2770 59 API calls 16054->16058 16060 7ff619bc2b26 16054->16060 16057 7ff619bc2b7e 16055->16057 16059 7ff619bc2bd8 16057->16059 16061 7ff619bc2ff0 75 API calls 16057->16061 16058->16060 16059->16054 16062 7ff619bc66e0 98 API calls 16059->16062 16063 7ff619bcacc0 _wfindfirst32i64 8 API calls 16060->16063 16064 7ff619bc2bab 16061->16064 16067 7ff619bc2be8 16062->16067 16065 7ff619bc2b4a 16063->16065 16064->16059 16066 7ff619bc2ff0 75 API calls 16064->16066 16065->15265 16066->16059 16067->16054 16068 7ff619bc1af0 59 API calls 16067->16068 16070 7ff619bc2d06 16067->16070 16069 7ff619bc2c3f 16068->16069 16069->16054 16071 7ff619bc1b30 49 API calls 16069->16071 16070->16054 16087 7ff619bc2d1e 16070->16087 16072 7ff619bc2c67 16071->16072 16073 7ff619bc2da2 16072->16073 16074 7ff619bc1b30 49 API calls 16072->16074 16075 7ff619bc2770 59 API calls 16073->16075 16076 7ff619bc2c94 16074->16076 16092 7ff619bc2d01 16075->16092 16076->16073 16078 7ff619bc1b30 49 API calls 16076->16078 16077 7ff619bc1ab0 74 API calls 16077->16054 16079 7ff619bc2cc1 16078->16079 16079->16073 16082 7ff619bc2ccc 16079->16082 16080 7ff619bc1440 161 API calls 16080->16087 16081 7ff619bc1780 59 API calls 16081->16087 16084 7ff619bc2d84 16086 7ff619bc2770 59 API calls 16084->16086 16089 7ff619bc2d95 16086->16089 16087->16060 16087->16080 16087->16081 16087->16084 16091 7ff619bc1ab0 74 API calls 16089->16091 16091->16060 16092->16077 16094 7ff619bc17a1 16093->16094 16095 7ff619bc1795 16093->16095 16094->15265 16096 7ff619bc2770 59 API calls 16095->16096 16096->16094 16098 7ff619bc6728 16097->16098 16099 7ff619bc66f2 16097->16099 16098->16007 16148 7ff619bc16d0 16099->16148 16104 7ff619bc2770 59 API calls 16105 7ff619bc671d 16104->16105 16105->16007 16107 7ff619bc6a10 16106->16107 16108 7ff619bc1b30 49 API calls 16107->16108 16109 7ff619bc6a41 16108->16109 16110 7ff619bc1b30 49 API calls 16109->16110 16121 7ff619bc6bc9 16109->16121 16113 7ff619bc6a68 16110->16113 16111 7ff619bcacc0 _wfindfirst32i64 8 API calls 16112 7ff619bc147f 16111->16112 16112->16011 16112->16012 16113->16121 16660 7ff619bd4e98 16113->16660 16115 7ff619bc6b79 16116 7ff619bc7990 57 API calls 16115->16116 16118 7ff619bc6b91 16116->16118 16117 7ff619bc6bb8 16120 7ff619bc3c90 116 API calls 16117->16120 16118->16117 16669 7ff619bc2880 16118->16669 16120->16121 16121->16111 16122 7ff619bc6a9d 16122->16115 16122->16121 16123 7ff619bd4e98 49 API calls 16122->16123 16124 7ff619bc7990 57 API calls 16122->16124 16125 7ff619bc7800 58 API calls 16122->16125 16123->16122 16124->16122 16125->16122 16127 7ff619bc10a6 16126->16127 16128 7ff619bc10d3 16127->16128 16129 7ff619bc10ad 16127->16129 16132 7ff619bc10ed 16128->16132 16134 7ff619bc1109 16128->16134 16130 7ff619bc2770 59 API calls 16129->16130 16131 7ff619bc10c0 16130->16131 16131->16033 16133 7ff619bc24d0 59 API calls 16132->16133 16139 7ff619bc1104 __std_exception_destroy 16133->16139 16135 7ff619bc111b 16134->16135 16143 7ff619bc1137 memcpy_s 16134->16143 16136 7ff619bc24d0 59 API calls 16135->16136 16136->16139 16137 7ff619bcf518 _fread_nolock 53 API calls 16137->16143 16138 7ff619bcf28c 37 API calls 16138->16143 16139->16033 16140 7ff619bc11fe 16141 7ff619bc2770 59 API calls 16140->16141 16141->16139 16142 7ff619bcfc24 76 API calls 16142->16143 16143->16137 16143->16138 16143->16139 16143->16140 16143->16142 16145 7ff619bcfc54 16144->16145 16695 7ff619bcf988 16145->16695 16147 7ff619bcfc72 16147->16038 16150 7ff619bc16f5 16148->16150 16149 7ff619bc1738 16152 7ff619bc6740 16149->16152 16150->16149 16151 7ff619bc2770 59 API calls 16150->16151 16151->16149 16153 7ff619bc6758 16152->16153 16154 7ff619bc6778 16153->16154 16155 7ff619bc67cb 16153->16155 16156 7ff619bc6950 61 API calls 16154->16156 16157 7ff619bc67d0 GetTempPathW 16155->16157 16159 7ff619bc6784 16156->16159 16158 7ff619bc67e5 16157->16158 16192 7ff619bc2470 16158->16192 16216 7ff619bc6440 16159->16216 16164 7ff619bcacc0 _wfindfirst32i64 8 API calls 16167 7ff619bc670d 16164->16167 16166 7ff619bc67aa __std_exception_destroy 16166->16157 16169 7ff619bc67b8 16166->16169 16167->16098 16167->16104 16172 7ff619bc2770 59 API calls 16169->16172 16170 7ff619bc67fe __std_exception_destroy 16171 7ff619bc68a6 16170->16171 16175 7ff619bc6831 16170->16175 16196 7ff619bd76dc 16170->16196 16199 7ff619bc7800 16170->16199 16174 7ff619bc7aa0 59 API calls 16171->16174 16176 7ff619bc68b7 __std_exception_destroy 16174->16176 16177 7ff619bc7990 57 API calls 16175->16177 16186 7ff619bc686a __std_exception_destroy 16175->16186 16178 7ff619bc7990 57 API calls 16176->16178 16176->16186 16179 7ff619bc6847 16177->16179 16182 7ff619bc68d5 16178->16182 16180 7ff619bc6889 SetEnvironmentVariableW 16179->16180 16181 7ff619bc684c 16179->16181 16180->16186 16183 7ff619bc7990 57 API calls 16181->16183 16184 7ff619bc690d SetEnvironmentVariableW 16182->16184 16185 7ff619bc68da 16182->16185 16187 7ff619bc685c 16183->16187 16184->16186 16188 7ff619bc7990 57 API calls 16185->16188 16186->16164 16189 7ff619bd6444 38 API calls 16187->16189 16190 7ff619bc68ea 16188->16190 16189->16186 16193 7ff619bc2495 16192->16193 16250 7ff619bd3be8 16193->16250 16418 7ff619bd72fc 16196->16418 16200 7ff619bcacf0 16199->16200 16201 7ff619bc7810 GetCurrentProcess OpenProcessToken 16200->16201 16202 7ff619bc78d1 __std_exception_destroy 16201->16202 16203 7ff619bc785b GetTokenInformation 16201->16203 16206 7ff619bc78e4 CloseHandle 16202->16206 16207 7ff619bc78ea 16202->16207 16204 7ff619bc7888 16203->16204 16205 7ff619bc787d GetLastError 16203->16205 16204->16202 16209 7ff619bc789e GetTokenInformation 16204->16209 16205->16202 16205->16204 16206->16207 16549 7ff619bc7500 16207->16549 16209->16202 16210 7ff619bc78c4 ConvertSidToStringSidW 16209->16210 16210->16202 16217 7ff619bc644c 16216->16217 16218 7ff619bc7990 57 API calls 16217->16218 16219 7ff619bc646e 16218->16219 16220 7ff619bc6489 ExpandEnvironmentStringsW 16219->16220 16221 7ff619bc6476 16219->16221 16222 7ff619bc64af __std_exception_destroy 16220->16222 16223 7ff619bc2770 59 API calls 16221->16223 16224 7ff619bc64b3 16222->16224 16225 7ff619bc64c6 16222->16225 16229 7ff619bc6482 16223->16229 16227 7ff619bc2770 59 API calls 16224->16227 16230 7ff619bc64e0 16225->16230 16231 7ff619bc64d4 16225->16231 16226 7ff619bcacc0 _wfindfirst32i64 8 API calls 16228 7ff619bc65a8 16226->16228 16227->16229 16228->16186 16240 7ff619bd6444 16228->16240 16229->16226 16560 7ff619bd50f8 16230->16560 16553 7ff619bd5cd4 16231->16553 16234 7ff619bc64de 16235 7ff619bc64fa 16234->16235 16238 7ff619bc650d memcpy_s 16234->16238 16236 7ff619bc2770 59 API calls 16235->16236 16236->16229 16237 7ff619bc6582 CreateDirectoryW 16237->16229 16238->16237 16239 7ff619bc655c CreateDirectoryW 16238->16239 16239->16238 16241 7ff619bd6464 16240->16241 16242 7ff619bd6451 16240->16242 16652 7ff619bd60c8 16241->16652 16243 7ff619bd41f4 _get_daylight 11 API calls 16242->16243 16245 7ff619bd6456 16243->16245 16247 7ff619bda100 _invalid_parameter_noinfo 37 API calls 16245->16247 16248 7ff619bd6462 16247->16248 16248->16166 16252 7ff619bd3c42 16250->16252 16251 7ff619bd3c67 16253 7ff619bda030 _invalid_parameter_noinfo 37 API calls 16251->16253 16252->16251 16254 7ff619bd3ca3 16252->16254 16267 7ff619bd3c91 16253->16267 16268 7ff619bd2024 16254->16268 16256 7ff619bd3d84 16258 7ff619bda168 __free_lconv_mon 11 API calls 16256->16258 16257 7ff619bcacc0 _wfindfirst32i64 8 API calls 16259 7ff619bc24b4 16257->16259 16258->16267 16259->16170 16261 7ff619bd3daa 16261->16256 16263 7ff619bd3db4 16261->16263 16262 7ff619bd3d59 16264 7ff619bda168 __free_lconv_mon 11 API calls 16262->16264 16266 7ff619bda168 __free_lconv_mon 11 API calls 16263->16266 16264->16267 16265 7ff619bd3d50 16265->16256 16265->16262 16266->16267 16267->16257 16269 7ff619bd2062 16268->16269 16270 7ff619bd2052 16268->16270 16271 7ff619bd2068 16269->16271 16276 7ff619bd2098 16269->16276 16272 7ff619bda030 _invalid_parameter_noinfo 37 API calls 16270->16272 16273 7ff619bda030 _invalid_parameter_noinfo 37 API calls 16271->16273 16274 7ff619bd2090 16272->16274 16273->16274 16274->16256 16274->16261 16274->16262 16274->16265 16276->16270 16276->16274 16279 7ff619bd29e4 16276->16279 16310 7ff619bd246c 16276->16310 16345 7ff619bd1c10 16276->16345 16280 7ff619bd2a9a 16279->16280 16281 7ff619bd2a28 16279->16281 16283 7ff619bd2aa0 16280->16283 16284 7ff619bd2b18 16280->16284 16282 7ff619bd2b0b 16281->16282 16294 7ff619bd2a2e 16281->16294 16372 7ff619bd0e20 16282->16372 16283->16282 16288 7ff619bd2b04 16283->16288 16289 7ff619bd2aac 16283->16289 16379 7ff619bd3180 16284->16379 16287 7ff619bd2a6d 16305 7ff619bd2b23 16287->16305 16348 7ff619bd34a4 16287->16348 16291 7ff619bd3568 37 API calls 16288->16291 16292 7ff619bd2ab2 16289->16292 16293 7ff619bd2ae4 16289->16293 16306 7ff619bd2a7e 16291->16306 16295 7ff619bd2abe 16292->16295 16296 7ff619bd2acd 16292->16296 16300 7ff619bd2a8d 16292->16300 16365 7ff619bd0a4c 16293->16365 16294->16284 16294->16287 16294->16296 16299 7ff619bd2a58 16294->16299 16294->16305 16295->16282 16295->16300 16361 7ff619bd36b4 16296->16361 16297 7ff619bcacc0 _wfindfirst32i64 8 API calls 16302 7ff619bd2e22 16297->16302 16299->16300 16303 7ff619bd2a5d 16299->16303 16300->16305 16354 7ff619bd11f4 16300->16354 16302->16276 16303->16284 16303->16287 16303->16306 16305->16297 16306->16305 16307 7ff619bd37d0 45 API calls 16306->16307 16308 7ff619bd2d09 16306->16308 16307->16308 16308->16305 16389 7ff619bddf50 16308->16389 16311 7ff619bd2490 16310->16311 16312 7ff619bd247a 16310->16312 16315 7ff619bda030 _invalid_parameter_noinfo 37 API calls 16311->16315 16321 7ff619bd24d0 16311->16321 16313 7ff619bd2a9a 16312->16313 16314 7ff619bd2a28 16312->16314 16312->16321 16317 7ff619bd2aa0 16313->16317 16318 7ff619bd2b18 16313->16318 16316 7ff619bd2b0b 16314->16316 16328 7ff619bd2a2e 16314->16328 16315->16321 16320 7ff619bd0e20 38 API calls 16316->16320 16317->16316 16322 7ff619bd2b04 16317->16322 16323 7ff619bd2aac 16317->16323 16319 7ff619bd3180 47 API calls 16318->16319 16341 7ff619bd2a7e 16319->16341 16320->16341 16321->16276 16325 7ff619bd3568 37 API calls 16322->16325 16326 7ff619bd2ab2 16323->16326 16327 7ff619bd2ae4 16323->16327 16324 7ff619bd34a4 46 API calls 16324->16341 16325->16341 16329 7ff619bd2a8d 16326->16329 16330 7ff619bd2abe 16326->16330 16331 7ff619bd2acd 16326->16331 16333 7ff619bd0a4c 38 API calls 16327->16333 16328->16318 16328->16331 16334 7ff619bd2a58 16328->16334 16339 7ff619bd2a6d 16328->16339 16344 7ff619bd2b23 16328->16344 16338 7ff619bd11f4 38 API calls 16329->16338 16329->16344 16330->16316 16330->16329 16335 7ff619bd36b4 45 API calls 16331->16335 16332 7ff619bcacc0 _wfindfirst32i64 8 API calls 16336 7ff619bd2e22 16332->16336 16333->16341 16334->16329 16337 7ff619bd2a5d 16334->16337 16335->16341 16336->16276 16337->16318 16337->16339 16337->16341 16338->16341 16339->16324 16339->16344 16340 7ff619bd37d0 45 API calls 16343 7ff619bd2d09 16340->16343 16341->16340 16341->16343 16341->16344 16342 7ff619bddf50 46 API calls 16342->16343 16343->16342 16343->16344 16344->16332 16401 7ff619bd010c 16345->16401 16349 7ff619bd34d7 16348->16349 16350 7ff619bd351c 16349->16350 16351 7ff619bd34f5 16349->16351 16352 7ff619bd37d0 45 API calls 16349->16352 16350->16306 16353 7ff619bddf50 46 API calls 16351->16353 16352->16351 16353->16350 16355 7ff619bd121a 16354->16355 16356 7ff619bd1244 16355->16356 16358 7ff619bd12fb 16355->16358 16357 7ff619bcfd70 12 API calls 16356->16357 16360 7ff619bd1280 16356->16360 16357->16360 16359 7ff619bda030 _invalid_parameter_noinfo 37 API calls 16358->16359 16359->16360 16360->16306 16362 7ff619bd36f5 16361->16362 16363 7ff619bd374c 45 API calls 16362->16363 16364 7ff619bd36f9 __crtLCMapStringW 16362->16364 16363->16364 16364->16306 16366 7ff619bd0a72 16365->16366 16367 7ff619bd0a9c 16366->16367 16369 7ff619bd0b53 16366->16369 16368 7ff619bcfd70 12 API calls 16367->16368 16371 7ff619bd0ad8 16367->16371 16368->16371 16370 7ff619bda030 _invalid_parameter_noinfo 37 API calls 16369->16370 16370->16371 16371->16306 16373 7ff619bd0e46 16372->16373 16374 7ff619bd0e70 16373->16374 16376 7ff619bd0f27 16373->16376 16375 7ff619bcfd70 12 API calls 16374->16375 16378 7ff619bd0eac 16374->16378 16375->16378 16377 7ff619bda030 _invalid_parameter_noinfo 37 API calls 16376->16377 16377->16378 16378->16306 16380 7ff619bd31a6 16379->16380 16381 7ff619bcfcc8 12 API calls 16380->16381 16382 7ff619bd31f8 16381->16382 16383 7ff619bddab8 46 API calls 16382->16383 16384 7ff619bd32c2 16383->16384 16385 7ff619bd37d0 45 API calls 16384->16385 16387 7ff619bd32e4 16384->16387 16385->16387 16386 7ff619bd37d0 45 API calls 16388 7ff619bd3372 16386->16388 16387->16386 16387->16387 16387->16388 16388->16306 16391 7ff619bddf81 16389->16391 16398 7ff619bddf8f 16389->16398 16390 7ff619bddfaf 16393 7ff619bddfc0 16390->16393 16394 7ff619bddfe7 16390->16394 16391->16390 16392 7ff619bd37d0 45 API calls 16391->16392 16391->16398 16392->16390 16394->16398 16398->16308 16402 7ff619bd0153 16401->16402 16403 7ff619bd0141 16401->16403 16405 7ff619bd0161 16402->16405 16410 7ff619bd019d 16402->16410 16404 7ff619bd41f4 _get_daylight 11 API calls 16403->16404 16406 7ff619bd0146 16404->16406 16407 7ff619bda030 _invalid_parameter_noinfo 37 API calls 16405->16407 16408 7ff619bda100 _invalid_parameter_noinfo 37 API calls 16406->16408 16414 7ff619bd0151 16407->16414 16408->16414 16409 7ff619bd04fd 16411 7ff619bd41f4 _get_daylight 11 API calls 16409->16411 16409->16414 16410->16409 16412 7ff619bd41f4 _get_daylight 11 API calls 16410->16412 16415 7ff619bd079d 16411->16415 16413 7ff619bd04f2 16412->16413 16417 7ff619bda100 _invalid_parameter_noinfo 37 API calls 16413->16417 16414->16276 16416 7ff619bda100 _invalid_parameter_noinfo 37 API calls 16415->16416 16416->16414 16417->16409 16459 7ff619be09c8 16418->16459 16518 7ff619be0740 16459->16518 16539 7ff619bdfac8 EnterCriticalSection 16518->16539 16550 7ff619bc7525 16549->16550 16551 7ff619bd3be8 48 API calls 16550->16551 16552 7ff619bc7548 LocalFree ConvertStringSecurityDescriptorToSecurityDescriptorW 16551->16552 16554 7ff619bd5cf2 16553->16554 16557 7ff619bd5d25 16553->16557 16555 7ff619bdfc64 _wfindfirst32i64 37 API calls 16554->16555 16554->16557 16556 7ff619bd5d21 16555->16556 16556->16557 16558 7ff619bda120 _wfindfirst32i64 17 API calls 16556->16558 16557->16234 16559 7ff619bd5d55 16558->16559 16561 7ff619bd5182 16560->16561 16562 7ff619bd5114 16560->16562 16597 7ff619bdf3fc 16561->16597 16562->16561 16563 7ff619bd5119 16562->16563 16565 7ff619bd514e 16563->16565 16566 7ff619bd5131 16563->16566 16580 7ff619bd4f3c GetFullPathNameW 16565->16580 16572 7ff619bd4ec8 GetFullPathNameW 16566->16572 16571 7ff619bd5146 __std_exception_destroy 16571->16234 16573 7ff619bd4f04 16572->16573 16574 7ff619bd4eee GetLastError 16572->16574 16576 7ff619bd4f00 16573->16576 16578 7ff619bd41f4 _get_daylight 11 API calls 16573->16578 16575 7ff619bd4168 _fread_nolock 11 API calls 16574->16575 16577 7ff619bd4efb 16575->16577 16576->16571 16579 7ff619bd41f4 _get_daylight 11 API calls 16577->16579 16578->16576 16579->16576 16581 7ff619bd4f6f GetLastError 16580->16581 16585 7ff619bd4f85 __std_exception_destroy 16580->16585 16582 7ff619bd4168 _fread_nolock 11 API calls 16581->16582 16583 7ff619bd4f7c 16582->16583 16584 7ff619bd41f4 _get_daylight 11 API calls 16583->16584 16586 7ff619bd4f81 16584->16586 16585->16586 16587 7ff619bd4fdf GetFullPathNameW 16585->16587 16588 7ff619bd5014 16586->16588 16587->16581 16587->16586 16591 7ff619bd5088 memcpy_s 16588->16591 16592 7ff619bd503d memcpy_s 16588->16592 16589 7ff619bd5071 16590 7ff619bd41f4 _get_daylight 11 API calls 16589->16590 16591->16571 16592->16589 16592->16591 16594 7ff619bd50aa 16592->16594 16594->16591 16595 7ff619bd41f4 _get_daylight 11 API calls 16594->16595 16600 7ff619bdf200 16597->16600 16601 7ff619bdf255 16600->16601 16602 7ff619bdf22c 16600->16602 16603 7ff619bdf27a 16601->16603 16604 7ff619bdf259 16601->16604 16605 7ff619bd41f4 _get_daylight 11 API calls 16602->16605 16638 7ff619bde8a8 16603->16638 16626 7ff619bdf37c 16604->16626 16620 7ff619bdf231 16605->16620 16611 7ff619bda100 _invalid_parameter_noinfo 37 API calls 16625 7ff619bdf23c __std_exception_destroy 16611->16625 16615 7ff619bcacc0 _wfindfirst32i64 8 API calls 16618 7ff619bdf24a 16615->16618 16618->16571 16620->16611 16625->16615 16627 7ff619bdf3b5 16626->16627 16628 7ff619bdf396 16626->16628 16629 7ff619bdf3c0 GetDriveTypeW 16627->16629 16637 7ff619bdf3b1 16627->16637 16630 7ff619bd41d4 _fread_nolock 11 API calls 16628->16630 16629->16637 16631 7ff619bdf39b 16630->16631 16632 7ff619bcacc0 _wfindfirst32i64 8 API calls 16637->16632 16639 7ff619bcc140 memcpy_s 16638->16639 16640 7ff619bde8de GetCurrentDirectoryW 16639->16640 16641 7ff619bde8f5 16640->16641 16642 7ff619bde91c 16640->16642 16645 7ff619bcacc0 _wfindfirst32i64 8 API calls 16641->16645 16643 7ff619bde0e0 _get_daylight 11 API calls 16642->16643 16659 7ff619bdfac8 EnterCriticalSection 16652->16659 16661 7ff619bda960 __GetCurrentState 45 API calls 16660->16661 16662 7ff619bd4ead 16661->16662 16663 7ff619bdf1f9 16662->16663 16668 7ff619bdf112 16662->16668 16682 7ff619bcb0c4 16663->16682 16666 7ff619bcacc0 _wfindfirst32i64 8 API calls 16667 7ff619bdf1f1 16666->16667 16667->16122 16668->16666 16670 7ff619bc28a0 16669->16670 16671 7ff619bd3994 49 API calls 16670->16671 16672 7ff619bc28ed memcpy_s 16671->16672 16673 7ff619bc7990 57 API calls 16672->16673 16674 7ff619bc291a 16673->16674 16675 7ff619bc291f 16674->16675 16676 7ff619bc2959 MessageBoxA 16674->16676 16677 7ff619bc7990 57 API calls 16675->16677 16678 7ff619bc2973 16676->16678 16679 7ff619bc2939 MessageBoxW 16677->16679 16680 7ff619bcacc0 _wfindfirst32i64 8 API calls 16678->16680 16679->16678 16685 7ff619bcb0d8 IsProcessorFeaturePresent 16682->16685 16686 7ff619bcb0ef 16685->16686 16691 7ff619bcb174 RtlCaptureContext RtlLookupFunctionEntry 16686->16691 16692 7ff619bcb1a4 RtlVirtualUnwind 16691->16692 16693 7ff619bcb103 16691->16693 16692->16693 16694 7ff619bcafb4 SetUnhandledExceptionFilter UnhandledExceptionFilter GetCurrentProcess TerminateProcess 16693->16694 16696 7ff619bcf9a8 16695->16696 16697 7ff619bcf9d5 16695->16697 16696->16697 16698 7ff619bcf9b2 16696->16698 16699 7ff619bcf9dd 16696->16699 16697->16147 16700 7ff619bda030 _invalid_parameter_noinfo 37 API calls 16698->16700 16702 7ff619bcf8c8 16699->16702 16700->16697 16709 7ff619bd409c EnterCriticalSection 16702->16709 16711 7ff619bc3024 16710->16711 16712 7ff619bd3994 49 API calls 16711->16712 16713 7ff619bc304a 16712->16713 16714 7ff619bc305b 16713->16714 16742 7ff619bd4bbc 16713->16742 16716 7ff619bcacc0 _wfindfirst32i64 8 API calls 16714->16716 16717 7ff619bc2a96 16716->16717 16717->16048 16717->16049 16719 7ff619bc65ce 16718->16719 16720 7ff619bc3c90 116 API calls 16719->16720 16721 7ff619bc65f5 16720->16721 16722 7ff619bc6a00 132 API calls 16721->16722 16723 7ff619bc6603 16722->16723 16724 7ff619bc66b3 16723->16724 16726 7ff619bc661d 16723->16726 16725 7ff619bc66af 16724->16725 16728 7ff619bcf1c8 74 API calls 16724->16728 16729 7ff619bcacc0 _wfindfirst32i64 8 API calls 16725->16729 16926 7ff619bcf260 16726->16926 16728->16725 16731 7ff619bc66d5 16729->16731 16730 7ff619bc6690 16732 7ff619bcf1c8 74 API calls 16730->16732 16731->16054 16733 7ff619bc66a7 16732->16733 16735 7ff619bcf1c8 74 API calls 16733->16735 16734 7ff619bcf518 _fread_nolock 53 API calls 16741 7ff619bc6622 16734->16741 16735->16725 16736 7ff619bcf28c 37 API calls 16736->16741 16737 7ff619bcfc24 76 API calls 16737->16741 16738 7ff619bc6659 16932 7ff619bd76f8 16738->16932 16739 7ff619bcf260 37 API calls 16739->16741 16741->16730 16741->16734 16741->16736 16741->16737 16741->16738 16741->16739 16743 7ff619bd4be5 16742->16743 16744 7ff619bd4bd9 16742->16744 16784 7ff619bd47cc 16743->16784 16759 7ff619bd4430 16744->16759 16748 7ff619bd4bde 16748->16714 16750 7ff619bd4c1d 16795 7ff619bd42b4 16750->16795 16753 7ff619bd4c8d 16755 7ff619bd4430 69 API calls 16753->16755 16754 7ff619bd4c79 16754->16748 16757 7ff619bda168 __free_lconv_mon 11 API calls 16754->16757 16756 7ff619bd4c99 16755->16756 16756->16748 16758 7ff619bda168 __free_lconv_mon 11 API calls 16756->16758 16757->16748 16758->16748 16760 7ff619bd444a 16759->16760 16761 7ff619bd4467 16759->16761 16763 7ff619bd41d4 _fread_nolock 11 API calls 16760->16763 16761->16760 16762 7ff619bd447a CreateFileW 16761->16762 16764 7ff619bd44e4 16762->16764 16765 7ff619bd44ae 16762->16765 16766 7ff619bd444f 16763->16766 16843 7ff619bd4aac 16764->16843 16817 7ff619bd4584 GetFileType 16765->16817 16769 7ff619bd41f4 _get_daylight 11 API calls 16766->16769 16772 7ff619bd4457 16769->16772 16777 7ff619bda100 _invalid_parameter_noinfo 37 API calls 16772->16777 16773 7ff619bd44c3 CloseHandle 16779 7ff619bd4462 16773->16779 16774 7ff619bd44d9 CloseHandle 16774->16779 16775 7ff619bd44ed 16780 7ff619bd4168 _fread_nolock 11 API calls 16775->16780 16776 7ff619bd4518 16864 7ff619bd4868 16776->16864 16777->16779 16779->16748 16783 7ff619bd44f7 16780->16783 16783->16779 16785 7ff619bd47f0 16784->16785 16786 7ff619bd47eb 16784->16786 16785->16786 16787 7ff619bda960 __GetCurrentState 45 API calls 16785->16787 16786->16750 16792 7ff619bde370 16786->16792 16788 7ff619bd480b 16787->16788 16905 7ff619bdceb0 16788->16905 16913 7ff619bde158 16792->16913 16796 7ff619bd4302 16795->16796 16797 7ff619bd42de 16795->16797 16798 7ff619bd435c 16796->16798 16799 7ff619bd4307 16796->16799 16800 7ff619bda168 __free_lconv_mon 11 API calls 16797->16800 16802 7ff619bd42ed 16797->16802 16923 7ff619bdeb84 16798->16923 16799->16802 16803 7ff619bd431c 16799->16803 16805 7ff619bda168 __free_lconv_mon 11 API calls 16799->16805 16800->16802 16802->16753 16802->16754 16806 7ff619bdce50 _fread_nolock 12 API calls 16803->16806 16805->16803 16806->16802 16818 7ff619bd45d2 16817->16818 16819 7ff619bd468f 16817->16819 16822 7ff619bd45fe GetFileInformationByHandle 16818->16822 16823 7ff619bd49a4 21 API calls 16818->16823 16820 7ff619bd4697 16819->16820 16821 7ff619bd46b9 16819->16821 16824 7ff619bd46aa GetLastError 16820->16824 16825 7ff619bd469b 16820->16825 16827 7ff619bd46dc PeekNamedPipe 16821->16827 16833 7ff619bd467a 16821->16833 16822->16824 16826 7ff619bd4627 16822->16826 16828 7ff619bd45ec 16823->16828 16831 7ff619bd4168 _fread_nolock 11 API calls 16824->16831 16829 7ff619bd41f4 _get_daylight 11 API calls 16825->16829 16830 7ff619bd4868 51 API calls 16826->16830 16827->16833 16828->16822 16828->16833 16829->16833 16834 7ff619bd4632 16830->16834 16831->16833 16832 7ff619bcacc0 _wfindfirst32i64 8 API calls 16835 7ff619bd44bc 16832->16835 16833->16832 16881 7ff619bd472c 16834->16881 16835->16773 16835->16774 16838 7ff619bd472c 10 API calls 16839 7ff619bd4651 16838->16839 16840 7ff619bd472c 10 API calls 16839->16840 16844 7ff619bd4ae2 16843->16844 16845 7ff619bd41f4 _get_daylight 11 API calls 16844->16845 16863 7ff619bd4b7a __std_exception_destroy 16844->16863 16847 7ff619bd4af4 16845->16847 16846 7ff619bcacc0 _wfindfirst32i64 8 API calls 16848 7ff619bd44e9 16846->16848 16849 7ff619bd41f4 _get_daylight 11 API calls 16847->16849 16848->16775 16848->16776 16850 7ff619bd4afc 16849->16850 16851 7ff619bd50f8 45 API calls 16850->16851 16852 7ff619bd4b11 16851->16852 16853 7ff619bd4b23 16852->16853 16854 7ff619bd4b19 16852->16854 16855 7ff619bd41f4 _get_daylight 11 API calls 16853->16855 16856 7ff619bd41f4 _get_daylight 11 API calls 16854->16856 16857 7ff619bd4b28 16855->16857 16860 7ff619bd4b1e 16856->16860 16858 7ff619bd41f4 _get_daylight 11 API calls 16857->16858 16857->16863 16859 7ff619bd4b32 16858->16859 16861 7ff619bd50f8 45 API calls 16859->16861 16862 7ff619bd4b6c GetDriveTypeW 16860->16862 16860->16863 16861->16860 16862->16863 16863->16846 16865 7ff619bd4890 16864->16865 16873 7ff619bd4525 16865->16873 16888 7ff619bdea14 16865->16888 16874 7ff619bd49a4 16873->16874 16875 7ff619bd49be 16874->16875 16876 7ff619bd49ce 16875->16876 16877 7ff619bd49f6 16875->16877 16879 7ff619bd4168 _fread_nolock 11 API calls 16876->16879 16880 7ff619bd49de 16876->16880 16878 7ff619bde8a8 21 API calls 16877->16878 16878->16880 16879->16880 16880->16783 16882 7ff619bd4755 FileTimeToSystemTime 16881->16882 16883 7ff619bd4748 16881->16883 16884 7ff619bd4769 SystemTimeToTzSpecificLocalTime 16882->16884 16885 7ff619bd4750 16882->16885 16883->16882 16883->16885 16884->16885 16886 7ff619bcacc0 _wfindfirst32i64 8 API calls 16885->16886 16887 7ff619bd4641 16886->16887 16887->16838 16889 7ff619bdea45 16888->16889 16890 7ff619bdea21 16888->16890 16893 7ff619bdea7f 16889->16893 16896 7ff619bdea9e 16889->16896 16890->16889 16891 7ff619bdea26 16890->16891 16892 7ff619bd41f4 _get_daylight 11 API calls 16891->16892 16894 7ff619bdea2b 16892->16894 16895 7ff619bd41f4 _get_daylight 11 API calls 16893->16895 16899 7ff619bdea84 16895->16899 16897 7ff619bd47cc 45 API calls 16896->16897 16903 7ff619bdeaab 16897->16903 16901 7ff619bda100 _invalid_parameter_noinfo 37 API calls 16899->16901 16902 7ff619bdea8f 16901->16902 16903->16902 16904 7ff619be4574 51 API calls 16903->16904 16904->16903 16906 7ff619bdcec5 16905->16906 16907 7ff619bd482e 16905->16907 16906->16907 16908 7ff619be2738 45 API calls 16906->16908 16909 7ff619bdcf1c 16907->16909 16908->16907 16910 7ff619bdcf31 16909->16910 16911 7ff619bdcf44 16909->16911 16910->16911 16912 7ff619be1ac0 45 API calls 16910->16912 16911->16786 16912->16911 16914 7ff619bde1b9 16913->16914 16921 7ff619bde1b4 __vcrt_FlsAlloc 16913->16921 16914->16750 16915 7ff619bde1e8 LoadLibraryExW 16917 7ff619bde2bd 16915->16917 16918 7ff619bde20d GetLastError 16915->16918 16916 7ff619bde2dd GetProcAddress 16916->16914 16920 7ff619bde2ee 16916->16920 16917->16916 16919 7ff619bde2d4 FreeLibrary 16917->16919 16918->16921 16919->16916 16920->16914 16921->16914 16921->16915 16921->16916 16922 7ff619bde247 LoadLibraryExW 16921->16922 16922->16917 16922->16921 16924 7ff619bdeb8c MultiByteToWideChar 16923->16924 16927 7ff619bcf279 16926->16927 16928 7ff619bcf269 16926->16928 16927->16741 16929 7ff619bd41f4 _get_daylight 11 API calls 16928->16929 16930 7ff619bcf26e 16929->16930 16931 7ff619bda100 _invalid_parameter_noinfo 37 API calls 16930->16931 16931->16927 16933 7ff619bd7700 16932->16933 16934 7ff619bd771c 16933->16934 16935 7ff619bd773d 16933->16935 16953 7ff619bd7120 16952->16953 16964 7ff619bd71d2 memcpy_s 16952->16964 16954 7ff619bd71e2 16953->16954 16956 7ff619bd7137 16953->16956 16960 7ff619bdaad8 _get_daylight 11 API calls 16954->16960 16954->16964 16955 7ff619bd41f4 _get_daylight 11 API calls 16957 7ff619bc6f80 16955->16957 16987 7ff619bdfac8 EnterCriticalSection 16956->16987 16957->15281 16961 7ff619bd71fe 16960->16961 16961->16964 16966 7ff619bdce50 _fread_nolock 12 API calls 16961->16966 16964->16955 16964->16957 16966->16964 16970 7ff619bc6ff3 16969->16970 16971 7ff619bd94ed 16969->16971 16975 7ff619bd6c88 16970->16975 16972 7ff619bd41f4 _get_daylight 11 API calls 16971->16972 17027 7ff619bd51ac 17026->17027 17028 7ff619bd51d2 17027->17028 17031 7ff619bd5205 17027->17031 17029 7ff619bd41f4 _get_daylight 11 API calls 17028->17029 17030 7ff619bd51d7 17029->17030 17032 7ff619bda100 _invalid_parameter_noinfo 37 API calls 17030->17032 17033 7ff619bd520b 17031->17033 17034 7ff619bd5218 17031->17034 17038 7ff619bc3ce9 17032->17038 17035 7ff619bd41f4 _get_daylight 11 API calls 17033->17035 17045 7ff619bda448 17034->17045 17035->17038 17038->15347 17058 7ff619bdfac8 EnterCriticalSection 17045->17058 17406 7ff619bd7cc4 17405->17406 17409 7ff619bd77a8 17406->17409 17408 7ff619bd7cdd 17408->15357 17410 7ff619bd77f2 17409->17410 17411 7ff619bd77c3 17409->17411 17419 7ff619bd409c EnterCriticalSection 17410->17419 17412 7ff619bda030 _invalid_parameter_noinfo 37 API calls 17411->17412 17414 7ff619bd77e3 17412->17414 17414->17408 17421 7ff619bcefc3 17420->17421 17422 7ff619bceff1 17420->17422 17423 7ff619bda030 _invalid_parameter_noinfo 37 API calls 17421->17423 17429 7ff619bcefe3 17422->17429 17430 7ff619bd409c EnterCriticalSection 17422->17430 17423->17429 17429->15361 17432 7ff619bc12f8 17431->17432 17433 7ff619bc12c6 17431->17433 17434 7ff619bcf830 73 API calls 17432->17434 17435 7ff619bc3c90 116 API calls 17433->17435 17436 7ff619bc130a 17434->17436 17437 7ff619bc12d6 17435->17437 17438 7ff619bc132f 17436->17438 17439 7ff619bc130e 17436->17439 17437->17432 17440 7ff619bc12de 17437->17440 17445 7ff619bc1364 17438->17445 17446 7ff619bc1344 17438->17446 17441 7ff619bc24d0 59 API calls 17439->17441 17442 7ff619bc2770 59 API calls 17440->17442 17444 7ff619bc1325 17441->17444 17443 7ff619bc12ee 17442->17443 17443->15367 17444->15367 17448 7ff619bc137e 17445->17448 17454 7ff619bc1395 17445->17454 17447 7ff619bc24d0 59 API calls 17446->17447 17453 7ff619bc135f __std_exception_destroy 17447->17453 17449 7ff619bc1050 98 API calls 17448->17449 17449->17453 17450 7ff619bc1421 17450->15367 17451 7ff619bcf518 _fread_nolock 53 API calls 17451->17454 17452 7ff619bcf1c8 74 API calls 17452->17450 17453->17450 17453->17452 17454->17451 17454->17453 17455 7ff619bc13de 17454->17455 17456 7ff619bc24d0 59 API calls 17455->17456 17456->17453 17458 7ff619bc1b30 49 API calls 17457->17458 17459 7ff619bc3d40 17458->17459 17459->15373 17461 7ff619bc16aa 17460->17461 17462 7ff619bc1666 17460->17462 17461->15382 17462->17461 17463 7ff619bc2770 59 API calls 17462->17463 17464 7ff619bc16be 17463->17464 17464->15382 17466 7ff619bc7990 57 API calls 17465->17466 17467 7ff619bc7127 LoadLibraryExW 17466->17467 17468 7ff619bc7144 __std_exception_destroy 17467->17468 17468->15398 17470 7ff619bc4950 17469->17470 17471 7ff619bc1b30 49 API calls 17470->17471 17472 7ff619bc4982 17471->17472 17473 7ff619bc49ab 17472->17473 17474 7ff619bc498b 17472->17474 17476 7ff619bc4a02 17473->17476 17478 7ff619bc3d10 49 API calls 17473->17478 17475 7ff619bc2770 59 API calls 17474->17475 17496 7ff619bc49a1 17475->17496 17477 7ff619bc3d10 49 API calls 17476->17477 17479 7ff619bc4a1b 17477->17479 17481 7ff619bc49cc 17478->17481 17480 7ff619bc4a39 17479->17480 17484 7ff619bc2770 59 API calls 17479->17484 17485 7ff619bc7110 58 API calls 17480->17485 17482 7ff619bc49ea 17481->17482 17486 7ff619bc2770 59 API calls 17481->17486 17554 7ff619bc3c20 17482->17554 17483 7ff619bcacc0 _wfindfirst32i64 8 API calls 17488 7ff619bc309e 17483->17488 17484->17480 17489 7ff619bc4a46 17485->17489 17486->17482 17488->15477 17497 7ff619bc4cc0 17488->17497 17491 7ff619bc4a6d 17489->17491 17492 7ff619bc4a4b 17489->17492 17560 7ff619bc3dd0 GetProcAddress 17491->17560 17493 7ff619bc2620 57 API calls 17492->17493 17493->17496 17495 7ff619bc7110 58 API calls 17495->17476 17496->17483 17498 7ff619bc6950 61 API calls 17497->17498 17500 7ff619bc4cd5 17498->17500 17499 7ff619bc4cf0 17501 7ff619bc7990 57 API calls 17499->17501 17500->17499 17502 7ff619bc2880 59 API calls 17500->17502 17503 7ff619bc4d34 17501->17503 17502->17499 17504 7ff619bc4d50 17503->17504 17505 7ff619bc4d39 17503->17505 17508 7ff619bc7990 57 API calls 17504->17508 17506 7ff619bc2770 59 API calls 17505->17506 17507 7ff619bc4d45 17506->17507 17507->15479 17509 7ff619bc4d85 17508->17509 17512 7ff619bc1b30 49 API calls 17509->17512 17523 7ff619bc4d8a __std_exception_destroy 17509->17523 17510 7ff619bc2770 59 API calls 17511 7ff619bc4f31 17510->17511 17511->15479 17513 7ff619bc4e07 17512->17513 17514 7ff619bc4e0e 17513->17514 17515 7ff619bc4e33 17513->17515 17517 7ff619bc2770 59 API calls 17514->17517 17516 7ff619bc7990 57 API calls 17515->17516 17519 7ff619bc4e4c 17516->17519 17518 7ff619bc4e23 17517->17518 17518->15479 17519->17523 17667 7ff619bc4aa0 17519->17667 17523->17510 17524 7ff619bc4f1a 17523->17524 17524->15479 17526 7ff619bc46d7 17525->17526 17526->17526 17527 7ff619bc4700 17526->17527 17534 7ff619bc4717 __std_exception_destroy 17526->17534 17528 7ff619bc2770 59 API calls 17527->17528 17529 7ff619bc470c 17528->17529 17529->15481 17530 7ff619bc47ff 17530->15481 17531 7ff619bc1780 59 API calls 17531->17534 17532 7ff619bc12b0 122 API calls 17532->17534 17533 7ff619bc2770 59 API calls 17533->17534 17534->17530 17534->17531 17534->17532 17534->17533 17536 7ff619bc4927 17535->17536 17537 7ff619bc483b 17535->17537 17536->15483 17537->17536 17538 7ff619bc1780 59 API calls 17537->17538 17539 7ff619bc2770 59 API calls 17537->17539 17538->17537 17539->17537 17555 7ff619bc3c2a 17554->17555 17556 7ff619bc7990 57 API calls 17555->17556 17557 7ff619bc3c52 17556->17557 17558 7ff619bcacc0 _wfindfirst32i64 8 API calls 17557->17558 17559 7ff619bc3c7a 17558->17559 17559->17476 17559->17495 17561 7ff619bc3df8 17560->17561 17562 7ff619bc3e1b GetProcAddress 17560->17562 17564 7ff619bc2620 57 API calls 17561->17564 17562->17561 17563 7ff619bc3e40 GetProcAddress 17562->17563 17563->17561 17565 7ff619bc3e65 GetProcAddress 17563->17565 17566 7ff619bc3e0b 17564->17566 17565->17561 17567 7ff619bc3e8d GetProcAddress 17565->17567 17566->17496 17567->17561 17568 7ff619bc3eb5 GetProcAddress 17567->17568 17568->17561 17569 7ff619bc3edd GetProcAddress 17568->17569 17570 7ff619bc3f05 GetProcAddress 17569->17570 17571 7ff619bc3ef9 17569->17571 17572 7ff619bc3f21 17570->17572 17573 7ff619bc3f2d GetProcAddress 17570->17573 17571->17570 17572->17573 17574 7ff619bc3f49 17573->17574 17575 7ff619bc3f85 GetProcAddress 17574->17575 17576 7ff619bc3f5d GetProcAddress 17574->17576 17578 7ff619bc3fa1 17575->17578 17579 7ff619bc3fad GetProcAddress 17575->17579 17576->17575 17577 7ff619bc3f79 17576->17577 17577->17575 17578->17579 17580 7ff619bc3fd5 GetProcAddress 17579->17580 17581 7ff619bc3fc9 17579->17581 17582 7ff619bc3ff1 17580->17582 17583 7ff619bc3ffd GetProcAddress 17580->17583 17581->17580 17582->17583 17584 7ff619bc4025 GetProcAddress 17583->17584 17585 7ff619bc4019 17583->17585 17586 7ff619bc4041 17584->17586 17587 7ff619bc404d GetProcAddress 17584->17587 17585->17584 17586->17587 17588 7ff619bc4075 GetProcAddress 17587->17588 17589 7ff619bc4069 17587->17589 17589->17588 17668 7ff619bc4aba 17667->17668 17671 7ff619bc1780 59 API calls 17668->17671 17672 7ff619bc4bd3 17668->17672 17676 7ff619bc4ca9 17668->17676 17693 7ff619bc4c71 17668->17693 17701 7ff619bd5480 17668->17701 17669 7ff619bcacc0 _wfindfirst32i64 8 API calls 17670 7ff619bc4c90 17669->17670 17694 7ff619bc7b90 17670->17694 17671->17668 17674 7ff619bd94e4 _fread_nolock 37 API calls 17672->17674 17672->17693 17675 7ff619bc4bea 17674->17675 17705 7ff619bd558c 17675->17705 17678 7ff619bc2770 59 API calls 17676->17678 17678->17693 17693->17669 17695 7ff619bc7baf 17694->17695 17702 7ff619bd54b0 17701->17702 17730 7ff619bd5284 17702->17730 17731 7ff619bd52b7 17730->17731 17732 7ff619bd52cc 17731->17732 17733 7ff619bd52f9 17731->17733 17742 7ff619bd52bc 17731->17742 17742->17742 17897 7ff619be94c0 17898 7ff619be94cf 17897->17898 17899 7ff619be94d9 17897->17899 17901 7ff619bdfb28 LeaveCriticalSection 17898->17901 18708 7ff619bcad40 18709 7ff619bcad50 18708->18709 18725 7ff619bd554c 18709->18725 18711 7ff619bcad5c 18731 7ff619bcb2e8 18711->18731 18713 7ff619bcb5cc 7 API calls 18714 7ff619bcadf5 18713->18714 18715 7ff619bcad74 _RTC_Initialize 18723 7ff619bcadc9 18715->18723 18736 7ff619bcb498 18715->18736 18717 7ff619bcad89 18739 7ff619bd81c4 18717->18739 18723->18713 18724 7ff619bcade5 18723->18724 18726 7ff619bd555d 18725->18726 18727 7ff619bd5565 18726->18727 18728 7ff619bd41f4 _get_daylight 11 API calls 18726->18728 18727->18711 18729 7ff619bd5574 18728->18729 18730 7ff619bda100 _invalid_parameter_noinfo 37 API calls 18729->18730 18730->18727 18732 7ff619bcb2f9 18731->18732 18735 7ff619bcb2fe __scrt_acquire_startup_lock 18731->18735 18733 7ff619bcb5cc 7 API calls 18732->18733 18732->18735 18734 7ff619bcb372 18733->18734 18735->18715 18764 7ff619bcb45c 18736->18764 18738 7ff619bcb4a1 18738->18717 18740 7ff619bd81e4 18739->18740 18762 7ff619bcad95 18739->18762 18741 7ff619bd8202 GetModuleFileNameW 18740->18741 18742 7ff619bd81ec 18740->18742 18746 7ff619bd822d 18741->18746 18743 7ff619bd41f4 _get_daylight 11 API calls 18742->18743 18744 7ff619bd81f1 18743->18744 18745 7ff619bda100 _invalid_parameter_noinfo 37 API calls 18744->18745 18745->18762 18747 7ff619bd8164 11 API calls 18746->18747 18748 7ff619bd826d 18747->18748 18749 7ff619bd8275 18748->18749 18755 7ff619bd828d 18748->18755 18750 7ff619bd41f4 _get_daylight 11 API calls 18749->18750 18751 7ff619bd827a 18750->18751 18752 7ff619bda168 __free_lconv_mon 11 API calls 18751->18752 18752->18762 18753 7ff619bd82af 18754 7ff619bda168 __free_lconv_mon 11 API calls 18753->18754 18754->18762 18755->18753 18756 7ff619bd82f4 18755->18756 18757 7ff619bd82db 18755->18757 18759 7ff619bda168 __free_lconv_mon 11 API calls 18756->18759 18758 7ff619bda168 __free_lconv_mon 11 API calls 18757->18758 18760 7ff619bd82e4 18758->18760 18759->18753 18761 7ff619bda168 __free_lconv_mon 11 API calls 18760->18761 18761->18762 18762->18723 18763 7ff619bcb56c InitializeSListHead 18762->18763 18765 7ff619bcb476 18764->18765 18767 7ff619bcb46f 18764->18767 18768 7ff619bd924c 18765->18768 18767->18738 18771 7ff619bd8e88 18768->18771 18778 7ff619bdfac8 EnterCriticalSection 18771->18778 18779 7ff619bd4040 18780 7ff619bd404b 18779->18780 18788 7ff619bde6f4 18780->18788 18801 7ff619bdfac8 EnterCriticalSection 18788->18801 14962 7ff619bdec40 14963 7ff619bdee28 14962->14963 14965 7ff619bdec83 _isindst 14962->14965 14964 7ff619bd41f4 _get_daylight 11 API calls 14963->14964 14982 7ff619bdee1a 14964->14982 14965->14963 14968 7ff619bdecff _isindst 14965->14968 14966 7ff619bcacc0 _wfindfirst32i64 8 API calls 14967 7ff619bdee43 14966->14967 14983 7ff619be52dc 14968->14983 14973 7ff619bdee54 14974 7ff619bda120 _wfindfirst32i64 17 API calls 14973->14974 14977 7ff619bdee68 14974->14977 14980 7ff619bded5c 14980->14982 15007 7ff619be531c 14980->15007 14982->14966 14984 7ff619be52ea 14983->14984 14988 7ff619bded1d 14983->14988 15014 7ff619bdfac8 EnterCriticalSection 14984->15014 14989 7ff619be46e8 14988->14989 14990 7ff619be46f1 14989->14990 14991 7ff619bded32 14989->14991 14992 7ff619bd41f4 _get_daylight 11 API calls 14990->14992 14991->14973 14995 7ff619be4718 14991->14995 14993 7ff619be46f6 14992->14993 14994 7ff619bda100 _invalid_parameter_noinfo 37 API calls 14993->14994 14994->14991 14996 7ff619be4721 14995->14996 14997 7ff619bded43 14995->14997 14998 7ff619bd41f4 _get_daylight 11 API calls 14996->14998 14997->14973 15001 7ff619be4748 14997->15001 14999 7ff619be4726 14998->14999 15000 7ff619bda100 _invalid_parameter_noinfo 37 API calls 14999->15000 15000->14997 15002 7ff619be4751 15001->15002 15006 7ff619bded54 15001->15006 15003 7ff619bd41f4 _get_daylight 11 API calls 15002->15003 15004 7ff619be4756 15003->15004 15005 7ff619bda100 _invalid_parameter_noinfo 37 API calls 15004->15005 15005->15006 15006->14973 15006->14980 15015 7ff619bdfac8 EnterCriticalSection 15007->15015 17961 7ff619be95bc 17964 7ff619bd40a8 LeaveCriticalSection 17961->17964 18828 7ff619bd6d50 18833 7ff619bdfac8 EnterCriticalSection 18828->18833 18101 7ff619bda7e0 18102 7ff619bda7e5 18101->18102 18103 7ff619bda7fa 18101->18103 18107 7ff619bda800 18102->18107 18108 7ff619bda842 18107->18108 18109 7ff619bda84a 18107->18109 18110 7ff619bda168 __free_lconv_mon 11 API calls 18108->18110 18111 7ff619bda168 __free_lconv_mon 11 API calls 18109->18111 18110->18109 18112 7ff619bda857 18111->18112 18113 7ff619bda168 __free_lconv_mon 11 API calls 18112->18113 18114 7ff619bda864 18113->18114 18115 7ff619bda168 __free_lconv_mon 11 API calls 18114->18115 18116 7ff619bda871 18115->18116 18117 7ff619bda168 __free_lconv_mon 11 API calls 18116->18117 18118 7ff619bda87e 18117->18118 18119 7ff619bda168 __free_lconv_mon 11 API calls 18118->18119 18120 7ff619bda88b 18119->18120 18121 7ff619bda168 __free_lconv_mon 11 API calls 18120->18121 18122 7ff619bda898 18121->18122 18123 7ff619bda168 __free_lconv_mon 11 API calls 18122->18123 18124 7ff619bda8a5 18123->18124 18125 7ff619bda168 __free_lconv_mon 11 API calls 18124->18125 18126 7ff619bda8b5 18125->18126 18127 7ff619bda168 __free_lconv_mon 11 API calls 18126->18127 18128 7ff619bda8c5 18127->18128 18133 7ff619bda6b0 18128->18133 18147 7ff619bdfac8 EnterCriticalSection 18133->18147

                                                                                                                                                                                                                                              Executed Functions

                                                                                                                                                                                                                                              Function 00007FF619BE4D48 Relevance: 14.3, APIs: 6, Strings: 2, Instructions: 334timeCOMMON
                                                                                                                                                                                                                                              Download Yara Rule

                                                                                                                                                                                                                                              Control-flow Graph

                                                                                                                                                                                                                                              • Executed
                                                                                                                                                                                                                                              • Not Executed
                                                                                                                                                                                                                                              control_flow_graph 135 7ff619be4d48-7ff619be4d83 call 7ff619be46d8 call 7ff619be46e0 call 7ff619be4748 142 7ff619be4fad-7ff619be4ff9 call 7ff619bda120 call 7ff619be46d8 call 7ff619be46e0 call 7ff619be4748 135->142 143 7ff619be4d89-7ff619be4d94 call 7ff619be46e8 135->143 168 7ff619be4fff-7ff619be500a call 7ff619be46e8 142->168 169 7ff619be5137-7ff619be51a5 call 7ff619bda120 call 7ff619be09e8 142->169 143->142 148 7ff619be4d9a-7ff619be4da4 143->148 150 7ff619be4dc6-7ff619be4dca 148->150 151 7ff619be4da6-7ff619be4da9 148->151 154 7ff619be4dcd-7ff619be4dd5 150->154 155 7ff619be4dac-7ff619be4db7 151->155 154->154 157 7ff619be4dd7-7ff619be4dea call 7ff619bdce50 154->157 158 7ff619be4dc2-7ff619be4dc4 155->158 159 7ff619be4db9-7ff619be4dc0 155->159 166 7ff619be4e02-7ff619be4e0e call 7ff619bda168 157->166 167 7ff619be4dec-7ff619be4dee call 7ff619bda168 157->167 158->150 160 7ff619be4df3-7ff619be4e01 158->160 159->155 159->158 176 7ff619be4e15-7ff619be4e1d 166->176 167->160 168->169 178 7ff619be5010-7ff619be501b call 7ff619be4718 168->178 187 7ff619be51b3-7ff619be51b6 169->187 188 7ff619be51a7-7ff619be51ae 169->188 176->176 179 7ff619be4e1f-7ff619be4e30 call 7ff619bdfc64 176->179 178->169 189 7ff619be5021-7ff619be5044 call 7ff619bda168 GetTimeZoneInformation 178->189 179->142 190 7ff619be4e36-7ff619be4e8c call 7ff619bcc140 * 4 call 7ff619be4c64 179->190 192 7ff619be51ed-7ff619be5200 call 7ff619bdce50 187->192 193 7ff619be51b8 187->193 191 7ff619be5243-7ff619be5246 188->191 205 7ff619be504a-7ff619be506b 189->205 206 7ff619be510c-7ff619be5136 call 7ff619be46d0 call 7ff619be46c0 call 7ff619be46c8 189->206 247 7ff619be4e8e-7ff619be4e92 190->247 196 7ff619be51bb call 7ff619be4fc4 191->196 197 7ff619be524c-7ff619be5254 call 7ff619be4d48 191->197 211 7ff619be5202 192->211 212 7ff619be520b-7ff619be5226 call 7ff619be09e8 192->212 193->196 209 7ff619be51c0-7ff619be51ec call 7ff619bda168 call 7ff619bcacc0 196->209 197->209 213 7ff619be506d-7ff619be5073 205->213 214 7ff619be5076-7ff619be507d 205->214 221 7ff619be5204-7ff619be5209 call 7ff619bda168 211->221 231 7ff619be522d-7ff619be523f call 7ff619bda168 212->231 232 7ff619be5228-7ff619be522b 212->232 213->214 215 7ff619be507f-7ff619be5087 214->215 216 7ff619be5091 214->216 215->216 222 7ff619be5089-7ff619be508f 215->222 225 7ff619be5093-7ff619be5107 call 7ff619bcc140 * 4 call 7ff619be1f84 call 7ff619be525c * 2 216->225 221->193 222->225 225->206 231->191 232->221 249 7ff619be4e94 247->249 250 7ff619be4e98-7ff619be4e9c 247->250 249->250 250->247 252 7ff619be4e9e-7ff619be4ec3 call 7ff619be7b68 250->252 258 7ff619be4ec6-7ff619be4eca 252->258 260 7ff619be4ecc-7ff619be4ed7 258->260 261 7ff619be4ed9-7ff619be4edd 258->261 260->261 263 7ff619be4edf-7ff619be4ee3 260->263 261->258 266 7ff619be4ee5-7ff619be4f0d call 7ff619be7b68 263->266 267 7ff619be4f64-7ff619be4f68 263->267 275 7ff619be4f0f 266->275 276 7ff619be4f2b-7ff619be4f2f 266->276 268 7ff619be4f6f-7ff619be4f7c 267->268 269 7ff619be4f6a-7ff619be4f6c 267->269 271 7ff619be4f7e-7ff619be4f94 call 7ff619be4c64 268->271 272 7ff619be4f97-7ff619be4fa6 call 7ff619be46d0 call 7ff619be46c0 268->272 269->268 271->272 272->142 279 7ff619be4f12-7ff619be4f19 275->279 276->267 281 7ff619be4f31-7ff619be4f4f call 7ff619be7b68 276->281 279->276 282 7ff619be4f1b-7ff619be4f29 279->282 287 7ff619be4f5b-7ff619be4f62 281->287 282->276 282->279 287->267 288 7ff619be4f51-7ff619be4f55 287->288 288->267 289 7ff619be4f57 288->289 289->287
                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                              • _get_daylight.LIBCMT ref: 00007FF619BE4D8D
                                                                                                                                                                                                                                                • Part of subcall function 00007FF619BE46E8: _invalid_parameter_noinfo.LIBCMT ref: 00007FF619BE46FC
                                                                                                                                                                                                                                                • Part of subcall function 00007FF619BDA168: RtlFreeHeap.NTDLL(?,?,?,00007FF619BE214A,?,?,?,00007FF619BE2187,?,?,00000000,00007FF619BE2658,?,?,?,00007FF619BE258B), ref: 00007FF619BDA17E
                                                                                                                                                                                                                                                • Part of subcall function 00007FF619BDA168: GetLastError.KERNEL32(?,?,?,00007FF619BE214A,?,?,?,00007FF619BE2187,?,?,00000000,00007FF619BE2658,?,?,?,00007FF619BE258B), ref: 00007FF619BDA188
                                                                                                                                                                                                                                                • Part of subcall function 00007FF619BDA120: IsProcessorFeaturePresent.KERNEL32(?,?,?,?,00007FF619BDA0FE,?,?,?,?,?,00007FF619BD201E), ref: 00007FF619BDA129
                                                                                                                                                                                                                                                • Part of subcall function 00007FF619BDA120: GetCurrentProcess.KERNEL32(?,?,?,?,00007FF619BDA0FE,?,?,?,?,?,00007FF619BD201E), ref: 00007FF619BDA14E
                                                                                                                                                                                                                                              • _get_daylight.LIBCMT ref: 00007FF619BE4D7C
                                                                                                                                                                                                                                                • Part of subcall function 00007FF619BE4748: _invalid_parameter_noinfo.LIBCMT ref: 00007FF619BE475C
                                                                                                                                                                                                                                              • _get_daylight.LIBCMT ref: 00007FF619BE4FF2
                                                                                                                                                                                                                                              • _get_daylight.LIBCMT ref: 00007FF619BE5003
                                                                                                                                                                                                                                              • _get_daylight.LIBCMT ref: 00007FF619BE5014
                                                                                                                                                                                                                                              • GetTimeZoneInformation.KERNELBASE(?,?,?,?,?,?,?,?,?,00000000,?,00007FF619BE5254), ref: 00007FF619BE503B
                                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 00000000.00000002.1925722330.00007FF619BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF619BC0000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1925682521.00007FF619BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1925758127.00007FF619BEA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1925809705.00007FF619BFD000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1925809705.00007FF619C0C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1925902396.00007FF619C0E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_0_2_7ff619bc0000_NEVER OPEN!.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: _get_daylight$_invalid_parameter_noinfo$CurrentErrorFeatureFreeHeapInformationLastPresentProcessProcessorTimeZone
                                                                                                                                                                                                                                              • String ID: Eastern Standard Time$Eastern Summer Time
                                                                                                                                                                                                                                              • API String ID: 4070488512-239921721
                                                                                                                                                                                                                                              • Opcode ID: 117bb5b06d64383e6cb5a61328ac0362288f3110439e8fd4eb588df6a1d5683c
                                                                                                                                                                                                                                              • Instruction ID: f697bbadb7834df348fb2637d0f95d20f36ca06bf216d9d14a01495711f33e25
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 117bb5b06d64383e6cb5a61328ac0362288f3110439e8fd4eb588df6a1d5683c
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 2FD1B226E08A4646EB30DF27D4501BA77A6EF86FACF444175EA4DC7685DF3CE8418740
                                                                                                                                                                                                                                              Function 00007FF619BC6740 Relevance: 12.4, APIs: 3, Strings: 4, Instructions: 139COMMON
                                                                                                                                                                                                                                              Download Yara Rule

                                                                                                                                                                                                                                              Control-flow Graph

                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                              • GetTempPathW.KERNEL32(?,00000000,?,00007FF619BC670D), ref: 00007FF619BC67DA
                                                                                                                                                                                                                                                • Part of subcall function 00007FF619BC6950: GetEnvironmentVariableW.KERNEL32(00007FF619BC36C7), ref: 00007FF619BC698A
                                                                                                                                                                                                                                                • Part of subcall function 00007FF619BC6950: ExpandEnvironmentStringsW.KERNEL32 ref: 00007FF619BC69A7
                                                                                                                                                                                                                                                • Part of subcall function 00007FF619BD6444: _invalid_parameter_noinfo.LIBCMT ref: 00007FF619BD645D
                                                                                                                                                                                                                                              • SetEnvironmentVariableW.KERNEL32(?,TokenIntegrityLevel), ref: 00007FF619BC6891
                                                                                                                                                                                                                                                • Part of subcall function 00007FF619BC2770: MessageBoxW.USER32 ref: 00007FF619BC2841
                                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 00000000.00000002.1925722330.00007FF619BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF619BC0000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1925682521.00007FF619BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1925758127.00007FF619BEA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1925809705.00007FF619BFD000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1925809705.00007FF619C0C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1925902396.00007FF619C0E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_0_2_7ff619bc0000_NEVER OPEN!.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: Environment$Variable$ExpandMessagePathStringsTemp_invalid_parameter_noinfo
                                                                                                                                                                                                                                              • String ID: LOADER: Failed to set the TMP environment variable.$TMP$TMP$_MEI%d
                                                                                                                                                                                                                                              • API String ID: 3752271684-1116378104
                                                                                                                                                                                                                                              • Opcode ID: a657bcaa384b06c856f550ba716170645b7c61d86da0af2e63a6a4fbedfebf30
                                                                                                                                                                                                                                              • Instruction ID: bc627f719fb61486ee14bd7a8e09b7e88febf44acefa7001768dfca45e61184a
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: a657bcaa384b06c856f550ba716170645b7c61d86da0af2e63a6a4fbedfebf30
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: F6518D11B19E4B91FA74EF22A9596BB52859F8BFECF440035ED0EC7797ED2CE4018600
                                                                                                                                                                                                                                              Function 00007FF619BDB28C Relevance: 10.8, APIs: 7, Instructions: 286COMMONLIBRARYCODE
                                                                                                                                                                                                                                              Download Yara Rule

                                                                                                                                                                                                                                              Control-flow Graph

                                                                                                                                                                                                                                              • Executed
                                                                                                                                                                                                                                              • Not Executed
                                                                                                                                                                                                                                              control_flow_graph 694 7ff619bdb28c-7ff619bdb2ad 695 7ff619bdb2af-7ff619bdb2c2 call 7ff619bd41d4 call 7ff619bd41f4 694->695 696 7ff619bdb2c7-7ff619bdb2c9 694->696 712 7ff619bdb6c3 695->712 698 7ff619bdb2cf-7ff619bdb2d6 696->698 699 7ff619bdb6ab-7ff619bdb6b8 call 7ff619bd41d4 call 7ff619bd41f4 696->699 698->699 701 7ff619bdb2dc-7ff619bdb310 698->701 718 7ff619bdb6be call 7ff619bda100 699->718 701->699 704 7ff619bdb316-7ff619bdb31d 701->704 707 7ff619bdb31f-7ff619bdb332 call 7ff619bd41d4 call 7ff619bd41f4 704->707 708 7ff619bdb337-7ff619bdb33a 704->708 707->718 710 7ff619bdb340-7ff619bdb342 708->710 711 7ff619bdb6a7-7ff619bdb6a9 708->711 710->711 716 7ff619bdb348-7ff619bdb34b 710->716 715 7ff619bdb6c6-7ff619bdb6d5 711->715 712->715 716->707 719 7ff619bdb34d-7ff619bdb371 716->719 718->712 722 7ff619bdb373-7ff619bdb376 719->722 723 7ff619bdb3a6-7ff619bdb3ae 719->723 725 7ff619bdb39e-7ff619bdb3a4 722->725 726 7ff619bdb378-7ff619bdb380 722->726 727 7ff619bdb382-7ff619bdb399 call 7ff619bd41d4 call 7ff619bd41f4 call 7ff619bda100 723->727 728 7ff619bdb3b0-7ff619bdb3da call 7ff619bdce50 call 7ff619bda168 * 2 723->728 731 7ff619bdb425-7ff619bdb436 725->731 726->725 726->727 759 7ff619bdb535 727->759 755 7ff619bdb3dc-7ff619bdb3f2 call 7ff619bd41f4 call 7ff619bd41d4 728->755 756 7ff619bdb3f7-7ff619bdb421 call 7ff619bdbabc 728->756 734 7ff619bdb4bd-7ff619bdb4c7 call 7ff619be2a30 731->734 735 7ff619bdb43c-7ff619bdb444 731->735 747 7ff619bdb553 734->747 748 7ff619bdb4cd-7ff619bdb4e3 734->748 735->734 736 7ff619bdb446-7ff619bdb448 735->736 736->734 740 7ff619bdb44a-7ff619bdb468 736->740 740->734 744 7ff619bdb46a-7ff619bdb476 740->744 744->734 749 7ff619bdb478-7ff619bdb47a 744->749 751 7ff619bdb558-7ff619bdb579 ReadFile 747->751 748->747 753 7ff619bdb4e5-7ff619bdb4f7 GetConsoleMode 748->753 749->734 754 7ff619bdb47c-7ff619bdb494 749->754 757 7ff619bdb57f-7ff619bdb587 751->757 758 7ff619bdb671-7ff619bdb67a GetLastError 751->758 753->747 760 7ff619bdb4f9-7ff619bdb501 753->760 754->734 764 7ff619bdb496-7ff619bdb4a2 754->764 755->759 756->731 757->758 766 7ff619bdb58d 757->766 761 7ff619bdb67c-7ff619bdb692 call 7ff619bd41f4 call 7ff619bd41d4 758->761 762 7ff619bdb697-7ff619bdb69a 758->762 763 7ff619bdb538-7ff619bdb542 call 7ff619bda168 759->763 760->751 768 7ff619bdb503-7ff619bdb526 ReadConsoleW 760->768 761->759 772 7ff619bdb52e-7ff619bdb530 call 7ff619bd4168 762->772 773 7ff619bdb6a0-7ff619bdb6a2 762->773 763->715 764->734 771 7ff619bdb4a4-7ff619bdb4a6 764->771 775 7ff619bdb594-7ff619bdb5ab 766->775 777 7ff619bdb547-7ff619bdb551 768->777 778 7ff619bdb528 GetLastError 768->778 771->734 782 7ff619bdb4a8-7ff619bdb4b8 771->782 772->759 773->763 775->763 784 7ff619bdb5ad-7ff619bdb5b8 775->784 777->775 778->772 782->734 787 7ff619bdb5df-7ff619bdb5e7 784->787 788 7ff619bdb5ba-7ff619bdb5d3 call 7ff619bdae9c 784->788 789 7ff619bdb65f-7ff619bdb66c call 7ff619bdacc4 787->789 790 7ff619bdb5e9-7ff619bdb5fb 787->790 796 7ff619bdb5d8-7ff619bdb5da 788->796 789->796 793 7ff619bdb652-7ff619bdb65a 790->793 794 7ff619bdb5fd 790->794 793->763 797 7ff619bdb603-7ff619bdb60a 794->797 796->763 799 7ff619bdb60c-7ff619bdb610 797->799 800 7ff619bdb647-7ff619bdb64c 797->800 801 7ff619bdb612-7ff619bdb619 799->801 802 7ff619bdb62d 799->802 800->793 801->802 803 7ff619bdb61b-7ff619bdb61f 801->803 804 7ff619bdb633-7ff619bdb643 802->804 803->802 805 7ff619bdb621-7ff619bdb62b 803->805 804->797 806 7ff619bdb645 804->806 805->804 806->793
                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 00000000.00000002.1925722330.00007FF619BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF619BC0000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1925682521.00007FF619BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1925758127.00007FF619BEA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1925809705.00007FF619BFD000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1925809705.00007FF619C0C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1925902396.00007FF619C0E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_0_2_7ff619bc0000_NEVER OPEN!.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: _invalid_parameter_noinfo
                                                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                                                              • API String ID: 3215553584-0
                                                                                                                                                                                                                                              • Opcode ID: 5a7dabb1e9ef4c9dfb2dafabf883447c7ea8797d5f58d5bd2ce831bfa94d3783
                                                                                                                                                                                                                                              • Instruction ID: 34e8390eae6af35a6c6dd7222e12f717ec27c2145903f913767c9f4b5584750c
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 5a7dabb1e9ef4c9dfb2dafabf883447c7ea8797d5f58d5bd2ce831bfa94d3783
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: ABC19C62A0CEAA95EB709F1594503BF6AE1EB82FACF444135DA4E87791CF7CE4548700
                                                                                                                                                                                                                                              Function 00007FF619BE4FC4 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 143timeCOMMON
                                                                                                                                                                                                                                              Download Yara Rule

                                                                                                                                                                                                                                              Control-flow Graph

                                                                                                                                                                                                                                              • Executed
                                                                                                                                                                                                                                              • Not Executed
                                                                                                                                                                                                                                              control_flow_graph 807 7ff619be4fc4-7ff619be4ff9 call 7ff619be46d8 call 7ff619be46e0 call 7ff619be4748 814 7ff619be4fff-7ff619be500a call 7ff619be46e8 807->814 815 7ff619be5137-7ff619be51a5 call 7ff619bda120 call 7ff619be09e8 807->815 814->815 820 7ff619be5010-7ff619be501b call 7ff619be4718 814->820 826 7ff619be51b3-7ff619be51b6 815->826 827 7ff619be51a7-7ff619be51ae 815->827 820->815 828 7ff619be5021-7ff619be5044 call 7ff619bda168 GetTimeZoneInformation 820->828 830 7ff619be51ed-7ff619be5200 call 7ff619bdce50 826->830 831 7ff619be51b8 826->831 829 7ff619be5243-7ff619be5246 827->829 840 7ff619be504a-7ff619be506b 828->840 841 7ff619be510c-7ff619be5136 call 7ff619be46d0 call 7ff619be46c0 call 7ff619be46c8 828->841 833 7ff619be51bb call 7ff619be4fc4 829->833 834 7ff619be524c-7ff619be5254 call 7ff619be4d48 829->834 845 7ff619be5202 830->845 846 7ff619be520b-7ff619be5226 call 7ff619be09e8 830->846 831->833 843 7ff619be51c0-7ff619be51ec call 7ff619bda168 call 7ff619bcacc0 833->843 834->843 847 7ff619be506d-7ff619be5073 840->847 848 7ff619be5076-7ff619be507d 840->848 854 7ff619be5204-7ff619be5209 call 7ff619bda168 845->854 862 7ff619be522d-7ff619be523f call 7ff619bda168 846->862 863 7ff619be5228-7ff619be522b 846->863 847->848 849 7ff619be507f-7ff619be5087 848->849 850 7ff619be5091 848->850 849->850 855 7ff619be5089-7ff619be508f 849->855 857 7ff619be5093-7ff619be5107 call 7ff619bcc140 * 4 call 7ff619be1f84 call 7ff619be525c * 2 850->857 854->831 855->857 857->841 862->829 863->854
                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                              • _get_daylight.LIBCMT ref: 00007FF619BE4FF2
                                                                                                                                                                                                                                                • Part of subcall function 00007FF619BE4748: _invalid_parameter_noinfo.LIBCMT ref: 00007FF619BE475C
                                                                                                                                                                                                                                              • _get_daylight.LIBCMT ref: 00007FF619BE5003
                                                                                                                                                                                                                                                • Part of subcall function 00007FF619BE46E8: _invalid_parameter_noinfo.LIBCMT ref: 00007FF619BE46FC
                                                                                                                                                                                                                                              • _get_daylight.LIBCMT ref: 00007FF619BE5014
                                                                                                                                                                                                                                                • Part of subcall function 00007FF619BE4718: _invalid_parameter_noinfo.LIBCMT ref: 00007FF619BE472C
                                                                                                                                                                                                                                                • Part of subcall function 00007FF619BDA168: RtlFreeHeap.NTDLL(?,?,?,00007FF619BE214A,?,?,?,00007FF619BE2187,?,?,00000000,00007FF619BE2658,?,?,?,00007FF619BE258B), ref: 00007FF619BDA17E
                                                                                                                                                                                                                                                • Part of subcall function 00007FF619BDA168: GetLastError.KERNEL32(?,?,?,00007FF619BE214A,?,?,?,00007FF619BE2187,?,?,00000000,00007FF619BE2658,?,?,?,00007FF619BE258B), ref: 00007FF619BDA188
                                                                                                                                                                                                                                              • GetTimeZoneInformation.KERNELBASE(?,?,?,?,?,?,?,?,?,00000000,?,00007FF619BE5254), ref: 00007FF619BE503B
                                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 00000000.00000002.1925722330.00007FF619BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF619BC0000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1925682521.00007FF619BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1925758127.00007FF619BEA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1925809705.00007FF619BFD000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1925809705.00007FF619C0C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1925902396.00007FF619C0E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_0_2_7ff619bc0000_NEVER OPEN!.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: _get_daylight_invalid_parameter_noinfo$ErrorFreeHeapInformationLastTimeZone
                                                                                                                                                                                                                                              • String ID: Eastern Standard Time$Eastern Summer Time
                                                                                                                                                                                                                                              • API String ID: 3458911817-239921721
                                                                                                                                                                                                                                              • Opcode ID: 8f76df28c868a91264669dac662f976d2c43e9fa87f2a31bca7d0f342cd26d0f
                                                                                                                                                                                                                                              • Instruction ID: 8d5359132c255d671d28050544184ce2dd591aa59bd9cead0e30a92fb6e013fa
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 8f76df28c868a91264669dac662f976d2c43e9fa87f2a31bca7d0f342cd26d0f
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: F8517036E08B4686E720DF26E8815BA7765FB8AF6CF444175EA4DC3696DF3CE4408740
                                                                                                                                                                                                                                              Function 00007FF619BC7780 Relevance: 3.0, APIs: 2, Instructions: 29COMMON
                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 00000000.00000002.1925722330.00007FF619BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF619BC0000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1925682521.00007FF619BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1925758127.00007FF619BEA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1925809705.00007FF619BFD000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1925809705.00007FF619C0C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1925902396.00007FF619C0E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_0_2_7ff619bc0000_NEVER OPEN!.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: Find$CloseFileFirst
                                                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                                                              • API String ID: 2295610775-0
                                                                                                                                                                                                                                              • Opcode ID: 956b6e7c3410f1f64b138177879099c8869163cebd60ae685645dcaa55457231
                                                                                                                                                                                                                                              • Instruction ID: fd3b74e84c8332bf44180ca5bcca7225137e2674adf1c85aaca9ebea32b22f7b
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 956b6e7c3410f1f64b138177879099c8869163cebd60ae685645dcaa55457231
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: A2F08C22A19A8986E7B08F64A49976B7390AB85B3CF004236D66D42AD4DF3CD008CA00
                                                                                                                                                                                                                                              Function 00007FF619BC17B0 Relevance: 21.1, APIs: 2, Strings: 10, Instructions: 144COMMON
                                                                                                                                                                                                                                              Download Yara Rule

                                                                                                                                                                                                                                              Control-flow Graph

                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 00000000.00000002.1925722330.00007FF619BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF619BC0000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1925682521.00007FF619BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1925758127.00007FF619BEA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1925809705.00007FF619BFD000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1925809705.00007FF619C0C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1925902396.00007FF619C0E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_0_2_7ff619bc0000_NEVER OPEN!.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: _fread_nolock$Message_invalid_parameter_noinfo
                                                                                                                                                                                                                                              • String ID: Cannot read Table of Contents.$Could not allocate buffer for TOC!$Could not read full TOC!$Error on file.$Failed to read cookie!$Failed to seek to cookie position!$MEI$fread$fseek$malloc
                                                                                                                                                                                                                                              • API String ID: 2153230061-4158440160
                                                                                                                                                                                                                                              • Opcode ID: fd2fb17d5dab632ef57fdbdf75846562414f3a1323a7561e5ee68d5a2a3c16f2
                                                                                                                                                                                                                                              • Instruction ID: cbd21400f8b79d03137b53b682e729b8261fa20175850ca3b05d16cd7f06b040
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: fd2fb17d5dab632ef57fdbdf75846562414f3a1323a7561e5ee68d5a2a3c16f2
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 6A513872A09E0A86EB64CF29D49427A33A4FB4AF6CB518136DA0DD7399DF7CE441C740
                                                                                                                                                                                                                                              Function 00007FF619BC1440 Relevance: 21.1, APIs: 1, Strings: 11, Instructions: 133COMMON
                                                                                                                                                                                                                                              Download Yara Rule

                                                                                                                                                                                                                                              Control-flow Graph

                                                                                                                                                                                                                                              • Executed
                                                                                                                                                                                                                                              • Not Executed
                                                                                                                                                                                                                                              control_flow_graph 53 7ff619bc1440-7ff619bc1457 call 7ff619bc66e0 56 7ff619bc1462-7ff619bc1485 call 7ff619bc6a00 53->56 57 7ff619bc1459-7ff619bc1461 53->57 60 7ff619bc14a7-7ff619bc14ad 56->60 61 7ff619bc1487-7ff619bc14a2 call 7ff619bc24d0 56->61 63 7ff619bc14e0-7ff619bc14f4 call 7ff619bcf830 60->63 64 7ff619bc14af-7ff619bc14ba call 7ff619bc3c90 60->64 70 7ff619bc1635-7ff619bc1647 61->70 72 7ff619bc1516-7ff619bc151a 63->72 73 7ff619bc14f6-7ff619bc1511 call 7ff619bc24d0 63->73 68 7ff619bc14bf-7ff619bc14c5 64->68 68->63 71 7ff619bc14c7-7ff619bc14db call 7ff619bc2770 68->71 83 7ff619bc1617-7ff619bc161d 71->83 76 7ff619bc1534-7ff619bc1554 call 7ff619bd3e60 72->76 77 7ff619bc151c-7ff619bc1528 call 7ff619bc1050 72->77 73->83 85 7ff619bc1575-7ff619bc157b 76->85 86 7ff619bc1556-7ff619bc1570 call 7ff619bc24d0 76->86 84 7ff619bc152d-7ff619bc152f 77->84 87 7ff619bc161f call 7ff619bcf1c8 83->87 88 7ff619bc162b-7ff619bc162e call 7ff619bcf1c8 83->88 84->83 90 7ff619bc1581-7ff619bc1586 85->90 91 7ff619bc1605-7ff619bc1608 call 7ff619bd3e4c 85->91 99 7ff619bc160d-7ff619bc1612 86->99 97 7ff619bc1624 87->97 98 7ff619bc1633 88->98 96 7ff619bc1590-7ff619bc15b2 call 7ff619bcf518 90->96 91->99 102 7ff619bc15e5-7ff619bc15ec 96->102 103 7ff619bc15b4-7ff619bc15cc call 7ff619bcfc24 96->103 97->88 98->70 99->83 104 7ff619bc15f3-7ff619bc15fb call 7ff619bc24d0 102->104 109 7ff619bc15ce-7ff619bc15d1 103->109 110 7ff619bc15d5-7ff619bc15e3 103->110 111 7ff619bc1600 104->111 109->96 112 7ff619bc15d3 109->112 110->104 111->91 112->111
                                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 00000000.00000002.1925722330.00007FF619BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF619BC0000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1925682521.00007FF619BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1925758127.00007FF619BEA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1925809705.00007FF619BFD000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1925809705.00007FF619C0C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1925902396.00007FF619C0E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_0_2_7ff619bc0000_NEVER OPEN!.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID:
                                                                                                                                                                                                                                              • String ID: Failed to extract %s: failed to allocate temporary buffer!$Failed to extract %s: failed to open archive file!$Failed to extract %s: failed to open target file!$Failed to extract %s: failed to read data chunk!$Failed to extract %s: failed to seek to the entry's data!$Failed to extract %s: failed to write data chunk!$fopen$fread$fseek$fwrite$malloc
                                                                                                                                                                                                                                              • API String ID: 0-666925554
                                                                                                                                                                                                                                              • Opcode ID: 3d6327a83819df1e062a3ab3ea2d343409870a393e5b5268861ae765b978afc7
                                                                                                                                                                                                                                              • Instruction ID: 687723bf93e0500b03d79112e5f53b9622437929502537de11c8aff22248a1d6
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 3d6327a83819df1e062a3ab3ea2d343409870a393e5b5268861ae765b978afc7
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 88518861B08E4A91EA30DF12E4446BB63A8BF47FBCF844535EE1D97696EE3CE5458300
                                                                                                                                                                                                                                              Function 00007FF619BC7800 Relevance: 21.1, APIs: 10, Strings: 2, Instructions: 91COMMON
                                                                                                                                                                                                                                              Download Yara Rule

                                                                                                                                                                                                                                              Control-flow Graph

                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 00000000.00000002.1925722330.00007FF619BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF619BC0000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1925682521.00007FF619BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1925758127.00007FF619BEA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1925809705.00007FF619BFD000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1925809705.00007FF619C0C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1925902396.00007FF619C0E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_0_2_7ff619bc0000_NEVER OPEN!.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: Token$ConvertDescriptorInformationProcessSecurityString$CloseCreateCurrentDirectoryErrorFreeHandleLastLocalOpen
                                                                                                                                                                                                                                              • String ID: D:(A;;FA;;;%s)$S-1-3-4
                                                                                                                                                                                                                                              • API String ID: 4998090-2855260032
                                                                                                                                                                                                                                              • Opcode ID: 6591b1212da81ebedb1b6999a7ad6cd934ab4383e2d97f6c3f94acd8b2e06d7e
                                                                                                                                                                                                                                              • Instruction ID: fcae61e60a318dc9f66ab40b006f0cf64e8ce66a5f0bbea6566f34b5ec5c56f7
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 6591b1212da81ebedb1b6999a7ad6cd934ab4383e2d97f6c3f94acd8b2e06d7e
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: DB415331A1CE4A82EB609F15E4946AB7365FF86FA8F440231EA5E876D5DF7CD448C700
                                                                                                                                                                                                                                              Function 00007FF619BE5C88 Relevance: 13.8, APIs: 9, Instructions: 276fileCOMMON
                                                                                                                                                                                                                                              Download Yara Rule

                                                                                                                                                                                                                                              Control-flow Graph

                                                                                                                                                                                                                                              • Executed
                                                                                                                                                                                                                                              • Not Executed
                                                                                                                                                                                                                                              control_flow_graph 290 7ff619be5c88-7ff619be5cfb call 7ff619be59b8 293 7ff619be5d15-7ff619be5d1f call 7ff619bd6a8c 290->293 294 7ff619be5cfd-7ff619be5d06 call 7ff619bd41d4 290->294 300 7ff619be5d21-7ff619be5d38 call 7ff619bd41d4 call 7ff619bd41f4 293->300 301 7ff619be5d3a-7ff619be5da3 CreateFileW 293->301 299 7ff619be5d09-7ff619be5d10 call 7ff619bd41f4 294->299 317 7ff619be6057-7ff619be6077 299->317 300->299 303 7ff619be5da5-7ff619be5dab 301->303 304 7ff619be5e20-7ff619be5e2b GetFileType 301->304 307 7ff619be5ded-7ff619be5e1b GetLastError call 7ff619bd4168 303->307 308 7ff619be5dad-7ff619be5db1 303->308 310 7ff619be5e7e-7ff619be5e85 304->310 311 7ff619be5e2d-7ff619be5e68 GetLastError call 7ff619bd4168 CloseHandle 304->311 307->299 308->307 315 7ff619be5db3-7ff619be5deb CreateFileW 308->315 313 7ff619be5e8d-7ff619be5e90 310->313 314 7ff619be5e87-7ff619be5e8b 310->314 311->299 325 7ff619be5e6e-7ff619be5e79 call 7ff619bd41f4 311->325 320 7ff619be5e96-7ff619be5eeb call 7ff619bd69a4 313->320 321 7ff619be5e92 313->321 314->320 315->304 315->307 329 7ff619be5f0a-7ff619be5f3b call 7ff619be5740 320->329 330 7ff619be5eed-7ff619be5ef9 call 7ff619be5bc4 320->330 321->320 325->299 335 7ff619be5f41-7ff619be5f84 329->335 336 7ff619be5f3d-7ff619be5f3f 329->336 330->329 337 7ff619be5efb 330->337 339 7ff619be5fa6-7ff619be5fb1 335->339 340 7ff619be5f86-7ff619be5f8a 335->340 338 7ff619be5efd-7ff619be5f05 call 7ff619bda2e0 336->338 337->338 338->317 342 7ff619be6055 339->342 343 7ff619be5fb7-7ff619be5fbb 339->343 340->339 341 7ff619be5f8c-7ff619be5fa1 340->341 341->339 342->317 343->342 345 7ff619be5fc1-7ff619be6006 CloseHandle CreateFileW 343->345 347 7ff619be603b-7ff619be6050 345->347 348 7ff619be6008-7ff619be6036 GetLastError call 7ff619bd4168 call 7ff619bd6bcc 345->348 347->342 348->347
                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 00000000.00000002.1925722330.00007FF619BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF619BC0000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1925682521.00007FF619BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1925758127.00007FF619BEA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1925809705.00007FF619BFD000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1925809705.00007FF619C0C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1925902396.00007FF619C0E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_0_2_7ff619bc0000_NEVER OPEN!.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: File$CreateErrorLast_invalid_parameter_noinfo$CloseHandle$Type_get_daylight
                                                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                                                              • API String ID: 1330151763-0
                                                                                                                                                                                                                                              • Opcode ID: e7a227fa92ea7581bfd134bfea7d4b548e5a44fbdc42318de0dcb122e3032d81
                                                                                                                                                                                                                                              • Instruction ID: 7ac71263ec66ef3603c4661aec47525be3be020f60aa170523440283f7192dff
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: e7a227fa92ea7581bfd134bfea7d4b548e5a44fbdc42318de0dcb122e3032d81
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 22C1B136B28E4A85EB20CFA9C4806AE3765FB4AFACB015235DA1E977D5DF38D455C300
                                                                                                                                                                                                                                              Function 00007FF619BC1000 Relevance: 12.5, APIs: 1, Strings: 6, Instructions: 273COMMON
                                                                                                                                                                                                                                              Download Yara Rule

                                                                                                                                                                                                                                              Control-flow Graph

                                                                                                                                                                                                                                              • Executed
                                                                                                                                                                                                                                              • Not Executed
                                                                                                                                                                                                                                              control_flow_graph 353 7ff619bc1000-7ff619bc3666 call 7ff619bcefa0 call 7ff619bcef98 call 7ff619bc7560 call 7ff619bcef98 call 7ff619bcacf0 call 7ff619bd4020 call 7ff619bd4cc8 call 7ff619bc1af0 371 7ff619bc366c-7ff619bc367b call 7ff619bc3b80 353->371 372 7ff619bc377a 353->372 371->372 377 7ff619bc3681-7ff619bc3694 call 7ff619bc3a50 371->377 374 7ff619bc377f-7ff619bc379f call 7ff619bcacc0 372->374 377->372 381 7ff619bc369a-7ff619bc36ad call 7ff619bc3b00 377->381 381->372 384 7ff619bc36b3-7ff619bc36da call 7ff619bc6950 381->384 387 7ff619bc371c-7ff619bc3744 call 7ff619bc6ef0 call 7ff619bc19d0 384->387 388 7ff619bc36dc-7ff619bc36eb call 7ff619bc6950 384->388 399 7ff619bc382d-7ff619bc383e 387->399 400 7ff619bc374a-7ff619bc3760 call 7ff619bc19d0 387->400 388->387 394 7ff619bc36ed-7ff619bc36f3 388->394 396 7ff619bc36ff-7ff619bc3719 call 7ff619bd3e4c call 7ff619bc6ef0 394->396 397 7ff619bc36f5-7ff619bc36fd 394->397 396->387 397->396 402 7ff619bc3840-7ff619bc384a call 7ff619bc3260 399->402 403 7ff619bc3853-7ff619bc386b call 7ff619bc7990 399->403 412 7ff619bc37a0-7ff619bc37a3 400->412 413 7ff619bc3762-7ff619bc3775 call 7ff619bc2770 400->413 415 7ff619bc384c 402->415 416 7ff619bc388b-7ff619bc3898 call 7ff619bc5e20 402->416 417 7ff619bc387e-7ff619bc3885 SetDllDirectoryW 403->417 418 7ff619bc386d-7ff619bc3879 call 7ff619bc2770 403->418 412->399 414 7ff619bc37a9-7ff619bc37c0 call 7ff619bc3c90 412->414 413->372 428 7ff619bc37c2-7ff619bc37c5 414->428 429 7ff619bc37c7-7ff619bc37f3 call 7ff619bc7160 414->429 415->403 426 7ff619bc38e6-7ff619bc38eb call 7ff619bc5da0 416->426 427 7ff619bc389a-7ff619bc38aa call 7ff619bc5ac0 416->427 417->416 418->372 434 7ff619bc38f0-7ff619bc38f3 426->434 427->426 441 7ff619bc38ac-7ff619bc38bb call 7ff619bc5620 427->441 432 7ff619bc3802-7ff619bc3818 call 7ff619bc2770 428->432 442 7ff619bc37f5-7ff619bc37fd call 7ff619bcf1c8 429->442 443 7ff619bc381d-7ff619bc382b 429->443 432->372 439 7ff619bc38f9-7ff619bc3906 434->439 440 7ff619bc39a6-7ff619bc39b5 call 7ff619bc30f0 434->440 444 7ff619bc3910-7ff619bc391a 439->444 440->372 457 7ff619bc39bb-7ff619bc39f2 call 7ff619bc6e80 call 7ff619bc6950 call 7ff619bc53c0 440->457 455 7ff619bc38bd-7ff619bc38c9 call 7ff619bc55b0 441->455 456 7ff619bc38dc-7ff619bc38e1 call 7ff619bc5870 441->456 442->432 443->402 448 7ff619bc3923-7ff619bc3925 444->448 449 7ff619bc391c-7ff619bc3921 444->449 453 7ff619bc3971-7ff619bc39a1 call 7ff619bc3250 call 7ff619bc3090 call 7ff619bc3240 call 7ff619bc5870 call 7ff619bc5da0 448->453 454 7ff619bc3927-7ff619bc394a call 7ff619bc1b30 448->454 449->444 449->448 453->374 454->372 467 7ff619bc3950-7ff619bc395b 454->467 455->456 468 7ff619bc38cb-7ff619bc38da call 7ff619bc5c70 455->468 456->426 457->372 480 7ff619bc39f8-7ff619bc3a2d call 7ff619bc3250 call 7ff619bc6f30 call 7ff619bc5870 call 7ff619bc5da0 457->480 471 7ff619bc3960-7ff619bc396f 467->471 468->434 471->453 471->471 493 7ff619bc3a2f-7ff619bc3a32 call 7ff619bc6bf0 480->493 494 7ff619bc3a37-7ff619bc3a41 call 7ff619bc1ab0 480->494 493->494 494->374
                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                                • Part of subcall function 00007FF619BC3B80: GetModuleFileNameW.KERNEL32(?,00007FF619BC3679), ref: 00007FF619BC3BB1
                                                                                                                                                                                                                                              • SetDllDirectoryW.KERNEL32 ref: 00007FF619BC3885
                                                                                                                                                                                                                                                • Part of subcall function 00007FF619BC6950: GetEnvironmentVariableW.KERNEL32(00007FF619BC36C7), ref: 00007FF619BC698A
                                                                                                                                                                                                                                                • Part of subcall function 00007FF619BC6950: ExpandEnvironmentStringsW.KERNEL32 ref: 00007FF619BC69A7
                                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 00000000.00000002.1925722330.00007FF619BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF619BC0000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1925682521.00007FF619BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1925758127.00007FF619BEA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1925809705.00007FF619BFD000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1925809705.00007FF619C0C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1925902396.00007FF619C0E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_0_2_7ff619bc0000_NEVER OPEN!.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: Environment$DirectoryExpandFileModuleNameStringsVariable
                                                                                                                                                                                                                                              • String ID: Cannot open PyInstaller archive from executable (%s) or external archive (%s)$Cannot side-load external archive %s (code %d)!$Failed to convert DLL search path!$MEI$_MEIPASS2$_PYI_ONEDIR_MODE
                                                                                                                                                                                                                                              • API String ID: 2344891160-3602715111
                                                                                                                                                                                                                                              • Opcode ID: 9f0e273dc311e8e4279b495ec382b8c4859f8b905af7ade748eed1cf2cadde61
                                                                                                                                                                                                                                              • Instruction ID: 5b18c65e6a4185351a7c542fbc6f5166c9eac7bfe068f0f5fbf4a712142d8d01
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 9f0e273dc311e8e4279b495ec382b8c4859f8b905af7ade748eed1cf2cadde61
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 63B16E61A1DE8B41FA75AF2198516FF2254BF46FACF804032EA4DC7796EE2CE605C740
                                                                                                                                                                                                                                              Function 00007FF619BC1050 Relevance: 12.4, APIs: 1, Strings: 6, Instructions: 156COMMON
                                                                                                                                                                                                                                              Download Yara Rule

                                                                                                                                                                                                                                              Control-flow Graph

                                                                                                                                                                                                                                              • Executed
                                                                                                                                                                                                                                              • Not Executed
                                                                                                                                                                                                                                              control_flow_graph 498 7ff619bc1050-7ff619bc10ab call 7ff619bc98a0 501 7ff619bc10d3-7ff619bc10eb call 7ff619bd3e60 498->501 502 7ff619bc10ad-7ff619bc10d2 call 7ff619bc2770 498->502 507 7ff619bc1109-7ff619bc1119 call 7ff619bd3e60 501->507 508 7ff619bc10ed-7ff619bc1104 call 7ff619bc24d0 501->508 514 7ff619bc1137-7ff619bc1147 507->514 515 7ff619bc111b-7ff619bc1132 call 7ff619bc24d0 507->515 513 7ff619bc126c-7ff619bc1281 call 7ff619bc9590 call 7ff619bd3e4c * 2 508->513 530 7ff619bc1286-7ff619bc12a0 513->530 517 7ff619bc1150-7ff619bc1175 call 7ff619bcf518 514->517 515->513 524 7ff619bc125e 517->524 525 7ff619bc117b-7ff619bc1185 call 7ff619bcf28c 517->525 527 7ff619bc1264 524->527 525->524 532 7ff619bc118b-7ff619bc1197 525->532 527->513 533 7ff619bc11a0-7ff619bc11c8 call 7ff619bc7d10 532->533 536 7ff619bc1241-7ff619bc125c call 7ff619bc2770 533->536 537 7ff619bc11ca-7ff619bc11cd 533->537 536->527 538 7ff619bc11cf-7ff619bc11d9 537->538 539 7ff619bc123c 537->539 541 7ff619bc1203-7ff619bc1206 538->541 542 7ff619bc11db-7ff619bc11e8 call 7ff619bcfc24 538->542 539->536 545 7ff619bc1219-7ff619bc121e 541->545 546 7ff619bc1208-7ff619bc1216 call 7ff619bcba90 541->546 548 7ff619bc11ed-7ff619bc11f0 542->548 545->533 547 7ff619bc1220-7ff619bc1223 545->547 546->545 550 7ff619bc1225-7ff619bc1228 547->550 551 7ff619bc1237-7ff619bc123a 547->551 552 7ff619bc11fe-7ff619bc1201 548->552 553 7ff619bc11f2-7ff619bc11fc call 7ff619bcf28c 548->553 550->536 555 7ff619bc122a-7ff619bc1232 550->555 551->527 552->536 553->545 553->552 555->517
                                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 00000000.00000002.1925722330.00007FF619BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF619BC0000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1925682521.00007FF619BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1925758127.00007FF619BEA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1925809705.00007FF619BFD000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1925809705.00007FF619C0C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1925902396.00007FF619C0E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_0_2_7ff619bc0000_NEVER OPEN!.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: Message
                                                                                                                                                                                                                                              • String ID: 1.2.12$Failed to extract %s: decompression resulted in return code %d!$Failed to extract %s: failed to allocate temporary input buffer!$Failed to extract %s: failed to allocate temporary output buffer!$Failed to extract %s: inflateInit() failed with return code %d!$malloc
                                                                                                                                                                                                                                              • API String ID: 2030045667-1282086711
                                                                                                                                                                                                                                              • Opcode ID: dfdf3b8f897ff59509150817e1d185143b8d85a9ecd279bdc521859ec2b6aa83
                                                                                                                                                                                                                                              • Instruction ID: 7f76304541f4b7ea47553d867fa7a84fe40b3c6db2dd7136ac293367922c2709
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: dfdf3b8f897ff59509150817e1d185143b8d85a9ecd279bdc521859ec2b6aa83
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 0651CF22A09E8A85EA709F51E4403BB6294FB86FACF444136EE4DDB785EF3CE545C700
                                                                                                                                                                                                                                              Function 00007FF619BDE158 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 117libraryloaderCOMMONLIBRARYCODE
                                                                                                                                                                                                                                              Download Yara Rule

                                                                                                                                                                                                                                              Control-flow Graph

                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                              • FreeLibrary.KERNEL32(?,00000000,?,00007FF619BDE4F6,?,?,-00000018,00007FF619BDA572,?,?,?,00007FF619BDA46A,?,?,?,00007FF619BD5222), ref: 00007FF619BDE2D7
                                                                                                                                                                                                                                              • GetProcAddress.KERNEL32(?,00000000,?,00007FF619BDE4F6,?,?,-00000018,00007FF619BDA572,?,?,?,00007FF619BDA46A,?,?,?,00007FF619BD5222), ref: 00007FF619BDE2E3
                                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 00000000.00000002.1925722330.00007FF619BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF619BC0000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1925682521.00007FF619BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1925758127.00007FF619BEA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1925809705.00007FF619BFD000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1925809705.00007FF619C0C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1925902396.00007FF619C0E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_0_2_7ff619bc0000_NEVER OPEN!.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: AddressFreeLibraryProc
                                                                                                                                                                                                                                              • String ID: api-ms-$ext-ms-
                                                                                                                                                                                                                                              • API String ID: 3013587201-537541572
                                                                                                                                                                                                                                              • Opcode ID: a2ae2c3a07d48552731a8859b03eb7dfad6cfb60df2b5b495a033224e1b0bc41
                                                                                                                                                                                                                                              • Instruction ID: 07dbb5e25e906787717d6be66f1009551eea7e823806dbe2da8bf113e8d8d1b9
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: a2ae2c3a07d48552731a8859b03eb7dfad6cfb60df2b5b495a033224e1b0bc41
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 7641AD62B19E0A41FA219F5698146A722D6BF4BFFCF084535DD1DCBB88DE3CE4458300
                                                                                                                                                                                                                                              Function 00007FF619BC6F30 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 93processsynchronizationCOMMON
                                                                                                                                                                                                                                              Download Yara Rule

                                                                                                                                                                                                                                              Control-flow Graph

                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                                • Part of subcall function 00007FF619BC7990: MultiByteToWideChar.KERNEL32 ref: 00007FF619BC79CA
                                                                                                                                                                                                                                                • Part of subcall function 00007FF619BD70F8: SetConsoleCtrlHandler.KERNEL32(?,?,?,?,?,?,?,?,?,?,00000000,00000000,00000000,00007FF619BD9584), ref: 00007FF619BD7165
                                                                                                                                                                                                                                                • Part of subcall function 00007FF619BD70F8: GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,00000000,00000000,00000000,00007FF619BD9584), ref: 00007FF619BD7178
                                                                                                                                                                                                                                              • GetStartupInfoW.KERNEL32 ref: 00007FF619BC6FB7
                                                                                                                                                                                                                                                • Part of subcall function 00007FF619BD94E4: _invalid_parameter_noinfo.LIBCMT ref: 00007FF619BD94F8
                                                                                                                                                                                                                                                • Part of subcall function 00007FF619BD6C88: _invalid_parameter_noinfo.LIBCMT ref: 00007FF619BD6CEF
                                                                                                                                                                                                                                              • GetCommandLineW.KERNEL32 ref: 00007FF619BC703F
                                                                                                                                                                                                                                              • CreateProcessW.KERNELBASE ref: 00007FF619BC7081
                                                                                                                                                                                                                                              • WaitForSingleObject.KERNEL32 ref: 00007FF619BC7095
                                                                                                                                                                                                                                              • GetExitCodeProcess.KERNELBASE ref: 00007FF619BC70A5
                                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 00000000.00000002.1925722330.00007FF619BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF619BC0000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1925682521.00007FF619BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1925758127.00007FF619BEA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1925809705.00007FF619BFD000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1925809705.00007FF619C0C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1925902396.00007FF619C0E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_0_2_7ff619bc0000_NEVER OPEN!.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: Process_invalid_parameter_noinfo$ByteCharCodeCommandConsoleCreateCtrlErrorExitHandlerInfoLastLineMultiObjectSingleStartupWaitWide
                                                                                                                                                                                                                                              • String ID: CreateProcessW$Error creating child process!
                                                                                                                                                                                                                                              • API String ID: 1742298069-3524285272
                                                                                                                                                                                                                                              • Opcode ID: 1cd61e54566385a94fb47874bd0fcb1c582be0e90f0846e9646c3e9263d15197
                                                                                                                                                                                                                                              • Instruction ID: 58d41b7295ce28464cfe163412b855a86aaf19c28df09c8580679a61382bae16
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 1cd61e54566385a94fb47874bd0fcb1c582be0e90f0846e9646c3e9263d15197
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: A2414331A08A8582D730DF64E4952EBB3A4FB96B68F404139E69D83796DF7CD454CB40
                                                                                                                                                                                                                                              Function 00007FF619BDC7BC Relevance: 6.2, APIs: 4, Instructions: 218COMMON
                                                                                                                                                                                                                                              Download Yara Rule

                                                                                                                                                                                                                                              Control-flow Graph

                                                                                                                                                                                                                                              • Executed
                                                                                                                                                                                                                                              • Not Executed
                                                                                                                                                                                                                                              control_flow_graph 884 7ff619bdc7bc-7ff619bdc7e1 885 7ff619bdc7e7-7ff619bdc7ea 884->885 886 7ff619bdcab9 884->886 888 7ff619bdc823-7ff619bdc84e 885->888 889 7ff619bdc7ec-7ff619bdc81e call 7ff619bda030 885->889 887 7ff619bdcabb-7ff619bdcacb 886->887 891 7ff619bdc850-7ff619bdc857 888->891 892 7ff619bdc859-7ff619bdc85f 888->892 889->887 891->889 891->892 893 7ff619bdc86f-7ff619bdc888 call 7ff619be2a30 892->893 894 7ff619bdc861-7ff619bdc86a call 7ff619bdbb58 892->894 899 7ff619bdc9a5-7ff619bdc9ae 893->899 900 7ff619bdc88e-7ff619bdc897 893->900 894->893 901 7ff619bdca01-7ff619bdca26 WriteFile 899->901 902 7ff619bdc9b0-7ff619bdc9b5 899->902 900->899 903 7ff619bdc89d-7ff619bdc8a1 900->903 908 7ff619bdca31 901->908 909 7ff619bdca28-7ff619bdca2e GetLastError 901->909 904 7ff619bdc9ed-7ff619bdc9ff call 7ff619bdc26c 902->904 905 7ff619bdc9b7-7ff619bdc9ba 902->905 906 7ff619bdc8a3-7ff619bdc8af call 7ff619bd37d0 903->906 907 7ff619bdc8b6-7ff619bdc8c1 903->907 930 7ff619bdc98e-7ff619bdc995 904->930 911 7ff619bdc9bc-7ff619bdc9bf 905->911 912 7ff619bdc9d9-7ff619bdc9eb call 7ff619bdc48c 905->912 906->907 915 7ff619bdc8c3-7ff619bdc8cc 907->915 916 7ff619bdc8d2-7ff619bdc8e7 GetConsoleMode 907->916 910 7ff619bdca34 908->910 909->908 917 7ff619bdca39 910->917 918 7ff619bdc9c5-7ff619bdc9d7 call 7ff619bdc370 911->918 919 7ff619bdca49-7ff619bdca53 911->919 912->930 915->899 915->916 923 7ff619bdc99a-7ff619bdc99e 916->923 924 7ff619bdc8ed-7ff619bdc8f0 916->924 925 7ff619bdca3e-7ff619bdca42 917->925 918->930 926 7ff619bdcab2-7ff619bdcab7 919->926 927 7ff619bdca55-7ff619bdca5a 919->927 923->899 931 7ff619bdc977-7ff619bdc989 call 7ff619bdbde0 924->931 932 7ff619bdc8f6-7ff619bdc8fd 924->932 925->919 926->887 934 7ff619bdca5c-7ff619bdca5f 927->934 935 7ff619bdca88-7ff619bdca92 927->935 930->917 931->930 932->925 933 7ff619bdc903-7ff619bdc911 932->933 933->910 938 7ff619bdc917 933->938 939 7ff619bdca61-7ff619bdca70 934->939 940 7ff619bdca78-7ff619bdca83 call 7ff619bd41b0 934->940 941 7ff619bdca94-7ff619bdca98 935->941 942 7ff619bdca9a-7ff619bdcaa9 935->942 943 7ff619bdc91a-7ff619bdc931 call 7ff619be2afc 938->943 939->940 940->935 941->886 941->942 942->926 948 7ff619bdc933-7ff619bdc93d 943->948 949 7ff619bdc969-7ff619bdc972 GetLastError 943->949 950 7ff619bdc93f-7ff619bdc951 call 7ff619be2afc 948->950 951 7ff619bdc95a-7ff619bdc961 948->951 949->910 950->949 955 7ff619bdc953-7ff619bdc958 950->955 951->910 953 7ff619bdc967 951->953 953->943 955->951
                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                              • GetConsoleMode.KERNEL32(?,?,?,?,?,?,?,?,?,?,00000000,00000000,00007FF619BDC75C), ref: 00007FF619BDC8DF
                                                                                                                                                                                                                                              • GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,00000000,00000000,00007FF619BDC75C), ref: 00007FF619BDC969
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 00000000.00000002.1925722330.00007FF619BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF619BC0000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1925682521.00007FF619BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1925758127.00007FF619BEA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1925809705.00007FF619BFD000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1925809705.00007FF619C0C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1925902396.00007FF619C0E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_0_2_7ff619bc0000_NEVER OPEN!.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: ConsoleErrorLastMode
                                                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                                                              • API String ID: 953036326-0
                                                                                                                                                                                                                                              • Opcode ID: fd137403e6e97c1a5ba82b3419691a9ebc8bf035f7c52069c471a636664b9908
                                                                                                                                                                                                                                              • Instruction ID: be6f3a06a823aac3d51a3273ad796ac6a915bdfe65e614057aa53dc8d0f54c67
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: fd137403e6e97c1a5ba82b3419691a9ebc8bf035f7c52069c471a636664b9908
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 2291CE62E18E5A89FB61CF6594446BE2BE0BB06FACF445136DE0E93788CF3CD4418300
                                                                                                                                                                                                                                              Function 00007FF619BDEC40 Relevance: 6.2, APIs: 4, Instructions: 161COMMON
                                                                                                                                                                                                                                              Download Yara Rule

                                                                                                                                                                                                                                              Control-flow Graph

                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 00000000.00000002.1925722330.00007FF619BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF619BC0000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1925682521.00007FF619BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1925758127.00007FF619BEA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1925809705.00007FF619BFD000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1925809705.00007FF619C0C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1925902396.00007FF619C0E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_0_2_7ff619bc0000_NEVER OPEN!.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: _get_daylight$_isindst
                                                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                                                              • API String ID: 4170891091-0
                                                                                                                                                                                                                                              • Opcode ID: 9a335e65895d815b06806fcf897e1ccafa5e2f7da5d283a57fe6a61041334353
                                                                                                                                                                                                                                              • Instruction ID: 8dbd0abd57a069956092aacc21f5137f47bc6686ffc85028c075c63a086db277
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 9a335e65895d815b06806fcf897e1ccafa5e2f7da5d283a57fe6a61041334353
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: A851F472F04A1A4AFB78CF6499815BE27E5AB06B6CF500135EE1E96BD5DF38B402C700
                                                                                                                                                                                                                                              Function 00007FF619BD4584 Relevance: 6.1, APIs: 4, Instructions: 119pipeCOMMON
                                                                                                                                                                                                                                              Download Yara Rule

                                                                                                                                                                                                                                              Control-flow Graph

                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 00000000.00000002.1925722330.00007FF619BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF619BC0000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1925682521.00007FF619BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1925758127.00007FF619BEA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1925809705.00007FF619BFD000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1925809705.00007FF619C0C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1925902396.00007FF619C0E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_0_2_7ff619bc0000_NEVER OPEN!.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: File$ErrorHandleInformationLastNamedPeekPipeType
                                                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                                                              • API String ID: 2780335769-0
                                                                                                                                                                                                                                              • Opcode ID: f08af1c1a1b606dce196c74d6fc6f8963a34cf033d17d6b560bcf375e956dfcc
                                                                                                                                                                                                                                              • Instruction ID: 28892d7ef669e73e5d53084280a4a7ad0571d05ba86268eb55e684f399a80da2
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: f08af1c1a1b606dce196c74d6fc6f8963a34cf033d17d6b560bcf375e956dfcc
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 08518A22A08A458AFB20CFB1D4513BE33E6AB4AFACF154135DE4997788DF3CD4458700
                                                                                                                                                                                                                                              Function 00007FF619BCAE2C Relevance: 6.1, APIs: 4, Instructions: 94COMMON
                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 00000000.00000002.1925722330.00007FF619BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF619BC0000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1925682521.00007FF619BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1925758127.00007FF619BEA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1925809705.00007FF619BFD000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1925809705.00007FF619C0C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1925902396.00007FF619C0E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_0_2_7ff619bc0000_NEVER OPEN!.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: __scrt_acquire_startup_lock__scrt_dllmain_crt_thread_attach__scrt_get_show_window_mode__scrt_initialize_crt__scrt_release_startup_lock
                                                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                                                              • API String ID: 1452418845-0
                                                                                                                                                                                                                                              • Opcode ID: 2dfea9045f881ff78022f3a65fc22168407db2ca461a817ccd3f57a6f463f9a5
                                                                                                                                                                                                                                              • Instruction ID: ddad11dad88b26954ec2b3970e425729b6eeaf6e647957d09e5c934a91a89cc4
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 2dfea9045f881ff78022f3a65fc22168407db2ca461a817ccd3f57a6f463f9a5
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: F5311721E08E1F86EA34AF6594553BF22A59F83F6CF440038E94ECB7D3DE2CA805D251
                                                                                                                                                                                                                                              Function 00007FF619BD4430 Relevance: 6.1, APIs: 4, Instructions: 90fileCOMMON
                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 00000000.00000002.1925722330.00007FF619BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF619BC0000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1925682521.00007FF619BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1925758127.00007FF619BEA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1925809705.00007FF619BFD000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1925809705.00007FF619C0C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1925902396.00007FF619C0E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_0_2_7ff619bc0000_NEVER OPEN!.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: CloseCreateFileHandle_invalid_parameter_noinfo
                                                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                                                              • API String ID: 1279662727-0
                                                                                                                                                                                                                                              • Opcode ID: aff0d7c093882a4d26d3a8b99022a8fcabbcfeaf98423b8fc509e437e0bc8c36
                                                                                                                                                                                                                                              • Instruction ID: 4120dc962e54ac8e9046ad6bed1c6f7d4c8a2b99f0523f60cc2b0a4fb60bde6b
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: aff0d7c093882a4d26d3a8b99022a8fcabbcfeaf98423b8fc509e437e0bc8c36
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: DC418222D18B8683F7648F6195103AA63A1FB96F7CF109334EA9C43BD1DF6CA5E08700
                                                                                                                                                                                                                                              Function 00007FF619BD8BE0 Relevance: 4.5, APIs: 3, Instructions: 14COMMON
                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 00000000.00000002.1925722330.00007FF619BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF619BC0000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1925682521.00007FF619BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1925758127.00007FF619BEA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1925809705.00007FF619BFD000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1925809705.00007FF619C0C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1925902396.00007FF619C0E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_0_2_7ff619bc0000_NEVER OPEN!.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: Process$CurrentExitTerminate
                                                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                                                              • API String ID: 1703294689-0
                                                                                                                                                                                                                                              • Opcode ID: d62060bd09c98f63d26231482086f6b03c071e5e7110db56bdb808fa1e27c3c8
                                                                                                                                                                                                                                              • Instruction ID: 023c47a6a963ef596c7731fd7fbd099b56ba3bc42643e86dcae7bf9a29fb0eb4
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: d62060bd09c98f63d26231482086f6b03c071e5e7110db56bdb808fa1e27c3c8
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: D2D09E10B09F0A82EA797F76589557A125D5F5BF6EF141478C80F86393CD2CA4898302
                                                                                                                                                                                                                                              Function 00007FF619BCF2B8 Relevance: 3.2, APIs: 2, Instructions: 175COMMONLIBRARYCODE
                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 00000000.00000002.1925722330.00007FF619BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF619BC0000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1925682521.00007FF619BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1925758127.00007FF619BEA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1925809705.00007FF619BFD000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1925809705.00007FF619C0C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1925902396.00007FF619C0E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_0_2_7ff619bc0000_NEVER OPEN!.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: _invalid_parameter_noinfo
                                                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                                                              • API String ID: 3215553584-0
                                                                                                                                                                                                                                              • Opcode ID: 46a2af1879c2f50747042a3ab55741b4931bc27440d9acf90303e4543271f7f8
                                                                                                                                                                                                                                              • Instruction ID: 60af2eb5fd27291d52924c93652fd45c522b7e0cf0265f29bceee99b92e86bfe
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 46a2af1879c2f50747042a3ab55741b4931bc27440d9acf90303e4543271f7f8
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: AC510321B09A9A96FB389E66940067B6691BF86FBCF144375EE6DC77C5CF3CE4018600
                                                                                                                                                                                                                                              Function 00007FF619BDB96C Relevance: 3.0, APIs: 2, Instructions: 46COMMONLIBRARYCODE
                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                              • SetFilePointerEx.KERNELBASE(?,?,?,?,00000000,00007FF619BDBB05), ref: 00007FF619BDB9B8
                                                                                                                                                                                                                                              • GetLastError.KERNEL32(?,?,?,?,00000000,00007FF619BDBB05), ref: 00007FF619BDB9C2
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 00000000.00000002.1925722330.00007FF619BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF619BC0000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1925682521.00007FF619BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1925758127.00007FF619BEA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1925809705.00007FF619BFD000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1925809705.00007FF619C0C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1925902396.00007FF619C0E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_0_2_7ff619bc0000_NEVER OPEN!.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: ErrorFileLastPointer
                                                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                                                              • API String ID: 2976181284-0
                                                                                                                                                                                                                                              • Opcode ID: 1eb380e80a89d0b1773f03f267f74a86f3d4599d947c953e904cec0139cff5ef
                                                                                                                                                                                                                                              • Instruction ID: 9ea1c1878fbe30ba209960072135d6133c1396b5de8fbafe9d41d2aad919a042
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 1eb380e80a89d0b1773f03f267f74a86f3d4599d947c953e904cec0139cff5ef
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 3611BF61A18E9681DA208F26A40417A67A1AB86FFCF544331EABD877D9CE7CD0548740
                                                                                                                                                                                                                                              Function 00007FF619BD472C Relevance: 3.0, APIs: 2, Instructions: 40timeCOMMON
                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                              • FileTimeToSystemTime.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF619BD4641), ref: 00007FF619BD475F
                                                                                                                                                                                                                                              • SystemTimeToTzSpecificLocalTime.KERNELBASE(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF619BD4641), ref: 00007FF619BD4775
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 00000000.00000002.1925722330.00007FF619BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF619BC0000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1925682521.00007FF619BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1925758127.00007FF619BEA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1925809705.00007FF619BFD000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1925809705.00007FF619C0C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1925902396.00007FF619C0E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_0_2_7ff619bc0000_NEVER OPEN!.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: Time$System$FileLocalSpecific
                                                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                                                              • API String ID: 1707611234-0
                                                                                                                                                                                                                                              • Opcode ID: 6efbe7fb942df77ddbf8decce42db6b9a9834a1eccc0b4e17cd5f894f5c9f7f5
                                                                                                                                                                                                                                              • Instruction ID: 2c868d5e064b850251a71dce70a2a1dd151129ef7b2f2f1adae3ad8498e422f1
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 6efbe7fb942df77ddbf8decce42db6b9a9834a1eccc0b4e17cd5f894f5c9f7f5
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 6811826160CA4A82EB648F55E41107BB7A2EB86F79F500235E6ADC5AD8EF6CD014CB00
                                                                                                                                                                                                                                              Function 00007FF619BD6714 Relevance: 3.0, APIs: 2, Instructions: 35timeCOMMONLIBRARYCODE
                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                              • FileTimeToSystemTime.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF619BD6591), ref: 00007FF619BD6737
                                                                                                                                                                                                                                              • SystemTimeToTzSpecificLocalTime.KERNELBASE(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF619BD6591), ref: 00007FF619BD674D
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 00000000.00000002.1925722330.00007FF619BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF619BC0000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1925682521.00007FF619BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1925758127.00007FF619BEA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1925809705.00007FF619BFD000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1925809705.00007FF619C0C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1925902396.00007FF619C0E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_0_2_7ff619bc0000_NEVER OPEN!.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: Time$System$FileLocalSpecific
                                                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                                                              • API String ID: 1707611234-0
                                                                                                                                                                                                                                              • Opcode ID: a68cac1c454e300f8b3e4b6d5a5d178c803399669668747c19dbdf19a8985f4c
                                                                                                                                                                                                                                              • Instruction ID: 3314917f2eafa2f52d0b34d036fe3f2a20c8abd36fcce6a10e6f671a8f4b2f1d
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: a68cac1c454e300f8b3e4b6d5a5d178c803399669668747c19dbdf19a8985f4c
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: FC018E2250CA59C2E7649F15E40123BB3A0FB82F7DF600336EAA9816D8DF3DD414DB00
                                                                                                                                                                                                                                              Function 00007FF619BDA168 Relevance: 3.0, APIs: 2, Instructions: 19memoryCOMMONLIBRARYCODE
                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                              • RtlFreeHeap.NTDLL(?,?,?,00007FF619BE214A,?,?,?,00007FF619BE2187,?,?,00000000,00007FF619BE2658,?,?,?,00007FF619BE258B), ref: 00007FF619BDA17E
                                                                                                                                                                                                                                              • GetLastError.KERNEL32(?,?,?,00007FF619BE214A,?,?,?,00007FF619BE2187,?,?,00000000,00007FF619BE2658,?,?,?,00007FF619BE258B), ref: 00007FF619BDA188
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 00000000.00000002.1925722330.00007FF619BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF619BC0000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1925682521.00007FF619BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1925758127.00007FF619BEA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1925809705.00007FF619BFD000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1925809705.00007FF619C0C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1925902396.00007FF619C0E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_0_2_7ff619bc0000_NEVER OPEN!.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: ErrorFreeHeapLast
                                                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                                                              • API String ID: 485612231-0
                                                                                                                                                                                                                                              • Opcode ID: a673a507b2d9f362c5f5c34d7f5e537087e665f3a82958f491e2c6c5d4392de6
                                                                                                                                                                                                                                              • Instruction ID: 9e1ddb109eb2b059439b5407fb77150af8176a12e0766ab9af0a31b700263de3
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: a673a507b2d9f362c5f5c34d7f5e537087e665f3a82958f491e2c6c5d4392de6
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: BCE08654F09E0A42FF399FB2A88517A25955F56F2CF040030C90DC2392DE2C68858200
                                                                                                                                                                                                                                              Function 00007FF619BD72D4 Relevance: 3.0, APIs: 2, Instructions: 12fileCOMMON
                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 00000000.00000002.1925722330.00007FF619BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF619BC0000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1925682521.00007FF619BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1925758127.00007FF619BEA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1925809705.00007FF619BFD000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1925809705.00007FF619C0C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1925902396.00007FF619C0E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_0_2_7ff619bc0000_NEVER OPEN!.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: DeleteErrorFileLast
                                                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                                                              • API String ID: 2018770650-0
                                                                                                                                                                                                                                              • Opcode ID: d7499c624ee991937a4b8caa9e62551e14322714b0d7c9d890be704f6f569852
                                                                                                                                                                                                                                              • Instruction ID: 51df59fe68bfb704d2d90c02ee97d3947a6037be78c2d9a581ebcec5bf900723
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: d7499c624ee991937a4b8caa9e62551e14322714b0d7c9d890be704f6f569852
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 35D0C950E1ED8B81E6342FB618854BB26D85F57F3CF500670D46DC02D1DE5CA4894201
                                                                                                                                                                                                                                              Function 00007FF619BD647C Relevance: 3.0, APIs: 2, Instructions: 12COMMON
                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 00000000.00000002.1925722330.00007FF619BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF619BC0000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1925682521.00007FF619BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1925758127.00007FF619BEA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1925809705.00007FF619BFD000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1925809705.00007FF619C0C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1925902396.00007FF619C0E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_0_2_7ff619bc0000_NEVER OPEN!.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: DirectoryErrorLastRemove
                                                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                                                              • API String ID: 377330604-0
                                                                                                                                                                                                                                              • Opcode ID: 6788dfb68509012efa5509a4fad9878ebfe710630e44273c153ed33f720737c1
                                                                                                                                                                                                                                              • Instruction ID: c389392e87aa04bcb56dcceba6b6b8b73fd30842affaa47bbc757a654d54654c
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 6788dfb68509012efa5509a4fad9878ebfe710630e44273c153ed33f720737c1
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 9DD0C914E69D0A81E6342FB2188507B22D81F56F3CF500679D42DC02D1DE2CA5994601
                                                                                                                                                                                                                                              Function 00007FF619BDA378 Relevance: 2.6, APIs: 2, Instructions: 59COMMON
                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                              • CloseHandle.KERNELBASE(?,?,?,00007FF619BDA1F5,?,?,00000000,00007FF619BDA2AA), ref: 00007FF619BDA3E6
                                                                                                                                                                                                                                              • GetLastError.KERNEL32(?,?,?,00007FF619BDA1F5,?,?,00000000,00007FF619BDA2AA), ref: 00007FF619BDA3F0
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 00000000.00000002.1925722330.00007FF619BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF619BC0000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1925682521.00007FF619BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1925758127.00007FF619BEA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1925809705.00007FF619BFD000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1925809705.00007FF619C0C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1925902396.00007FF619C0E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_0_2_7ff619bc0000_NEVER OPEN!.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: CloseErrorHandleLast
                                                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                                                              • API String ID: 918212764-0
                                                                                                                                                                                                                                              • Opcode ID: 6d510294f211babb34c62ae7a866304dc7809045747c103bf26d8d248780cbcb
                                                                                                                                                                                                                                              • Instruction ID: 3d680c131f722e6492fd9451d1fad8d2bcc94f93d7ab302be983eda5bb472c85
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 6d510294f211babb34c62ae7a866304dc7809045747c103bf26d8d248780cbcb
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 36219321F18F8681EE749F65949427E16D29F86FBCF584239DA2EC77D2CE6CA4458300
                                                                                                                                                                                                                                              Function 00007FF619BC6BF0 Relevance: 1.6, APIs: 1, Instructions: 141COMMON
                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 00000000.00000002.1925722330.00007FF619BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF619BC0000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1925682521.00007FF619BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1925758127.00007FF619BEA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1925809705.00007FF619BFD000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1925809705.00007FF619C0C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1925902396.00007FF619C0E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_0_2_7ff619bc0000_NEVER OPEN!.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: ByteCharMultiWide_findclose
                                                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                                                              • API String ID: 2772937645-0
                                                                                                                                                                                                                                              • Opcode ID: 546b9b719202fe24d9a2799ee9e9099ac0ea0e8d266654c37a6e474f9743e8e6
                                                                                                                                                                                                                                              • Instruction ID: cd00916e945b1a8d8c873b7584c298a36fda42b1a2712e6c8ee04013d163fc5a
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 546b9b719202fe24d9a2799ee9e9099ac0ea0e8d266654c37a6e474f9743e8e6
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 2A71AF52E18EC981E621CF2CC5452FE6360F7A9B5CF54E321DB9C52592EF28E2D9C700
                                                                                                                                                                                                                                              Function 00007FF619BDB6D8 Relevance: 1.6, APIs: 1, Instructions: 105COMMONLIBRARYCODE
                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 00000000.00000002.1925722330.00007FF619BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF619BC0000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1925682521.00007FF619BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1925758127.00007FF619BEA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1925809705.00007FF619BFD000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1925809705.00007FF619C0C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1925902396.00007FF619C0E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_0_2_7ff619bc0000_NEVER OPEN!.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: _invalid_parameter_noinfo
                                                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                                                              • API String ID: 3215553584-0
                                                                                                                                                                                                                                              • Opcode ID: 921bdf0eba68be09e4b7463ed2823839ea20c7cdcc22b5de8510a95a494254ce
                                                                                                                                                                                                                                              • Instruction ID: b4c1dec79c47801f2e26b82a65a6fe276ffad865282f1ba18ecf4d85a5b58517
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 921bdf0eba68be09e4b7463ed2823839ea20c7cdcc22b5de8510a95a494254ce
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 8241AF32A09A1A87EA348F19E54127A77E0EB52FACF100135DB9EC7791CF2DE502C741
                                                                                                                                                                                                                                              Function 00007FF619BC7160 Relevance: 1.6, APIs: 1, Instructions: 85COMMON
                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 00000000.00000002.1925722330.00007FF619BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF619BC0000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1925682521.00007FF619BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1925758127.00007FF619BEA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1925809705.00007FF619BFD000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1925809705.00007FF619C0C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1925902396.00007FF619C0E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_0_2_7ff619bc0000_NEVER OPEN!.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: _fread_nolock
                                                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                                                              • API String ID: 840049012-0
                                                                                                                                                                                                                                              • Opcode ID: 522848a42fe2cf6cb4b2bc8e004649ba31033a73cf127c7bcc63fbb12eb26665
                                                                                                                                                                                                                                              • Instruction ID: 03c45bda53aadf814c509b9544c331e22243daf5ef3b6d969e2f522b93c98551
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 522848a42fe2cf6cb4b2bc8e004649ba31033a73cf127c7bcc63fbb12eb26665
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 2121B621B0DA9A46FA249F5265443FBA641BF47FECF884431EE0C8B786CE3CE141C600
                                                                                                                                                                                                                                              Function 00007FF619BDB170 Relevance: 1.6, APIs: 1, Instructions: 74COMMONLIBRARYCODE
                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 00000000.00000002.1925722330.00007FF619BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF619BC0000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1925682521.00007FF619BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1925758127.00007FF619BEA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1925809705.00007FF619BFD000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1925809705.00007FF619C0C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1925902396.00007FF619C0E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_0_2_7ff619bc0000_NEVER OPEN!.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: _invalid_parameter_noinfo
                                                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                                                              • API String ID: 3215553584-0
                                                                                                                                                                                                                                              • Opcode ID: ebce2893e7386841ed580dde05bc7058577b7e5d5ec03578d12c1ac3e6eaceb6
                                                                                                                                                                                                                                              • Instruction ID: c07bbeaf650d441d91a209648fe9c840a0edf41784540298f68de250dfa624a5
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: ebce2893e7386841ed580dde05bc7058577b7e5d5ec03578d12c1ac3e6eaceb6
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: B8318162A0CE5A85E721AF9598413BE6EE1AB93FBCF510135DA2D833D2CF7CA4418710
                                                                                                                                                                                                                                              Function 00007FF619BD8B11 Relevance: 1.6, APIs: 1, Instructions: 61COMMON
                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 00000000.00000002.1925722330.00007FF619BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF619BC0000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1925682521.00007FF619BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1925758127.00007FF619BEA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1925809705.00007FF619BFD000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1925809705.00007FF619C0C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1925902396.00007FF619C0E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_0_2_7ff619bc0000_NEVER OPEN!.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: HandleModule$AddressFreeLibraryProc
                                                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                                                              • API String ID: 3947729631-0
                                                                                                                                                                                                                                              • Opcode ID: e6c24619f5215b83aec1ea87e649774fc018db111b87a8e2cbcec198033a6ec0
                                                                                                                                                                                                                                              • Instruction ID: 6d2384c23373d68932896313a508a179c582fc7f46f004c61caea263d52f2320
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: e6c24619f5215b83aec1ea87e649774fc018db111b87a8e2cbcec198033a6ec0
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: E3218DB2A05B4A8AEB658F64D4402AD33B0EB05B3DF080635D61D86BC5DF38D484C745
                                                                                                                                                                                                                                              Function 00007FF619BD5278 Relevance: 1.6, APIs: 1, Instructions: 55COMMON
                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 00000000.00000002.1925722330.00007FF619BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF619BC0000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1925682521.00007FF619BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1925758127.00007FF619BEA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1925809705.00007FF619BFD000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1925809705.00007FF619C0C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1925902396.00007FF619C0E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_0_2_7ff619bc0000_NEVER OPEN!.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: _invalid_parameter_noinfo
                                                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                                                              • API String ID: 3215553584-0
                                                                                                                                                                                                                                              • Opcode ID: e2d81e48737d2b9edbd67630313f86d574e33faf5878dae4ee8aa738ebab6973
                                                                                                                                                                                                                                              • Instruction ID: f4f9aab4e58d8cf539df32a8af3098b44006588f1e9b7427fe1ae91b0dea30b8
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: e2d81e48737d2b9edbd67630313f86d574e33faf5878dae4ee8aa738ebab6973
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 1511A822A1DE4981EA709F5194001BFA2E4BF97FACF544031EA4C97789DFBCD5418700
                                                                                                                                                                                                                                              Function 00007FF619BE567C Relevance: 1.6, APIs: 1, Instructions: 54COMMON
                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 00000000.00000002.1925722330.00007FF619BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF619BC0000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1925682521.00007FF619BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1925758127.00007FF619BEA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1925809705.00007FF619BFD000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1925809705.00007FF619C0C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1925902396.00007FF619C0E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_0_2_7ff619bc0000_NEVER OPEN!.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: _invalid_parameter_noinfo
                                                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                                                              • API String ID: 3215553584-0
                                                                                                                                                                                                                                              • Opcode ID: 60d9f9acc7225305b8a94005220afb75f792b29590b70391da89a6fb11ac5e62
                                                                                                                                                                                                                                              • Instruction ID: 886555cb7e01fd75d45fef2576f53b0a51c75971e0181341a2ec3b9609166485
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 60d9f9acc7225305b8a94005220afb75f792b29590b70391da89a6fb11ac5e62
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: FE216232A08E8687DB718F19D44037A77A4EB96FA8F244234E69DC76D5EF7CD8118B00
                                                                                                                                                                                                                                              Function 00007FF619BCF538 Relevance: 1.5, APIs: 1, Instructions: 48COMMONLIBRARYCODE
                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 00000000.00000002.1925722330.00007FF619BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF619BC0000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1925682521.00007FF619BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1925758127.00007FF619BEA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1925809705.00007FF619BFD000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1925809705.00007FF619C0C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1925902396.00007FF619C0E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_0_2_7ff619bc0000_NEVER OPEN!.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: _invalid_parameter_noinfo
                                                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                                                              • API String ID: 3215553584-0
                                                                                                                                                                                                                                              • Opcode ID: e4873d1516dd9c3e810b3a8ea2f1d2e802796ef0a43dc58582891be639f1b00f
                                                                                                                                                                                                                                              • Instruction ID: aa88901b43f0e418dabf74ed051d915edd0659e1b8c1cad65e58eafbbc4eec67
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: e4873d1516dd9c3e810b3a8ea2f1d2e802796ef0a43dc58582891be639f1b00f
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: DF01A161A08F4941EA24DF5299010BAA795BF97FF8F484671EE6C97BD6CE3CE5028300
                                                                                                                                                                                                                                              Function 00007FF619BC7290 Relevance: 1.3, APIs: 1, Instructions: 92COMMON
                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 00000000.00000002.1925722330.00007FF619BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF619BC0000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1925682521.00007FF619BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1925758127.00007FF619BEA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1925809705.00007FF619BFD000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1925809705.00007FF619C0C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1925902396.00007FF619C0E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_0_2_7ff619bc0000_NEVER OPEN!.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: DirectoryErrorLastRemove
                                                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                                                              • API String ID: 377330604-0
                                                                                                                                                                                                                                              • Opcode ID: 09a521ef4cb0fd8898bfebd8eeb22065011f25953e633beb0c80092615295a14
                                                                                                                                                                                                                                              • Instruction ID: 20853636db76c766f270745cb0af7ecf22f103f94d4bcceb0ede6570aeffd337
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 09a521ef4cb0fd8898bfebd8eeb22065011f25953e633beb0c80092615295a14
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: BD416716D1CAC981E6219F2495552FE6360FBE6B5CF459232EFCD92153EF28A2C9C300
                                                                                                                                                                                                                                              Function 00007FF619BDE0E0 Relevance: 1.3, APIs: 1, Instructions: 36memoryCOMMONLIBRARYCODE
                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                              • HeapAlloc.KERNEL32(?,?,00000000,00007FF619BDABF6,?,?,?,00007FF619BD9DBF,?,?,00000000,00007FF619BDA05A), ref: 00007FF619BDE135
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 00000000.00000002.1925722330.00007FF619BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF619BC0000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1925682521.00007FF619BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1925758127.00007FF619BEA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1925809705.00007FF619BFD000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1925809705.00007FF619C0C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1925902396.00007FF619C0E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_0_2_7ff619bc0000_NEVER OPEN!.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: AllocHeap
                                                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                                                              • API String ID: 4292702814-0
                                                                                                                                                                                                                                              • Opcode ID: a493b6c3a5346acdfb9ba84895edf5a7b56a1aa8e9cf3a29e90864fe141fa411
                                                                                                                                                                                                                                              • Instruction ID: 15b1aea61a953e7123e847d1af8a3dd8ebd75b7fd186bea1c7b156ea6c61a5c9
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: a493b6c3a5346acdfb9ba84895edf5a7b56a1aa8e9cf3a29e90864fe141fa411
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 56F01D64B0AA0F41FF755EA699522B652D55F5AFACF4C5430C90EC63C2ED2CF4808220
                                                                                                                                                                                                                                              Function 00007FF619BDCE50 Relevance: 1.3, APIs: 1, Instructions: 29memoryCOMMONLIBRARYCODE
                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                              • HeapAlloc.KERNEL32(?,?,00000000,00007FF619BD7228,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 00007FF619BDCE8E
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 00000000.00000002.1925722330.00007FF619BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF619BC0000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1925682521.00007FF619BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1925758127.00007FF619BEA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1925809705.00007FF619BFD000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1925809705.00007FF619C0C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1925902396.00007FF619C0E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_0_2_7ff619bc0000_NEVER OPEN!.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: AllocHeap
                                                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                                                              • API String ID: 4292702814-0
                                                                                                                                                                                                                                              • Opcode ID: 4298054405db4a4a08a5b14e1c0068d3d506bccc87335596e9568cb5352a493e
                                                                                                                                                                                                                                              • Instruction ID: 5f3010667ee3c11cd3ffcb02f797269967a9ac674175cc07c99ccc3558062a2f
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 4298054405db4a4a08a5b14e1c0068d3d506bccc87335596e9568cb5352a493e
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: AEF0F891E09A4A46FA755FA2594527622D45F86FBCF080A30ED2EC63C2DE2CF8818510

                                                                                                                                                                                                                                              Non-executed Functions

                                                                                                                                                                                                                                              Function 00007FF619BC3DD0 Relevance: 291.0, APIs: 55, Strings: 111, Instructions: 457libraryloaderCOMMON
                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 00000000.00000002.1925722330.00007FF619BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF619BC0000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1925682521.00007FF619BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1925758127.00007FF619BEA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1925809705.00007FF619BFD000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1925809705.00007FF619C0C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1925902396.00007FF619C0E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_0_2_7ff619bc0000_NEVER OPEN!.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: AddressProc
                                                                                                                                                                                                                                              • String ID: Failed to get address for PyDict_GetItemString$Failed to get address for PyErr_Clear$Failed to get address for PyErr_Fetch$Failed to get address for PyErr_NormalizeException$Failed to get address for PyErr_Occurred$Failed to get address for PyErr_Print$Failed to get address for PyErr_Restore$Failed to get address for PyEval_EvalCode$Failed to get address for PyImport_AddModule$Failed to get address for PyImport_ExecCodeModule$Failed to get address for PyImport_ImportModule$Failed to get address for PyList_Append$Failed to get address for PyList_New$Failed to get address for PyLong_AsLong$Failed to get address for PyMarshal_ReadObjectFromString$Failed to get address for PyMem_RawFree$Failed to get address for PyModule_GetDict$Failed to get address for PyObject_CallFunction$Failed to get address for PyObject_CallFunctionObjArgs$Failed to get address for PyObject_GetAttrString$Failed to get address for PyObject_SetAttrString$Failed to get address for PyObject_Str$Failed to get address for PyRun_SimpleStringFlags$Failed to get address for PySys_AddWarnOption$Failed to get address for PySys_GetObject$Failed to get address for PySys_SetArgvEx$Failed to get address for PySys_SetObject$Failed to get address for PySys_SetPath$Failed to get address for PyUnicode_AsUTF8$Failed to get address for PyUnicode_Decode$Failed to get address for PyUnicode_DecodeFSDefault$Failed to get address for PyUnicode_FromFormat$Failed to get address for PyUnicode_FromString$Failed to get address for PyUnicode_Join$Failed to get address for PyUnicode_Replace$Failed to get address for Py_BuildValue$Failed to get address for Py_DecRef$Failed to get address for Py_DecodeLocale$Failed to get address for Py_DontWriteBytecodeFlag$Failed to get address for Py_FileSystemDefaultEncoding$Failed to get address for Py_Finalize$Failed to get address for Py_FrozenFlag$Failed to get address for Py_GetPath$Failed to get address for Py_IgnoreEnvironmentFlag$Failed to get address for Py_IncRef$Failed to get address for Py_Initialize$Failed to get address for Py_NoSiteFlag$Failed to get address for Py_NoUserSiteDirectory$Failed to get address for Py_OptimizeFlag$Failed to get address for Py_SetPath$Failed to get address for Py_SetProgramName$Failed to get address for Py_SetPythonHome$Failed to get address for Py_UTF8Mode$Failed to get address for Py_UnbufferedStdioFlag$Failed to get address for Py_VerboseFlag$GetProcAddress$PyDict_GetItemString$PyErr_Clear$PyErr_Fetch$PyErr_NormalizeException$PyErr_Occurred$PyErr_Print$PyErr_Restore$PyEval_EvalCode$PyImport_AddModule$PyImport_ExecCodeModule$PyImport_ImportModule$PyList_Append$PyList_New$PyLong_AsLong$PyMarshal_ReadObjectFromString$PyMem_RawFree$PyModule_GetDict$PyObject_CallFunction$PyObject_CallFunctionObjArgs$PyObject_GetAttrString$PyObject_SetAttrString$PyObject_Str$PyRun_SimpleStringFlags$PySys_AddWarnOption$PySys_GetObject$PySys_SetArgvEx$PySys_SetObject$PySys_SetPath$PyUnicode_AsUTF8$PyUnicode_Decode$PyUnicode_DecodeFSDefault$PyUnicode_FromFormat$PyUnicode_FromString$PyUnicode_Join$PyUnicode_Replace$Py_BuildValue$Py_DecRef$Py_DecodeLocale$Py_DontWriteBytecodeFlag$Py_FileSystemDefaultEncoding$Py_Finalize$Py_FrozenFlag$Py_GetPath$Py_IgnoreEnvironmentFlag$Py_IncRef$Py_Initialize$Py_NoSiteFlag$Py_NoUserSiteDirectory$Py_OptimizeFlag$Py_SetPath$Py_SetProgramName$Py_SetPythonHome$Py_UTF8Mode$Py_UnbufferedStdioFlag$Py_VerboseFlag
                                                                                                                                                                                                                                              • API String ID: 190572456-3109299426
                                                                                                                                                                                                                                              • Opcode ID: 7d3d92c3fb4b4818ef88af2979818605c477eb2c491dbc0430b532d63662b789
                                                                                                                                                                                                                                              • Instruction ID: 2d85f2adfc47572b6307bf6d64679233a8973931b3eee965231d49ae1e94e59c
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 7d3d92c3fb4b4818ef88af2979818605c477eb2c491dbc0430b532d63662b789
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: D1429864A0EF1F91FA35DF06A85017623A9AF4AFBCB945075C81EC63A4EF7CB644D210
                                                                                                                                                                                                                                              Function 00007FF619BC1B90 Relevance: 43.9, APIs: 20, Strings: 5, Instructions: 188windowCOMMON
                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 00000000.00000002.1925722330.00007FF619BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF619BC0000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1925682521.00007FF619BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1925758127.00007FF619BEA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1925809705.00007FF619BFD000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1925809705.00007FF619C0C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1925902396.00007FF619C0E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_0_2_7ff619bc0000_NEVER OPEN!.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: MessageSend$Window$Create$Move$ObjectSelect$#380BaseClientDialogDrawFontIndirectInfoParametersRectReleaseSystemTextUnits
                                                                                                                                                                                                                                              • String ID: BUTTON$Close$EDIT$Failed to execute script '%ls' due to unhandled exception: %ls$STATIC
                                                                                                                                                                                                                                              • API String ID: 2446303242-1601438679
                                                                                                                                                                                                                                              • Opcode ID: 7ed90ee14006bcd321cd10bdeb934db8782b761a46ad43856a2a4bf3b656c6c9
                                                                                                                                                                                                                                              • Instruction ID: ca8a52d12660aca049709209b9aedf26b9220e32ce1f6b412a9e61f27de32089
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 7ed90ee14006bcd321cd10bdeb934db8782b761a46ad43856a2a4bf3b656c6c9
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: EEA15936208F8587E7248F12E59479AB378F789BA8F504129EB8D43B24CF7DE165CB40
                                                                                                                                                                                                                                              Function 00007FF619BE314C Relevance: 24.0, APIs: 9, Strings: 4, Instructions: 1203COMMON
                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 00000000.00000002.1925722330.00007FF619BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF619BC0000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1925682521.00007FF619BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1925758127.00007FF619BEA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1925809705.00007FF619BFD000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1925809705.00007FF619C0C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1925902396.00007FF619C0E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_0_2_7ff619bc0000_NEVER OPEN!.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: _invalid_parameter_noinfo$memcpy_s$fegetenv
                                                                                                                                                                                                                                              • String ID: 1#IND$1#INF$1#QNAN$1#SNAN
                                                                                                                                                                                                                                              • API String ID: 808467561-2761157908
                                                                                                                                                                                                                                              • Opcode ID: f752bff3088effa309b52e81ea8db1ba9b6c8dea184d4b5b07fd11c25a621607
                                                                                                                                                                                                                                              • Instruction ID: a2320ba3a4db2bcc22e8b7ed7a6440aba86b744459321adb6a9968a24d9cd50b
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: f752bff3088effa309b52e81ea8db1ba9b6c8dea184d4b5b07fd11c25a621607
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 53B20572A19A8A8BE7758F26D4407FE37A5FB46B5CF505135DA0A97A84DF3CE500CB00
                                                                                                                                                                                                                                              Function 00007FF619BC7410 Relevance: 15.8, APIs: 3, Strings: 6, Instructions: 52windowCOMMON
                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                              • GetLastError.KERNEL32(00000000,00007FF619BC26A0), ref: 00007FF619BC7437
                                                                                                                                                                                                                                              • FormatMessageW.KERNEL32(00000000,00007FF619BC26A0), ref: 00007FF619BC7466
                                                                                                                                                                                                                                              • WideCharToMultiByte.KERNEL32 ref: 00007FF619BC74BC
                                                                                                                                                                                                                                                • Part of subcall function 00007FF619BC2620: GetLastError.KERNEL32(00000000,00000000,00000000,00007FF619BC76A4,?,?,?,?,?,?,?,?,?,?,?,00007FF619BC101D), ref: 00007FF619BC2654
                                                                                                                                                                                                                                                • Part of subcall function 00007FF619BC2620: MessageBoxW.USER32 ref: 00007FF619BC272C
                                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 00000000.00000002.1925722330.00007FF619BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF619BC0000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1925682521.00007FF619BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1925758127.00007FF619BEA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1925809705.00007FF619BFD000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1925809705.00007FF619C0C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1925902396.00007FF619C0E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_0_2_7ff619bc0000_NEVER OPEN!.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: ErrorLastMessage$ByteCharFormatMultiWide
                                                                                                                                                                                                                                              • String ID: Failed to encode wchar_t as UTF-8.$FormatMessageW$No error messages generated.$PyInstaller: FormatMessageW failed.$PyInstaller: pyi_win32_utils_to_utf8 failed.$WideCharToMultiByte
                                                                                                                                                                                                                                              • API String ID: 2920928814-2573406579
                                                                                                                                                                                                                                              • Opcode ID: 904cea7669a0d8d992d4f9b78dda1624a08753575e193a6c14212660532e3fc7
                                                                                                                                                                                                                                              • Instruction ID: 4203c6b86ca57d1cd2a048bbb91d93802a0b8fdc2de7b3c0943654f04e058c99
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 904cea7669a0d8d992d4f9b78dda1624a08753575e193a6c14212660532e3fc7
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: C1218031A08E4A92E7709F15EC8426B6769BF8ABACF844135E58DC26A4EF3CE145C700
                                                                                                                                                                                                                                              Function 00007FF619BCB5CC Relevance: 10.6, APIs: 7, Instructions: 72COMMON
                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 00000000.00000002.1925722330.00007FF619BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF619BC0000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1925682521.00007FF619BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1925758127.00007FF619BEA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1925809705.00007FF619BFD000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1925809705.00007FF619C0C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1925902396.00007FF619C0E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_0_2_7ff619bc0000_NEVER OPEN!.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: ExceptionFilterPresentUnhandled$CaptureContextDebuggerEntryFeatureFunctionLookupProcessorUnwindVirtual
                                                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                                                              • API String ID: 3140674995-0
                                                                                                                                                                                                                                              • Opcode ID: 6b6968d94bce6e9e5fed0559e23dc5a31b9e8664b1d3bb7900027832e5426e22
                                                                                                                                                                                                                                              • Instruction ID: 956cddf57e913ed4d2ede28bce3e746f0ac4787523eaf0f2847890d8d260f178
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 6b6968d94bce6e9e5fed0559e23dc5a31b9e8664b1d3bb7900027832e5426e22
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: C4315E72608E858AEB708F61E8903EE7365FB85B58F44443ADA4E87B98DF3CD548C710
                                                                                                                                                                                                                                              Function 00007FF619BD9E30 Relevance: 9.1, APIs: 6, Instructions: 83COMMONLIBRARYCODE
                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 00000000.00000002.1925722330.00007FF619BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF619BC0000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1925682521.00007FF619BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1925758127.00007FF619BEA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1925809705.00007FF619BFD000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1925809705.00007FF619C0C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1925902396.00007FF619C0E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_0_2_7ff619bc0000_NEVER OPEN!.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: ExceptionFilterUnhandled$CaptureContextDebuggerEntryFunctionLookupPresentUnwindVirtual
                                                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                                                              • API String ID: 1239891234-0
                                                                                                                                                                                                                                              • Opcode ID: 2a5c43df35e99ae67e4cea9ce9060e2489f8be8a1fb54d96256a74953a59f3d3
                                                                                                                                                                                                                                              • Instruction ID: 6e128ac320acbcb63795b66fc8bcb50e2be856c1ffad75328f5f93452a0e98b2
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 2a5c43df35e99ae67e4cea9ce9060e2489f8be8a1fb54d96256a74953a59f3d3
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 1A314F36618F8586DB70CF25E8402AE73A8FB8AB68F540535EA9D83B95DF3CD145CB00
                                                                                                                                                                                                                                              Function 00007FF619BE0CE4 Relevance: 7.8, APIs: 5, Instructions: 282COMMON
                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 00000000.00000002.1925722330.00007FF619BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF619BC0000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1925682521.00007FF619BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1925758127.00007FF619BEA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1925809705.00007FF619BFD000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1925809705.00007FF619C0C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1925902396.00007FF619C0E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_0_2_7ff619bc0000_NEVER OPEN!.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: FileFindFirst_invalid_parameter_noinfo
                                                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                                                              • API String ID: 2227656907-0
                                                                                                                                                                                                                                              • Opcode ID: b3f1c49e492e255234082c3cff1f32be82a3374c5446236373d35cc3037b48ce
                                                                                                                                                                                                                                              • Instruction ID: 52e0d8e0c873aa7c11c53c77856ef1a7400ecea9afef975d03bf51a04f8758c2
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: b3f1c49e492e255234082c3cff1f32be82a3374c5446236373d35cc3037b48ce
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 7EB19222B1CA9A81EA709F2294106BB6395FB46FFCF544171EE5E87B85DE3CE441C300
                                                                                                                                                                                                                                              Function 00007FF619BE2CC0 Relevance: 7.3, APIs: 3, Strings: 1, Instructions: 329COMMON
                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 00000000.00000002.1925722330.00007FF619BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF619BC0000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1925682521.00007FF619BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1925758127.00007FF619BEA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1925809705.00007FF619BFD000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1925809705.00007FF619C0C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1925902396.00007FF619C0E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_0_2_7ff619bc0000_NEVER OPEN!.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: memcpy_s
                                                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                                                              • API String ID: 1502251526-3916222277
                                                                                                                                                                                                                                              • Opcode ID: cde1b8b2f6d1160984fe15dbaba42dea7d5925037cfa26e03551a8a86da9f649
                                                                                                                                                                                                                                              • Instruction ID: 27c3592d0e4a8c1d0ebeca0fff7d2a97e990050aef33461fcfd299e76d2ce0e7
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: cde1b8b2f6d1160984fe15dbaba42dea7d5925037cfa26e03551a8a86da9f649
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: EAC1E872B19A8A8BD734CF16E044A6EB795F785B98F458139DB4A83B44DF3CE805CB40
                                                                                                                                                                                                                                              Function 00007FF619BE8A88 Relevance: 3.2, APIs: 2, Instructions: 232COMMONLIBRARYCODE
                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 00000000.00000002.1925722330.00007FF619BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF619BC0000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1925682521.00007FF619BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1925758127.00007FF619BEA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1925809705.00007FF619BFD000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1925809705.00007FF619C0C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1925902396.00007FF619C0E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_0_2_7ff619bc0000_NEVER OPEN!.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: ExceptionRaise_clrfp
                                                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                                                              • API String ID: 15204871-0
                                                                                                                                                                                                                                              • Opcode ID: c98df24206d3f77735ae33df8ceacecd19d4940239c19f738c6055ff3a65a8e1
                                                                                                                                                                                                                                              • Instruction ID: e932c0d83876d702921fcb80909c7ed94b3322e78df360b685def7e4d48b73cb
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: c98df24206d3f77735ae33df8ceacecd19d4940239c19f738c6055ff3a65a8e1
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 68B15A77A00F888BEB25CF2AC48236937A4F745F9CB148965DA5D877A4CF39D451C701
                                                                                                                                                                                                                                              Function 00007FF619BDD438 Relevance: 2.6, Strings: 2, Instructions: 144COMMON
                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 00000000.00000002.1925722330.00007FF619BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF619BC0000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1925682521.00007FF619BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1925758127.00007FF619BEA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1925809705.00007FF619BFD000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1925809705.00007FF619C0C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1925902396.00007FF619C0E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_0_2_7ff619bc0000_NEVER OPEN!.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID:
                                                                                                                                                                                                                                              • String ID: e+000$gfff
                                                                                                                                                                                                                                              • API String ID: 0-3030954782
                                                                                                                                                                                                                                              • Opcode ID: f03b78b00f9cd60af7c202ce44a1da6624136329721a9d3af132449252dcedc0
                                                                                                                                                                                                                                              • Instruction ID: 41585637713cfca1833d2bb17915ec47ec2925f0b38acc36885ed3fc2acb5ef7
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: f03b78b00f9cd60af7c202ce44a1da6624136329721a9d3af132449252dcedc0
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 22513862B18AC946E7348E35980076A6BD1E786FACF489235CBAC87FC5CE3DE4458700
                                                                                                                                                                                                                                              Function 00007FF619BDFD48 Relevance: 2.0, APIs: 1, Instructions: 462COMMON
                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 00000000.00000002.1925722330.00007FF619BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF619BC0000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1925682521.00007FF619BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1925758127.00007FF619BEA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1925809705.00007FF619BFD000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1925809705.00007FF619C0C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1925902396.00007FF619C0E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_0_2_7ff619bc0000_NEVER OPEN!.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: CurrentFeaturePresentProcessProcessor
                                                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                                                              • API String ID: 1010374628-0
                                                                                                                                                                                                                                              • Opcode ID: d68a4561d4443392d37dbbd3e574b346064aadcb7cdc880701d4372b212264c2
                                                                                                                                                                                                                                              • Instruction ID: 0e96a23eba88d6e2421018b13ae1a7594147e96f09a0f0fbe461ceb986710247
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: d68a4561d4443392d37dbbd3e574b346064aadcb7cdc880701d4372b212264c2
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 75025A21A1EE4A41FE75AF16980127B26E4AF47FBCF584635ED5DDA3D2DE3CA8018300
                                                                                                                                                                                                                                              Function 00007FF619BE5740 Relevance: 1.7, APIs: 1, Instructions: 182COMMON
                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 00000000.00000002.1925722330.00007FF619BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF619BC0000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1925682521.00007FF619BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1925758127.00007FF619BEA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1925809705.00007FF619BFD000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1925809705.00007FF619C0C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1925902396.00007FF619C0E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_0_2_7ff619bc0000_NEVER OPEN!.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: _get_daylight_invalid_parameter_noinfo
                                                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                                                              • API String ID: 474895018-0
                                                                                                                                                                                                                                              • Opcode ID: bc8244d02579a66843833e3490c576fed28d4216ac76c7b63b03d331e6201322
                                                                                                                                                                                                                                              • Instruction ID: 1619a2775d29c3e74f5db506c59f8bc7523740d90b94d55776ef9e8983fac767
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: bc8244d02579a66843833e3490c576fed28d4216ac76c7b63b03d331e6201322
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 3161D822F0895E45FF708E2684447BF6685AF52F78F194275DA6DC76C1FEADE8408700
                                                                                                                                                                                                                                              Function 00007FF619BDCF88 Relevance: 1.5, Strings: 1, Instructions: 260COMMON
                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 00000000.00000002.1925722330.00007FF619BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF619BC0000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1925682521.00007FF619BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1925758127.00007FF619BEA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1925809705.00007FF619BFD000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1925809705.00007FF619C0C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1925902396.00007FF619C0E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_0_2_7ff619bc0000_NEVER OPEN!.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID:
                                                                                                                                                                                                                                              • String ID: gfffffff
                                                                                                                                                                                                                                              • API String ID: 0-1523873471
                                                                                                                                                                                                                                              • Opcode ID: d30af38685738228081a68dbd93523c6f265c6663808b840609621f3fa1f17b1
                                                                                                                                                                                                                                              • Instruction ID: 43fa0f3993189f2787ee2c0d61e0d893c0e34576881155e7f82149d33ae3ab14
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: d30af38685738228081a68dbd93523c6f265c6663808b840609621f3fa1f17b1
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 54A12662B09ACA46EB31CF25A4107AA77D5EB96BACF048131DE8D87B85DE3DE501C701
                                                                                                                                                                                                                                              Function 00007FF619BD72FC Relevance: 1.4, Strings: 1, Instructions: 177COMMON
                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 00000000.00000002.1925722330.00007FF619BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF619BC0000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1925682521.00007FF619BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1925758127.00007FF619BEA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1925809705.00007FF619BFD000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1925809705.00007FF619C0C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1925902396.00007FF619C0E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_0_2_7ff619bc0000_NEVER OPEN!.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: _invalid_parameter_noinfo
                                                                                                                                                                                                                                              • String ID: TMP
                                                                                                                                                                                                                                              • API String ID: 3215553584-3125297090
                                                                                                                                                                                                                                              • Opcode ID: d384ede67a321a74620895a0e1fb7f854e6a221175bf470888624725848e9a0f
                                                                                                                                                                                                                                              • Instruction ID: c7c5d2455d02a6b36a1e95f4653694c367e2cba0aa4f8461f15f70182f08ab81
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: d384ede67a321a74620895a0e1fb7f854e6a221175bf470888624725848e9a0f
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: FB51AA51B09A8A41FA74AE2659915BB62D1AF87FFCF484538DE0DC7792EE3CE5028200
                                                                                                                                                                                                                                              Function 00007FF619BE28B0 Relevance: 1.3, APIs: 1, Instructions: 7memoryCOMMON
                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 00000000.00000002.1925722330.00007FF619BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF619BC0000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1925682521.00007FF619BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1925758127.00007FF619BEA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1925809705.00007FF619BFD000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1925809705.00007FF619C0C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1925902396.00007FF619C0E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_0_2_7ff619bc0000_NEVER OPEN!.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: HeapProcess
                                                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                                                              • API String ID: 54951025-0
                                                                                                                                                                                                                                              • Opcode ID: 19da4fe8d26728c5e911c5c5510c93168406015c51bc059135fabb43e6d65509
                                                                                                                                                                                                                                              • Instruction ID: 47116e6309cad9b68d4a3ff984c062d4f893c1ddd6a567f59c67d33fbe854f7c
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 19da4fe8d26728c5e911c5c5510c93168406015c51bc059135fabb43e6d65509
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: E8B09224E07F0AC2EA482F126C4221822B87F49B24F994078C04CC1320DF3C24A99701
                                                                                                                                                                                                                                              Function 00007FF619BD29E4 Relevance: .3, Instructions: 339COMMON
                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 00000000.00000002.1925722330.00007FF619BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF619BC0000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1925682521.00007FF619BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1925758127.00007FF619BEA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1925809705.00007FF619BFD000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1925809705.00007FF619C0C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1925902396.00007FF619C0E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_0_2_7ff619bc0000_NEVER OPEN!.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID:
                                                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                                                              • API String ID:
                                                                                                                                                                                                                                              • Opcode ID: fb8b9ab7e683055d7f91b062d2ef33cac13758f08328e56af0959892d6318d41
                                                                                                                                                                                                                                              • Instruction ID: fe0c499dde1848b97a4dbe8341587dba2d2d0a4fa553a609d444278f646e5364
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: fb8b9ab7e683055d7f91b062d2ef33cac13758f08328e56af0959892d6318d41
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: B6D19A26A08E8E86EB798F19804057E37E0FB06F7CB544236DE4D87394DF69E892C744
                                                                                                                                                                                                                                              Function 00007FF619BD2618 Relevance: .3, Instructions: 317COMMON
                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 00000000.00000002.1925722330.00007FF619BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF619BC0000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1925682521.00007FF619BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1925758127.00007FF619BEA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1925809705.00007FF619BFD000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1925809705.00007FF619C0C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1925902396.00007FF619C0E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_0_2_7ff619bc0000_NEVER OPEN!.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID:
                                                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                                                              • API String ID:
                                                                                                                                                                                                                                              • Opcode ID: e0af3fb3f739479494d9ff6125cfbc2fa0ac53ff408a7d01b209d4c3e0664dd5
                                                                                                                                                                                                                                              • Instruction ID: 4e19e9daa9e2a64bafb1861d391f99941f3e1c7109a26c5dbad21a33332bc903
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: e0af3fb3f739479494d9ff6125cfbc2fa0ac53ff408a7d01b209d4c3e0664dd5
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: EBD19E36A08E8A86EB788E29800427A27E1AF46F7CF545235DE5C97795CF29E942C340
                                                                                                                                                                                                                                              Function 00007FF619BC9CB0 Relevance: .3, Instructions: 287COMMON
                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 00000000.00000002.1925722330.00007FF619BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF619BC0000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1925682521.00007FF619BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1925758127.00007FF619BEA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1925809705.00007FF619BFD000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1925809705.00007FF619C0C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1925902396.00007FF619C0E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_0_2_7ff619bc0000_NEVER OPEN!.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID:
                                                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                                                              • API String ID:
                                                                                                                                                                                                                                              • Opcode ID: c3fee6b40a5eb321c916c7db653b3bb63d8cae01afa51a75cab4dfb5e8f015da
                                                                                                                                                                                                                                              • Instruction ID: dae2da343481d073c35a2ddc6731d1bd064fb713a88156db926f5b41187935df
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: c3fee6b40a5eb321c916c7db653b3bb63d8cae01afa51a75cab4dfb5e8f015da
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 47C106722181E04BD299EB29E45A87A33D0F78930DFD4442BEB9B67B85CA3CE514D721
                                                                                                                                                                                                                                              Function 00007FF619BD1CA0 Relevance: .2, Instructions: 244COMMON
                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 00000000.00000002.1925722330.00007FF619BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF619BC0000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1925682521.00007FF619BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1925758127.00007FF619BEA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1925809705.00007FF619BFD000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1925809705.00007FF619C0C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1925902396.00007FF619C0E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_0_2_7ff619bc0000_NEVER OPEN!.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID:
                                                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                                                              • API String ID:
                                                                                                                                                                                                                                              • Opcode ID: 91ceea803a154026f4ed1a56ec923424108e69554f751e9bf0b66e7d0f476bf8
                                                                                                                                                                                                                                              • Instruction ID: e71bd25c851f90cffab4becd30210070708ad5b1542ce0e10006d92493902e6c
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 91ceea803a154026f4ed1a56ec923424108e69554f751e9bf0b66e7d0f476bf8
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: F8B16C72A08B9986E7798F29805023E3BE1F75AF6CF240239DA4E87395CF39E451C754
                                                                                                                                                                                                                                              Function 00007FF619BDDAB8 Relevance: .2, Instructions: 198COMMON
                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 00000000.00000002.1925722330.00007FF619BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF619BC0000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1925682521.00007FF619BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1925758127.00007FF619BEA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1925809705.00007FF619BFD000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1925809705.00007FF619C0C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1925902396.00007FF619C0E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_0_2_7ff619bc0000_NEVER OPEN!.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID:
                                                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                                                              • API String ID:
                                                                                                                                                                                                                                              • Opcode ID: 93d1f7f5e2d35d378a18d758ef7452beceb4e4448ff7612bfe2c34f606049c8f
                                                                                                                                                                                                                                              • Instruction ID: eec7930f596ed4544b1a52566f26147ebbe82de5abd22e604cdb00238ae5f937
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 93d1f7f5e2d35d378a18d758ef7452beceb4e4448ff7612bfe2c34f606049c8f
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 5881A172A08A8945EA748E29944037A7AD0FB86BACF544235DADD87F99DF3DE5408B00
                                                                                                                                                                                                                                              Function 00007FF619BD0A4C Relevance: .1, Instructions: 138COMMON
                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 00000000.00000002.1925722330.00007FF619BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF619BC0000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1925682521.00007FF619BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1925758127.00007FF619BEA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1925809705.00007FF619BFD000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1925809705.00007FF619C0C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1925902396.00007FF619C0E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_0_2_7ff619bc0000_NEVER OPEN!.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID:
                                                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                                                              • API String ID:
                                                                                                                                                                                                                                              • Opcode ID: 5bc1e8dee506cd44ecbf0b5e8aaaa02a315f50eccdbe70c528d8c0aedf534dfa
                                                                                                                                                                                                                                              • Instruction ID: 81c45f076ea18d1e63397f6b63ab3fa80c983b83caaeb8d5aaddaa93b6fcfdde
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 5bc1e8dee506cd44ecbf0b5e8aaaa02a315f50eccdbe70c528d8c0aedf534dfa
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 78515B76A18A5A82E7388E28815423E37E0EB56FBCF154135DA4D977D9CF29EC81C780
                                                                                                                                                                                                                                              Function 00007FF619BD11F4 Relevance: .1, Instructions: 138COMMON
                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 00000000.00000002.1925722330.00007FF619BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF619BC0000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1925682521.00007FF619BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1925758127.00007FF619BEA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1925809705.00007FF619BFD000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1925809705.00007FF619C0C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1925902396.00007FF619C0E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_0_2_7ff619bc0000_NEVER OPEN!.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID:
                                                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                                                              • API String ID:
                                                                                                                                                                                                                                              • Opcode ID: 4ffcc455aa6a00ff2032288bac82e9b5ec4fd6d29c2556166949a364a98c5f89
                                                                                                                                                                                                                                              • Instruction ID: 71ed2c1d321a17490b0905f21e80b161293fddf58611d6d925bedfee8fb7ddd3
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 4ffcc455aa6a00ff2032288bac82e9b5ec4fd6d29c2556166949a364a98c5f89
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 39517B76A08A5982E73C8E68C19423E27E1FB56F7CF144235DA4D97BD9CF29E841C780
                                                                                                                                                                                                                                              Function 00007FF619BD4D00 Relevance: .1, Instructions: 138COMMON
                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 00000000.00000002.1925722330.00007FF619BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF619BC0000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1925682521.00007FF619BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1925758127.00007FF619BEA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1925809705.00007FF619BFD000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1925809705.00007FF619C0C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1925902396.00007FF619C0E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_0_2_7ff619bc0000_NEVER OPEN!.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID:
                                                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                                                              • API String ID:
                                                                                                                                                                                                                                              • Opcode ID: d6ef73793ea1788ae08d57b95515db7d43b127d7364744ae73512ded182e4f5a
                                                                                                                                                                                                                                              • Instruction ID: 6f007693314b5f1905c9f86cdf5236d6aa32345b820499be8ae2d40d4baad265
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: d6ef73793ea1788ae08d57b95515db7d43b127d7364744ae73512ded182e4f5a
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: C3418C52909E8E05E9B98F1805007F626C2AF63FBED6862B5DD99D37C7CE0C69878200
                                                                                                                                                                                                                                              Function 00007FF619BD0E20 Relevance: .1, Instructions: 138COMMON
                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 00000000.00000002.1925722330.00007FF619BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF619BC0000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1925682521.00007FF619BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1925758127.00007FF619BEA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1925809705.00007FF619BFD000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1925809705.00007FF619C0C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1925902396.00007FF619C0E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_0_2_7ff619bc0000_NEVER OPEN!.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID:
                                                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                                                              • API String ID:
                                                                                                                                                                                                                                              • Opcode ID: 8aeb93c5629d17fe34525ae1cda0d80ab686c951b12f53e4f6f64a56c68414ad
                                                                                                                                                                                                                                              • Instruction ID: d17dfcecdf6883148b7eddeb7c240db2d6ab61a29a7b0b7ed1d6eb8eab273914
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 8aeb93c5629d17fe34525ae1cda0d80ab686c951b12f53e4f6f64a56c68414ad
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 63514076A08A5983E7388E28C15423E27E0EB56FBCF250135DE4D977D9CF29E841C780
                                                                                                                                                                                                                                              Function 00007FF619BD0C38 Relevance: .1, Instructions: 137COMMON
                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 00000000.00000002.1925722330.00007FF619BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF619BC0000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1925682521.00007FF619BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1925758127.00007FF619BEA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1925809705.00007FF619BFD000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1925809705.00007FF619C0C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1925902396.00007FF619C0E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_0_2_7ff619bc0000_NEVER OPEN!.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID:
                                                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                                                              • API String ID:
                                                                                                                                                                                                                                              • Opcode ID: aa395c9792183e49334293850312205b65f34961702d15c96fad58c9c510fd66
                                                                                                                                                                                                                                              • Instruction ID: 136e9d88a74580b80c0876760201b6fe0ccff7f93f63766044daab31594b469a
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: aa395c9792183e49334293850312205b65f34961702d15c96fad58c9c510fd66
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 62516F72A18E5982E7788E28C15437E27E0EB56FACF184139DE4D97799CF29EC41C780
                                                                                                                                                                                                                                              Function 00007FF619BD0864 Relevance: .1, Instructions: 137COMMON
                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 00000000.00000002.1925722330.00007FF619BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF619BC0000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1925682521.00007FF619BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1925758127.00007FF619BEA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1925809705.00007FF619BFD000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1925809705.00007FF619C0C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1925902396.00007FF619C0E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_0_2_7ff619bc0000_NEVER OPEN!.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID:
                                                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                                                              • API String ID:
                                                                                                                                                                                                                                              • Opcode ID: ef981404636da51f1ed954bd302f164e3a78945c52a2db6131100af8a3259a9c
                                                                                                                                                                                                                                              • Instruction ID: acd5d88d9f4fcbc84d4d1a858ecbe552d877f7ae275975c4119553ee5dfa562b
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: ef981404636da51f1ed954bd302f164e3a78945c52a2db6131100af8a3259a9c
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 76519C76A09A5A82F7388E29C15423E27E0EB56FACF140135CE4E97799CF39ED41C780
                                                                                                                                                                                                                                              Function 00007FF619BD100C Relevance: .1, Instructions: 137COMMON
                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 00000000.00000002.1925722330.00007FF619BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF619BC0000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1925682521.00007FF619BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1925758127.00007FF619BEA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1925809705.00007FF619BFD000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1925809705.00007FF619C0C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1925902396.00007FF619C0E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_0_2_7ff619bc0000_NEVER OPEN!.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID:
                                                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                                                              • API String ID:
                                                                                                                                                                                                                                              • Opcode ID: e5ad9c7ecca594120113de473f7742fb11cadaaafa7376847cd05c838e1b111d
                                                                                                                                                                                                                                              • Instruction ID: 334baeed94cbd75874fa26bc628c171c96cfa8dd6a7ba41ff70b1478e1e0e560
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: e5ad9c7ecca594120113de473f7742fb11cadaaafa7376847cd05c838e1b111d
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: B7517B76A1CA9A82E73C9E28C15423E27E0FB56FACF144135CE4997799CF29EC41C780
                                                                                                                                                                                                                                              Function 00007FF619BD8F00 Relevance: .1, Instructions: 126COMMON
                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 00000000.00000002.1925722330.00007FF619BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF619BC0000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1925682521.00007FF619BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1925758127.00007FF619BEA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1925809705.00007FF619BFD000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1925809705.00007FF619C0C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1925902396.00007FF619C0E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_0_2_7ff619bc0000_NEVER OPEN!.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: ErrorFreeHeapLast
                                                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                                                              • API String ID: 485612231-0
                                                                                                                                                                                                                                              • Opcode ID: 187bcfe8ad65e2c1e0a81d4629d9ff93352063670a7bff08a034696ccc920c5c
                                                                                                                                                                                                                                              • Instruction ID: 642673932cbf4268cac3baa081c91662797b42c4558d24b22756c5585a028b7e
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 187bcfe8ad65e2c1e0a81d4629d9ff93352063670a7bff08a034696ccc920c5c
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: AF419032714E5982EF14CF2AD96516AA392BB49FE8B499436DE0DC7B58DF3CD0428304
                                                                                                                                                                                                                                              Function 00007FF619BD62F0 Relevance: .1, Instructions: 98COMMON
                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 00000000.00000002.1925722330.00007FF619BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF619BC0000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1925682521.00007FF619BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1925758127.00007FF619BEA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1925809705.00007FF619BFD000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1925809705.00007FF619C0C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1925902396.00007FF619C0E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_0_2_7ff619bc0000_NEVER OPEN!.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID:
                                                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                                                              • API String ID:
                                                                                                                                                                                                                                              • Opcode ID: ba081c41fdd114359a61cef8d5e9e24532fb21a12c47f22df6f51dbc1286213a
                                                                                                                                                                                                                                              • Instruction ID: ce3478f77cb51bdecaeba50192cc3fa0415427dafd1de6de7d50e65216a9c10f
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: ba081c41fdd114359a61cef8d5e9e24532fb21a12c47f22df6f51dbc1286213a
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 8F31A432718F8682E774DF26644012B6AD5AF86FB8F144239EA4DD3BD6DF3CD5028604
                                                                                                                                                                                                                                              Function 00007FF619BE88D0 Relevance: .0, Instructions: 32COMMON
                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 00000000.00000002.1925722330.00007FF619BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF619BC0000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1925682521.00007FF619BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1925758127.00007FF619BEA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1925809705.00007FF619BFD000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1925809705.00007FF619C0C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1925902396.00007FF619C0E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_0_2_7ff619bc0000_NEVER OPEN!.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID:
                                                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                                                              • API String ID:
                                                                                                                                                                                                                                              • Opcode ID: 931d88bd1b3e63247472d43ba1997f474145f501e72483d5500b516f2c71a83b
                                                                                                                                                                                                                                              • Instruction ID: d096b4a34d9224e05c1e2f4270df7794ce29039828882af22c2c4be666664671
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 931d88bd1b3e63247472d43ba1997f474145f501e72483d5500b516f2c71a83b
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: B2F068B5B187958ADBA48F29A40262D77F0F7487D4F44903DE6CDC3B14DA3C90508F04
                                                                                                                                                                                                                                              Function 00007FF619BCB7B0 Relevance: .0, Instructions: 2COMMON
                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 00000000.00000002.1925722330.00007FF619BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF619BC0000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1925682521.00007FF619BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1925758127.00007FF619BEA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1925809705.00007FF619BFD000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1925809705.00007FF619C0C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1925902396.00007FF619C0E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_0_2_7ff619bc0000_NEVER OPEN!.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID:
                                                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                                                              • API String ID:
                                                                                                                                                                                                                                              • Opcode ID: 6c002e7d7884e8c4061cd0b6b52ae5efdc83914f73eae79fef453be1d5e57078
                                                                                                                                                                                                                                              • Instruction ID: 093833ddd8953e3c9e7c84df41c92118d212ae7988c7318780f85a2182239435
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 6c002e7d7884e8c4061cd0b6b52ae5efdc83914f73eae79fef453be1d5e57078
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 6CA00121908C1AD0E6648F01A8540262628FB52B29B41047AD84E810A09E2CA400E242
                                                                                                                                                                                                                                              Function 00007FF619BC55B0 Relevance: 166.5, APIs: 31, Strings: 64, Instructions: 287libraryloaderCOMMON
                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 00000000.00000002.1925722330.00007FF619BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF619BC0000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1925682521.00007FF619BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1925758127.00007FF619BEA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1925809705.00007FF619BFD000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1925809705.00007FF619C0C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1925902396.00007FF619C0E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_0_2_7ff619bc0000_NEVER OPEN!.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: AddressProc$LibraryLoad
                                                                                                                                                                                                                                              • String ID: Failed to get address for Tcl_Alloc$Failed to get address for Tcl_ConditionFinalize$Failed to get address for Tcl_ConditionNotify$Failed to get address for Tcl_ConditionWait$Failed to get address for Tcl_CreateInterp$Failed to get address for Tcl_CreateObjCommand$Failed to get address for Tcl_CreateThread$Failed to get address for Tcl_DeleteInterp$Failed to get address for Tcl_DoOneEvent$Failed to get address for Tcl_EvalEx$Failed to get address for Tcl_EvalFile$Failed to get address for Tcl_EvalObjv$Failed to get address for Tcl_Finalize$Failed to get address for Tcl_FinalizeThread$Failed to get address for Tcl_FindExecutable$Failed to get address for Tcl_Free$Failed to get address for Tcl_GetCurrentThread$Failed to get address for Tcl_GetObjResult$Failed to get address for Tcl_GetString$Failed to get address for Tcl_GetVar2$Failed to get address for Tcl_Init$Failed to get address for Tcl_MutexLock$Failed to get address for Tcl_MutexUnlock$Failed to get address for Tcl_NewByteArrayObj$Failed to get address for Tcl_NewStringObj$Failed to get address for Tcl_SetVar2$Failed to get address for Tcl_SetVar2Ex$Failed to get address for Tcl_ThreadAlert$Failed to get address for Tcl_ThreadQueueEvent$Failed to get address for Tk_GetNumMainWindows$Failed to get address for Tk_Init$GetProcAddress$LOADER: Failed to load tcl/tk libraries$Tcl_Alloc$Tcl_ConditionFinalize$Tcl_ConditionNotify$Tcl_ConditionWait$Tcl_CreateInterp$Tcl_CreateObjCommand$Tcl_CreateThread$Tcl_DeleteInterp$Tcl_DoOneEvent$Tcl_EvalEx$Tcl_EvalFile$Tcl_EvalObjv$Tcl_Finalize$Tcl_FinalizeThread$Tcl_FindExecutable$Tcl_Free$Tcl_GetCurrentThread$Tcl_GetObjResult$Tcl_GetString$Tcl_GetVar2$Tcl_Init$Tcl_MutexLock$Tcl_MutexUnlock$Tcl_NewByteArrayObj$Tcl_NewStringObj$Tcl_SetVar2$Tcl_SetVar2Ex$Tcl_ThreadAlert$Tcl_ThreadQueueEvent$Tk_GetNumMainWindows$Tk_Init
                                                                                                                                                                                                                                              • API String ID: 2238633743-1453502826
                                                                                                                                                                                                                                              • Opcode ID: 45e68652b3cd2763e61bf8c7b4b9299d96d60ba340caa4760d9ec6d98f32a26d
                                                                                                                                                                                                                                              • Instruction ID: 7dade8275fa92090aafe1193fd658dfaeaf3b1f2d767258a86b34f9a80d001b6
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 45e68652b3cd2763e61bf8c7b4b9299d96d60ba340caa4760d9ec6d98f32a26d
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 89E1ABA4E0DF0B90FA39CF1AA85417623B9AF06FA8F985175D85DC6794EFBCB544C200
                                                                                                                                                                                                                                              Function 00007FF619BC2030 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 120COMMON
                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 00000000.00000002.1925722330.00007FF619BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF619BC0000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1925682521.00007FF619BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1925758127.00007FF619BEA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1925809705.00007FF619BFD000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1925809705.00007FF619C0C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1925902396.00007FF619C0E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_0_2_7ff619bc0000_NEVER OPEN!.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: MoveWindow$ObjectSelect$DrawReleaseText
                                                                                                                                                                                                                                              • String ID: P%
                                                                                                                                                                                                                                              • API String ID: 2147705588-2959514604
                                                                                                                                                                                                                                              • Opcode ID: 6cf46cb85abbdff361c8f4f8800dc6b6c327d34febef624f12cf28668e06a053
                                                                                                                                                                                                                                              • Instruction ID: a531cc044e1811028c34cc6b56f45bc2fb7d1f3e62d752cd3a53c95b5f3a966e
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 6cf46cb85abbdff361c8f4f8800dc6b6c327d34febef624f12cf28668e06a053
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 6651F326608BA187D6349F26E4181BBB7A1FB99F69F004125EBCF83685DF3CD045DB10
                                                                                                                                                                                                                                              Function 00007FF619BC12B0 Relevance: 14.1, APIs: 1, Strings: 7, Instructions: 106COMMON
                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 00000000.00000002.1925722330.00007FF619BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF619BC0000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1925682521.00007FF619BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1925758127.00007FF619BEA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1925809705.00007FF619BFD000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1925809705.00007FF619C0C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1925902396.00007FF619C0E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_0_2_7ff619bc0000_NEVER OPEN!.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: Message
                                                                                                                                                                                                                                              • String ID: Failed to extract %s: failed to allocate data buffer (%u bytes)!$Failed to extract %s: failed to open archive file!$Failed to extract %s: failed to read data chunk!$Failed to extract %s: failed to seek to the entry's data!$fread$fseek$malloc
                                                                                                                                                                                                                                              • API String ID: 2030045667-3659356012
                                                                                                                                                                                                                                              • Opcode ID: 35bad0d24fa3563d73b92c1f1c2091f7009dee2449702eeff9db08ea766860f8
                                                                                                                                                                                                                                              • Instruction ID: d1e8ede81bca9f67c5701be9a229380ddc0e8ce4ed3ffc0420fce541a2a3de5e
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 35bad0d24fa3563d73b92c1f1c2091f7009dee2449702eeff9db08ea766860f8
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: C9416061A08E4A92EA34DF12E4402AB63A4FF46FACF844436DE4D97B55EE3CE542C700
                                                                                                                                                                                                                                              Function 00007FF619BD95C4 Relevance: 12.7, APIs: 3, Strings: 4, Instructions: 489COMMON
                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 00000000.00000002.1925722330.00007FF619BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF619BC0000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1925682521.00007FF619BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1925758127.00007FF619BEA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1925809705.00007FF619BFD000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1925809705.00007FF619C0C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1925902396.00007FF619C0E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_0_2_7ff619bc0000_NEVER OPEN!.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: _invalid_parameter_noinfo
                                                                                                                                                                                                                                              • String ID: 0$f$p$p
                                                                                                                                                                                                                                              • API String ID: 3215553584-1202675169
                                                                                                                                                                                                                                              • Opcode ID: 216f111ad4c5b66b884b0df32855d232c2f88c8bc1f49e6a12dd5780390dcc5b
                                                                                                                                                                                                                                              • Instruction ID: 46fada16bb23b05e52e6d5072648a8f0e9c46fd62afaf33fd684c88ef37bc0df
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 216f111ad4c5b66b884b0df32855d232c2f88c8bc1f49e6a12dd5780390dcc5b
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 17128E72A0E94B86FB346E1590446BB76D3EB42F6CF884135E69A877C4DF3DE5808B04
                                                                                                                                                                                                                                              Function 00007FF619BCDB60 Relevance: 12.6, APIs: 4, Strings: 3, Instructions: 317COMMON
                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 00000000.00000002.1925722330.00007FF619BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF619BC0000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1925682521.00007FF619BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1925758127.00007FF619BEA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1925809705.00007FF619BFD000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1925809705.00007FF619C0C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1925902396.00007FF619C0E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_0_2_7ff619bc0000_NEVER OPEN!.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: BlockFrameHandler3::Unwind$CatchExecutionHandlerIs_bad_exception_allowedSearchStatestd::bad_alloc::bad_alloc
                                                                                                                                                                                                                                              • String ID: csm$csm$csm
                                                                                                                                                                                                                                              • API String ID: 849930591-393685449
                                                                                                                                                                                                                                              • Opcode ID: 7137a45c87a1c42c9297b97288d1de501ad69753d3396f0e1b378e006ad8aaa6
                                                                                                                                                                                                                                              • Instruction ID: b8d5c1c1e9e3f3aba019b935acacb75fa33117699fd67146e9f52b42f1350d96
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 7137a45c87a1c42c9297b97288d1de501ad69753d3396f0e1b378e006ad8aaa6
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 1AE15D76A08B4A8AEB309F6594412AF77A0FB96FACF100535EE4D97B55CF38E481C740
                                                                                                                                                                                                                                              Function 00007FF619BC7560 Relevance: 12.4, APIs: 2, Strings: 5, Instructions: 104COMMON
                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                              • WideCharToMultiByte.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00007FF619BC101D), ref: 00007FF619BC75FF
                                                                                                                                                                                                                                              • WideCharToMultiByte.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00007FF619BC101D), ref: 00007FF619BC764F
                                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 00000000.00000002.1925722330.00007FF619BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF619BC0000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1925682521.00007FF619BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1925758127.00007FF619BEA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1925809705.00007FF619BFD000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1925809705.00007FF619C0C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1925902396.00007FF619C0E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_0_2_7ff619bc0000_NEVER OPEN!.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: ByteCharMultiWide
                                                                                                                                                                                                                                              • String ID: Failed to encode wchar_t as UTF-8.$Failed to get UTF-8 buffer size.$Out of memory.$WideCharToMultiByte$win32_utils_to_utf8
                                                                                                                                                                                                                                              • API String ID: 626452242-27947307
                                                                                                                                                                                                                                              • Opcode ID: 44bd59f9cbd0c1bab7727675d44fbf1c519c8e5a350bb71af5096b05f54b9704
                                                                                                                                                                                                                                              • Instruction ID: f2edc32fec6c31ce993698a15385ea92125d7e84fc57fbed0d783c4efe3c4f1d
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 44bd59f9cbd0c1bab7727675d44fbf1c519c8e5a350bb71af5096b05f54b9704
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: F8418232A09F8682D6309F16B48016BB7A5FB86FA8F544135EA9DC7B95DF3CE451C700
                                                                                                                                                                                                                                              Function 00007FF619BC7AA0 Relevance: 12.3, APIs: 2, Strings: 5, Instructions: 63COMMON
                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                              • WideCharToMultiByte.KERNEL32(?,00007FF619BC3679), ref: 00007FF619BC7AE1
                                                                                                                                                                                                                                                • Part of subcall function 00007FF619BC2620: GetLastError.KERNEL32(00000000,00000000,00000000,00007FF619BC76A4,?,?,?,?,?,?,?,?,?,?,?,00007FF619BC101D), ref: 00007FF619BC2654
                                                                                                                                                                                                                                                • Part of subcall function 00007FF619BC2620: MessageBoxW.USER32 ref: 00007FF619BC272C
                                                                                                                                                                                                                                              • WideCharToMultiByte.KERNEL32(?,00007FF619BC3679), ref: 00007FF619BC7B55
                                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 00000000.00000002.1925722330.00007FF619BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF619BC0000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1925682521.00007FF619BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1925758127.00007FF619BEA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1925809705.00007FF619BFD000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1925809705.00007FF619C0C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1925902396.00007FF619C0E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_0_2_7ff619bc0000_NEVER OPEN!.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: ByteCharMultiWide$ErrorLastMessage
                                                                                                                                                                                                                                              • String ID: Failed to encode wchar_t as UTF-8.$Failed to get UTF-8 buffer size.$Out of memory.$WideCharToMultiByte$win32_utils_to_utf8
                                                                                                                                                                                                                                              • API String ID: 3723044601-27947307
                                                                                                                                                                                                                                              • Opcode ID: b11e43d7c6d1527cb9d332ac96d423ab1dd5107057e4ee7710d1ce1ad2b4adc8
                                                                                                                                                                                                                                              • Instruction ID: 8c20605ce0b4de4eb702c3aa9be6338f1954107c1a5562abc3ee78a78732f849
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: b11e43d7c6d1527cb9d332ac96d423ab1dd5107057e4ee7710d1ce1ad2b4adc8
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 74216D21A08F4B85EA209F16E89007A77A5AB86FA8F544175DA4DC37A5EF7CE551C300
                                                                                                                                                                                                                                              Function 00007FF619BD010C Relevance: 11.0, APIs: 3, Strings: 3, Instructions: 475COMMON
                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 00000000.00000002.1925722330.00007FF619BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF619BC0000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1925682521.00007FF619BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1925758127.00007FF619BEA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1925809705.00007FF619BFD000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1925809705.00007FF619C0C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1925902396.00007FF619C0E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_0_2_7ff619bc0000_NEVER OPEN!.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: _invalid_parameter_noinfo
                                                                                                                                                                                                                                              • String ID: f$p$p
                                                                                                                                                                                                                                              • API String ID: 3215553584-1995029353
                                                                                                                                                                                                                                              • Opcode ID: e564e9ffa487f496332ad79a12679e83e89e7590c537cca4c07bc5f1831f7133
                                                                                                                                                                                                                                              • Instruction ID: 2e563d62bcdf8c00dea7d849d9a547cea662337245aaea81fb2367b0163d7990
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: e564e9ffa487f496332ad79a12679e83e89e7590c537cca4c07bc5f1831f7133
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 2012B121E0D94B86FB349E15E0446BB76E2FB52FACF844035E6C9867C4DE3CE9808B51
                                                                                                                                                                                                                                              Function 00007FF619BC7B90 Relevance: 10.6, APIs: 2, Strings: 5, Instructions: 99COMMON
                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 00000000.00000002.1925722330.00007FF619BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF619BC0000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1925682521.00007FF619BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1925758127.00007FF619BEA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1925809705.00007FF619BFD000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1925809705.00007FF619C0C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1925902396.00007FF619C0E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_0_2_7ff619bc0000_NEVER OPEN!.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: ByteCharMultiWide
                                                                                                                                                                                                                                              • String ID: Failed to decode wchar_t from UTF-8$Failed to get wchar_t buffer size.$MultiByteToWideChar$Out of memory.$win32_utils_from_utf8
                                                                                                                                                                                                                                              • API String ID: 626452242-876015163
                                                                                                                                                                                                                                              • Opcode ID: a181c4653b270c240a20b71774802f78ed29fd61c7b1d57222845c1f55e9839c
                                                                                                                                                                                                                                              • Instruction ID: f4b637a3c3fd1c01599e1f6317e814c9e263bd991277699c19cce6afdace7ceb
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: a181c4653b270c240a20b71774802f78ed29fd61c7b1d57222845c1f55e9839c
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 5A417F32A09F4B82E630DF16A48056B67A5FB46FA8F144135EE9D87BA5DF3CE452C700
                                                                                                                                                                                                                                              Function 00007FF619BC6440 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 88COMMON
                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                                • Part of subcall function 00007FF619BC7990: MultiByteToWideChar.KERNEL32 ref: 00007FF619BC79CA
                                                                                                                                                                                                                                              • ExpandEnvironmentStringsW.KERNEL32(00000000,00007FF619BC678F,?,00000000,?,TokenIntegrityLevel), ref: 00007FF619BC649F
                                                                                                                                                                                                                                                • Part of subcall function 00007FF619BC2770: MessageBoxW.USER32 ref: 00007FF619BC2841
                                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                                              • LOADER: Failed to expand environment variables in the runtime-tmpdir., xrefs: 00007FF619BC64B3
                                                                                                                                                                                                                                              • LOADER: Failed to obtain the absolute path of the runtime-tmpdir., xrefs: 00007FF619BC64FA
                                                                                                                                                                                                                                              • LOADER: Failed to convert runtime-tmpdir to a wide string., xrefs: 00007FF619BC6476
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 00000000.00000002.1925722330.00007FF619BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF619BC0000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1925682521.00007FF619BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1925758127.00007FF619BEA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1925809705.00007FF619BFD000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1925809705.00007FF619C0C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1925902396.00007FF619C0E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_0_2_7ff619bc0000_NEVER OPEN!.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: ByteCharEnvironmentExpandMessageMultiStringsWide
                                                                                                                                                                                                                                              • String ID: LOADER: Failed to convert runtime-tmpdir to a wide string.$LOADER: Failed to expand environment variables in the runtime-tmpdir.$LOADER: Failed to obtain the absolute path of the runtime-tmpdir.
                                                                                                                                                                                                                                              • API String ID: 1662231829-3498232454
                                                                                                                                                                                                                                              • Opcode ID: 1a78d63db9e5c5418a60acc91ec9d4210b790a3baa2768e8ac1cd5e3290d3fb6
                                                                                                                                                                                                                                              • Instruction ID: b0f4d426383709a71d95db9b2d42d29af51c1f38a70f07444048cb22dd1eb5a6
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 1a78d63db9e5c5418a60acc91ec9d4210b790a3baa2768e8ac1cd5e3290d3fb6
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 7A31B711F1CE8B81FA309F25D9552BB5295AF9AFACF444436DA4EC279AEE2CF5048700
                                                                                                                                                                                                                                              Function 00007FF619BCCE18 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 88libraryloaderCOMMONLIBRARYCODE
                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                              • LoadLibraryExW.KERNEL32(?,?,?,00007FF619BCD0CA,?,?,?,00007FF619BCCDBC,?,?,00000001,00007FF619BCC9D9), ref: 00007FF619BCCE9D
                                                                                                                                                                                                                                              • GetLastError.KERNEL32(?,?,?,00007FF619BCD0CA,?,?,?,00007FF619BCCDBC,?,?,00000001,00007FF619BCC9D9), ref: 00007FF619BCCEAB
                                                                                                                                                                                                                                              • LoadLibraryExW.KERNEL32(?,?,?,00007FF619BCD0CA,?,?,?,00007FF619BCCDBC,?,?,00000001,00007FF619BCC9D9), ref: 00007FF619BCCED5
                                                                                                                                                                                                                                              • FreeLibrary.KERNEL32(?,?,?,00007FF619BCD0CA,?,?,?,00007FF619BCCDBC,?,?,00000001,00007FF619BCC9D9), ref: 00007FF619BCCF1B
                                                                                                                                                                                                                                              • GetProcAddress.KERNEL32(?,?,?,00007FF619BCD0CA,?,?,?,00007FF619BCCDBC,?,?,00000001,00007FF619BCC9D9), ref: 00007FF619BCCF27
                                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 00000000.00000002.1925722330.00007FF619BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF619BC0000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1925682521.00007FF619BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1925758127.00007FF619BEA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1925809705.00007FF619BFD000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1925809705.00007FF619C0C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1925902396.00007FF619C0E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_0_2_7ff619bc0000_NEVER OPEN!.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: Library$Load$AddressErrorFreeLastProc
                                                                                                                                                                                                                                              • String ID: api-ms-
                                                                                                                                                                                                                                              • API String ID: 2559590344-2084034818
                                                                                                                                                                                                                                              • Opcode ID: 498a46deb9e57335d1de5ef4a955cc682f3fb4b8c547d247cdb2efba5821273f
                                                                                                                                                                                                                                              • Instruction ID: 0452f0a6bc95feb73ec9d7c530df79555f56691bffe4acca3e0defd3443ad74f
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 498a46deb9e57335d1de5ef4a955cc682f3fb4b8c547d247cdb2efba5821273f
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 4C319C21F1AE4A91EE71DF06A8005B62298BF5BFB8F5A4935DD2DCA780DF3CE4458704
                                                                                                                                                                                                                                              Function 00007FF619BC7990 Relevance: 10.6, APIs: 2, Strings: 5, Instructions: 68COMMON
                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                              • MultiByteToWideChar.KERNEL32 ref: 00007FF619BC79CA
                                                                                                                                                                                                                                                • Part of subcall function 00007FF619BC2620: GetLastError.KERNEL32(00000000,00000000,00000000,00007FF619BC76A4,?,?,?,?,?,?,?,?,?,?,?,00007FF619BC101D), ref: 00007FF619BC2654
                                                                                                                                                                                                                                                • Part of subcall function 00007FF619BC2620: MessageBoxW.USER32 ref: 00007FF619BC272C
                                                                                                                                                                                                                                              • MultiByteToWideChar.KERNEL32 ref: 00007FF619BC7A50
                                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 00000000.00000002.1925722330.00007FF619BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF619BC0000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1925682521.00007FF619BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1925758127.00007FF619BEA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1925809705.00007FF619BFD000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1925809705.00007FF619C0C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1925902396.00007FF619C0E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_0_2_7ff619bc0000_NEVER OPEN!.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: ByteCharMultiWide$ErrorLastMessage
                                                                                                                                                                                                                                              • String ID: Failed to decode wchar_t from UTF-8$Failed to get wchar_t buffer size.$MultiByteToWideChar$Out of memory.$win32_utils_from_utf8
                                                                                                                                                                                                                                              • API String ID: 3723044601-876015163
                                                                                                                                                                                                                                              • Opcode ID: e4b57f199998f7b1657d81dc8f37c951294af66f0894a5466f77556df0e946e9
                                                                                                                                                                                                                                              • Instruction ID: fe5c932ae4092ed0267dabd7907c5ff862ea2840bd21a6c2fd7ea2f9bf78642f
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: e4b57f199998f7b1657d81dc8f37c951294af66f0894a5466f77556df0e946e9
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: F6212322B08E4681EB60DF26F440177A365AB9ABE8F584175EB5CC3B69EE6CE5418700
                                                                                                                                                                                                                                              Function 00007FF619BDA960 Relevance: 10.6, APIs: 7, Instructions: 62COMMONLIBRARYCODE
                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                              • GetLastError.KERNEL32(?,?,?,00007FF619BE2747,?,?,?,00007FF619BDCF10,?,?,00000000,00007FF619BD380F,?,?,?,00007FF619BD9674), ref: 00007FF619BDA96F
                                                                                                                                                                                                                                              • FlsGetValue.KERNEL32(?,?,?,00007FF619BE2747,?,?,?,00007FF619BDCF10,?,?,00000000,00007FF619BD380F,?,?,?,00007FF619BD9674), ref: 00007FF619BDA984
                                                                                                                                                                                                                                              • FlsSetValue.KERNEL32(?,?,?,00007FF619BE2747,?,?,?,00007FF619BDCF10,?,?,00000000,00007FF619BD380F,?,?,?,00007FF619BD9674), ref: 00007FF619BDA9A5
                                                                                                                                                                                                                                              • FlsSetValue.KERNEL32(?,?,?,00007FF619BE2747,?,?,?,00007FF619BDCF10,?,?,00000000,00007FF619BD380F,?,?,?,00007FF619BD9674), ref: 00007FF619BDA9D2
                                                                                                                                                                                                                                              • FlsSetValue.KERNEL32(?,?,?,00007FF619BE2747,?,?,?,00007FF619BDCF10,?,?,00000000,00007FF619BD380F,?,?,?,00007FF619BD9674), ref: 00007FF619BDA9E3
                                                                                                                                                                                                                                              • FlsSetValue.KERNEL32(?,?,?,00007FF619BE2747,?,?,?,00007FF619BDCF10,?,?,00000000,00007FF619BD380F,?,?,?,00007FF619BD9674), ref: 00007FF619BDA9F4
                                                                                                                                                                                                                                              • SetLastError.KERNEL32(?,?,?,00007FF619BE2747,?,?,?,00007FF619BDCF10,?,?,00000000,00007FF619BD380F,?,?,?,00007FF619BD9674), ref: 00007FF619BDAA0F
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 00000000.00000002.1925722330.00007FF619BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF619BC0000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1925682521.00007FF619BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1925758127.00007FF619BEA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1925809705.00007FF619BFD000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1925809705.00007FF619C0C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1925902396.00007FF619C0E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_0_2_7ff619bc0000_NEVER OPEN!.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: Value$ErrorLast
                                                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                                                              • API String ID: 2506987500-0
                                                                                                                                                                                                                                              • Opcode ID: 82491ca02f49234ec1e26b247981f906afbb8406f8092f357683c8b46e638aa2
                                                                                                                                                                                                                                              • Instruction ID: b033b690eff72c581becb72339f94efa873a585b7f06cc8c89dc60a1710ea913
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 82491ca02f49234ec1e26b247981f906afbb8406f8092f357683c8b46e638aa2
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 14215E21A0DE4E41FA746F21565523F62C24F8AFBCF145738E93EC6BC6DE2CB4418600
                                                                                                                                                                                                                                              Function 00007FF619BE6F7C Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 48fileCOMMON
                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 00000000.00000002.1925722330.00007FF619BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF619BC0000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1925682521.00007FF619BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1925758127.00007FF619BEA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1925809705.00007FF619BFD000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1925809705.00007FF619C0C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1925902396.00007FF619C0E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_0_2_7ff619bc0000_NEVER OPEN!.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: ConsoleWrite$CloseCreateErrorFileHandleLast
                                                                                                                                                                                                                                              • String ID: CONOUT$
                                                                                                                                                                                                                                              • API String ID: 3230265001-3130406586
                                                                                                                                                                                                                                              • Opcode ID: 9b0c467059450527019a7bcd7e40657f3b8ea03f40c84b5b8d47b747d07757bb
                                                                                                                                                                                                                                              • Instruction ID: 1344662cfaf5570444aa80b92e96ecb969c506955c8aad71dee52dde2d543c16
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 9b0c467059450527019a7bcd7e40657f3b8ea03f40c84b5b8d47b747d07757bb
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: A2115E21A18E4586E7608F57E85432AB6A8FB8AFFCF044274EA5DC7795CF7CD8448740
                                                                                                                                                                                                                                              Function 00007FF619BDAAD8 Relevance: 9.1, APIs: 6, Instructions: 57COMMONLIBRARYCODE
                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                              • GetLastError.KERNEL32(?,?,?,00007FF619BD41FD,?,?,?,?,00007FF619BDE147,?,?,00000000,00007FF619BDABF6,?,?,?), ref: 00007FF619BDAAE7
                                                                                                                                                                                                                                              • FlsSetValue.KERNEL32(?,?,?,00007FF619BD41FD,?,?,?,?,00007FF619BDE147,?,?,00000000,00007FF619BDABF6,?,?,?), ref: 00007FF619BDAB1D
                                                                                                                                                                                                                                              • FlsSetValue.KERNEL32(?,?,?,00007FF619BD41FD,?,?,?,?,00007FF619BDE147,?,?,00000000,00007FF619BDABF6,?,?,?), ref: 00007FF619BDAB4A
                                                                                                                                                                                                                                              • FlsSetValue.KERNEL32(?,?,?,00007FF619BD41FD,?,?,?,?,00007FF619BDE147,?,?,00000000,00007FF619BDABF6,?,?,?), ref: 00007FF619BDAB5B
                                                                                                                                                                                                                                              • FlsSetValue.KERNEL32(?,?,?,00007FF619BD41FD,?,?,?,?,00007FF619BDE147,?,?,00000000,00007FF619BDABF6,?,?,?), ref: 00007FF619BDAB6C
                                                                                                                                                                                                                                              • SetLastError.KERNEL32(?,?,?,00007FF619BD41FD,?,?,?,?,00007FF619BDE147,?,?,00000000,00007FF619BDABF6,?,?,?), ref: 00007FF619BDAB87
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 00000000.00000002.1925722330.00007FF619BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF619BC0000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1925682521.00007FF619BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1925758127.00007FF619BEA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1925809705.00007FF619BFD000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1925809705.00007FF619C0C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1925902396.00007FF619C0E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_0_2_7ff619bc0000_NEVER OPEN!.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: Value$ErrorLast
                                                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                                                              • API String ID: 2506987500-0
                                                                                                                                                                                                                                              • Opcode ID: a1c7565a82b12080a7e4a6293aba57bcc0a0246c19bd776823cb351104546e5d
                                                                                                                                                                                                                                              • Instruction ID: a38a73f17675b55dc74d5639610eac0e074dd2d7a423ae9e66c5f182b064467d
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: a1c7565a82b12080a7e4a6293aba57bcc0a0246c19bd776823cb351104546e5d
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 46114D20A08E4A42FA746F21565513F62C25F8AFBCF545738D93EC67D6DE2CB4028700
                                                                                                                                                                                                                                              Function 00007FF619BCE394 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 162COMMON
                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 00000000.00000002.1925722330.00007FF619BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF619BC0000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1925682521.00007FF619BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1925758127.00007FF619BEA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1925809705.00007FF619BFD000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1925809705.00007FF619C0C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1925902396.00007FF619C0E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_0_2_7ff619bc0000_NEVER OPEN!.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: Frame$EmptyHandler3::StateUnwind__except_validate_context_record__std_exception_copy
                                                                                                                                                                                                                                              • String ID: csm$csm
                                                                                                                                                                                                                                              • API String ID: 851805269-3733052814
                                                                                                                                                                                                                                              • Opcode ID: 299de1fc68536281d3fe39e191cf3aad2c95231a45bdf52044d673f3605024c1
                                                                                                                                                                                                                                              • Instruction ID: 7c56104a58930782c969e9d8bdc81a1f07ba1f59e2fd19054c48fd757bebff1d
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 299de1fc68536281d3fe39e191cf3aad2c95231a45bdf52044d673f3605024c1
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 77617F32A08A4AC6EB748F15944427A77A0FB56FACF144136DA9C87B95DF3CF890C700
                                                                                                                                                                                                                                              Function 00007FF619BCC7D8 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 144COMMON
                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 00000000.00000002.1925722330.00007FF619BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF619BC0000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1925682521.00007FF619BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1925758127.00007FF619BEA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1925809705.00007FF619BFD000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1925809705.00007FF619C0C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1925902396.00007FF619C0E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_0_2_7ff619bc0000_NEVER OPEN!.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: CurrentImageNonwritableUnwind__except_validate_context_record
                                                                                                                                                                                                                                              • String ID: csm$f
                                                                                                                                                                                                                                              • API String ID: 2395640692-629598281
                                                                                                                                                                                                                                              • Opcode ID: 2a60e48d34e2d081a64a19c3087b12e76bb296e8dfc97340c1001bb2fa126da7
                                                                                                                                                                                                                                              • Instruction ID: b15b32efa89a7fbe440e84abedab9936f7222f09d095605ef9812cb0ed930158
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 2a60e48d34e2d081a64a19c3087b12e76bb296e8dfc97340c1001bb2fa126da7
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: BB51B132F19A0686D765CF15E408A3A37A5FB66FACF508930DA4E97788DF78E8418704
                                                                                                                                                                                                                                              Function 00007FF619BC2240 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 81windowCOMMON
                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 00000000.00000002.1925722330.00007FF619BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF619BC0000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1925682521.00007FF619BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1925758127.00007FF619BEA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1925809705.00007FF619BFD000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1925809705.00007FF619C0C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1925902396.00007FF619C0E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_0_2_7ff619bc0000_NEVER OPEN!.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: DeleteDestroyDialogHandleIconIndirectModuleObjectParam
                                                                                                                                                                                                                                              • String ID: Unhandled exception in script
                                                                                                                                                                                                                                              • API String ID: 3081866767-2699770090
                                                                                                                                                                                                                                              • Opcode ID: d06fa68a38a4eb8fcc30f5dbe48dceb4872e6e84d86a46026ce11bd39583f372
                                                                                                                                                                                                                                              • Instruction ID: 137fae4a072a5b533dae4a1aa04f16d1076e0d0d425e725cb4f38368dc94bed5
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: d06fa68a38a4eb8fcc30f5dbe48dceb4872e6e84d86a46026ce11bd39583f372
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: A9316272A09A8689EB30DF21E8551EA6364FF89FACF440135EA4D8BB59DF3CD145C700
                                                                                                                                                                                                                                              Function 00007FF619BC2620 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 67windowCOMMON
                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                              • GetLastError.KERNEL32(00000000,00000000,00000000,00007FF619BC76A4,?,?,?,?,?,?,?,?,?,?,?,00007FF619BC101D), ref: 00007FF619BC2654
                                                                                                                                                                                                                                                • Part of subcall function 00007FF619BC7410: GetLastError.KERNEL32(00000000,00007FF619BC26A0), ref: 00007FF619BC7437
                                                                                                                                                                                                                                                • Part of subcall function 00007FF619BC7410: FormatMessageW.KERNEL32(00000000,00007FF619BC26A0), ref: 00007FF619BC7466
                                                                                                                                                                                                                                                • Part of subcall function 00007FF619BC7990: MultiByteToWideChar.KERNEL32 ref: 00007FF619BC79CA
                                                                                                                                                                                                                                              • MessageBoxW.USER32 ref: 00007FF619BC272C
                                                                                                                                                                                                                                              • MessageBoxA.USER32 ref: 00007FF619BC2748
                                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 00000000.00000002.1925722330.00007FF619BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF619BC0000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1925682521.00007FF619BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1925758127.00007FF619BEA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1925809705.00007FF619BFD000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1925809705.00007FF619C0C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1925902396.00007FF619C0E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_0_2_7ff619bc0000_NEVER OPEN!.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: Message$ErrorLast$ByteCharFormatMultiWide
                                                                                                                                                                                                                                              • String ID: %s%s: %s$Fatal error detected
                                                                                                                                                                                                                                              • API String ID: 2806210788-2410924014
                                                                                                                                                                                                                                              • Opcode ID: 06cd5466942112b508e396ea70b9586e8f0482aad08493747faa49d6edf4eebc
                                                                                                                                                                                                                                              • Instruction ID: 4bf1df803be2759ccf129fdf1bfe7d9b8730e688868027cd7c0979b6638fc7cd
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 06cd5466942112b508e396ea70b9586e8f0482aad08493747faa49d6edf4eebc
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 52316F72628E8692E7309F11E4517EB7368FB85B9CF404036EA8D83A99DF3CD205CB40
                                                                                                                                                                                                                                              Function 00007FF619BD8C44 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 27libraryloaderCOMMON
                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 00000000.00000002.1925722330.00007FF619BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF619BC0000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1925682521.00007FF619BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1925758127.00007FF619BEA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1925809705.00007FF619BFD000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1925809705.00007FF619C0C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1925902396.00007FF619C0E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_0_2_7ff619bc0000_NEVER OPEN!.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: AddressFreeHandleLibraryModuleProc
                                                                                                                                                                                                                                              • String ID: CorExitProcess$mscoree.dll
                                                                                                                                                                                                                                              • API String ID: 4061214504-1276376045
                                                                                                                                                                                                                                              • Opcode ID: ff0f43bb8c2651fc19042a00c2a68c9718d43f98581b66faf951866b22fbabd4
                                                                                                                                                                                                                                              • Instruction ID: 163be6dd3dc43b2ed40e65287badb4157c03ec46bce1b60eb9425c9b8f92a8bc
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: ff0f43bb8c2651fc19042a00c2a68c9718d43f98581b66faf951866b22fbabd4
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: BBF04461619E0A81EB208F15E8543365364BF47F7DF544639C66E852E4CF2CD545C300
                                                                                                                                                                                                                                              Function 00007FF619BE86CC Relevance: 7.6, APIs: 5, Instructions: 56COMMONLIBRARYCODE
                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 00000000.00000002.1925722330.00007FF619BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF619BC0000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1925682521.00007FF619BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1925758127.00007FF619BEA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1925809705.00007FF619BFD000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1925809705.00007FF619C0C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1925902396.00007FF619C0E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_0_2_7ff619bc0000_NEVER OPEN!.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: _set_statfp
                                                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                                                              • API String ID: 1156100317-0
                                                                                                                                                                                                                                              • Opcode ID: 69d38c35bd33e64192705e47d806ebaffe6519085bb8d16871af39b095092657
                                                                                                                                                                                                                                              • Instruction ID: 552bac61620391b285c89e85d10c26daca9362b7a6184203f9602c0683921781
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 69d38c35bd33e64192705e47d806ebaffe6519085bb8d16871af39b095092657
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: EE11C122E28F0B09F7745E6AD54237700496F57B7CF480AB0EA7E866DADE1CA841510A
                                                                                                                                                                                                                                              Function 00007FF619BDABA0 Relevance: 7.6, APIs: 5, Instructions: 54COMMONLIBRARYCODE
                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                              • FlsGetValue.KERNEL32(?,?,?,00007FF619BD9DBF,?,?,00000000,00007FF619BDA05A,?,?,?,?,?,00007FF619BD201E), ref: 00007FF619BDABBF
                                                                                                                                                                                                                                              • FlsSetValue.KERNEL32(?,?,?,00007FF619BD9DBF,?,?,00000000,00007FF619BDA05A,?,?,?,?,?,00007FF619BD201E), ref: 00007FF619BDABDE
                                                                                                                                                                                                                                              • FlsSetValue.KERNEL32(?,?,?,00007FF619BD9DBF,?,?,00000000,00007FF619BDA05A,?,?,?,?,?,00007FF619BD201E), ref: 00007FF619BDAC06
                                                                                                                                                                                                                                              • FlsSetValue.KERNEL32(?,?,?,00007FF619BD9DBF,?,?,00000000,00007FF619BDA05A,?,?,?,?,?,00007FF619BD201E), ref: 00007FF619BDAC17
                                                                                                                                                                                                                                              • FlsSetValue.KERNEL32(?,?,?,00007FF619BD9DBF,?,?,00000000,00007FF619BDA05A,?,?,?,?,?,00007FF619BD201E), ref: 00007FF619BDAC28
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 00000000.00000002.1925722330.00007FF619BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF619BC0000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1925682521.00007FF619BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1925758127.00007FF619BEA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1925809705.00007FF619BFD000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1925809705.00007FF619C0C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1925902396.00007FF619C0E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_0_2_7ff619bc0000_NEVER OPEN!.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: Value
                                                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                                                              • API String ID: 3702945584-0
                                                                                                                                                                                                                                              • Opcode ID: 94380f9ab8d251d95a8d8ea79ebe565fb33a59bb6cd24ec569ad17321942cf24
                                                                                                                                                                                                                                              • Instruction ID: a3bc2a5d85f8423020d23c3b1660a62e2b1ec1af8741ac1d0806080800538bba
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 94380f9ab8d251d95a8d8ea79ebe565fb33a59bb6cd24ec569ad17321942cf24
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 78114C20A08E0A42FA786F255A5127B22C55F96FBCF485738E83EC67D6DE2CB5428600
                                                                                                                                                                                                                                              Function 00007FF619BDAA34 Relevance: 7.6, APIs: 5, Instructions: 50COMMON
                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                              • FlsGetValue.KERNEL32(?,?,?,?,?,?,?,00007FF619BE2747,?,?,?,00007FF619BDCF10,?,?,00000000,00007FF619BD380F), ref: 00007FF619BDAA45
                                                                                                                                                                                                                                              • FlsSetValue.KERNEL32(?,?,?,?,?,?,?,00007FF619BE2747,?,?,?,00007FF619BDCF10,?,?,00000000,00007FF619BD380F), ref: 00007FF619BDAA64
                                                                                                                                                                                                                                              • FlsSetValue.KERNEL32(?,?,?,?,?,?,?,00007FF619BE2747,?,?,?,00007FF619BDCF10,?,?,00000000,00007FF619BD380F), ref: 00007FF619BDAA8C
                                                                                                                                                                                                                                              • FlsSetValue.KERNEL32(?,?,?,?,?,?,?,00007FF619BE2747,?,?,?,00007FF619BDCF10,?,?,00000000,00007FF619BD380F), ref: 00007FF619BDAA9D
                                                                                                                                                                                                                                              • FlsSetValue.KERNEL32(?,?,?,?,?,?,?,00007FF619BE2747,?,?,?,00007FF619BDCF10,?,?,00000000,00007FF619BD380F), ref: 00007FF619BDAAAE
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 00000000.00000002.1925722330.00007FF619BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF619BC0000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1925682521.00007FF619BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1925758127.00007FF619BEA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1925809705.00007FF619BFD000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1925809705.00007FF619C0C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1925902396.00007FF619C0E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_0_2_7ff619bc0000_NEVER OPEN!.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: Value
                                                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                                                              • API String ID: 3702945584-0
                                                                                                                                                                                                                                              • Opcode ID: 02e010e6fc15830288cb7bd3570cb8411669fc634165f0cae0ca52d8b326d335
                                                                                                                                                                                                                                              • Instruction ID: 3036cab4d37a476bf73562d257a444498c66f2ff416c5233c642c27931d2ec21
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 02e010e6fc15830288cb7bd3570cb8411669fc634165f0cae0ca52d8b326d335
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: C1110924E09E0F41F9B96E21555617B12C24F87F7CF585B38D93ECA3D2EE2CB8419650
                                                                                                                                                                                                                                              Function 00007FF619BDF4D4 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 219COMMON
                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 00000000.00000002.1925722330.00007FF619BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF619BC0000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1925682521.00007FF619BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1925758127.00007FF619BEA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1925809705.00007FF619BFD000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1925809705.00007FF619C0C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1925902396.00007FF619C0E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_0_2_7ff619bc0000_NEVER OPEN!.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: _invalid_parameter_noinfo
                                                                                                                                                                                                                                              • String ID: UTF-16LEUNICODE$UTF-8$ccs
                                                                                                                                                                                                                                              • API String ID: 3215553584-1196891531
                                                                                                                                                                                                                                              • Opcode ID: 0616ab0422fa9c9da61e7b81d7bd0815e3234bc6ac49e26cf25c718118b1d5e3
                                                                                                                                                                                                                                              • Instruction ID: 9168cd15db66a78936460b14b32eb9605a21c591f11b8f2b4be3b7cb610c9b1c
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 0616ab0422fa9c9da61e7b81d7bd0815e3234bc6ac49e26cf25c718118b1d5e3
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 79817276E2DA0A85FB754E2581502BA36E0EB13F6CF558035CA0ED7BA4DF2DE901D701
                                                                                                                                                                                                                                              Function 00007FF619BCE038 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 147COMMON
                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 00000000.00000002.1925722330.00007FF619BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF619BC0000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1925682521.00007FF619BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1925758127.00007FF619BEA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1925809705.00007FF619BFD000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1925809705.00007FF619C0C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1925902396.00007FF619C0E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_0_2_7ff619bc0000_NEVER OPEN!.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: CallEncodePointerTranslator
                                                                                                                                                                                                                                              • String ID: MOC$RCC
                                                                                                                                                                                                                                              • API String ID: 3544855599-2084237596
                                                                                                                                                                                                                                              • Opcode ID: 7879004664854e12467c2bd0163f26a934bd251a603f79bfcf6fe9940e12b56f
                                                                                                                                                                                                                                              • Instruction ID: a0c7055e5009d4726f391945de74c39ce30c41ebdc9f9488d2210fb0975dac74
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 7879004664854e12467c2bd0163f26a934bd251a603f79bfcf6fe9940e12b56f
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 7A613936A08B49CAE7208F65D4803AE77A0FB45BACF144225EE4D97B95CF38E555C740
                                                                                                                                                                                                                                              Function 00007FF619BC24D0 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 67windowCOMMON
                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 00000000.00000002.1925722330.00007FF619BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF619BC0000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1925682521.00007FF619BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1925758127.00007FF619BEA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1925809705.00007FF619BFD000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1925809705.00007FF619C0C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1925902396.00007FF619C0E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_0_2_7ff619bc0000_NEVER OPEN!.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: Message$ByteCharMultiWide
                                                                                                                                                                                                                                              • String ID: %s%s: %s$Fatal error detected
                                                                                                                                                                                                                                              • API String ID: 1878133881-2410924014
                                                                                                                                                                                                                                              • Opcode ID: 3c570bcd5f93380f8cf11f8fb0abc6b872d4b8d8cf7d568423a648373884b94f
                                                                                                                                                                                                                                              • Instruction ID: 2d90a4e482f336642382222d2fae01b88e6fe8c5821446e3045a2682264cdb99
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 3c570bcd5f93380f8cf11f8fb0abc6b872d4b8d8cf7d568423a648373884b94f
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 44314172628E8691E630DB11E4517EB63A8FB85F9CF404135EA8D87699DF3CD205CB40
                                                                                                                                                                                                                                              Function 00007FF619BC3B80 Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 36COMMON
                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                              • GetModuleFileNameW.KERNEL32(?,00007FF619BC3679), ref: 00007FF619BC3BB1
                                                                                                                                                                                                                                                • Part of subcall function 00007FF619BC2620: GetLastError.KERNEL32(00000000,00000000,00000000,00007FF619BC76A4,?,?,?,?,?,?,?,?,?,?,?,00007FF619BC101D), ref: 00007FF619BC2654
                                                                                                                                                                                                                                                • Part of subcall function 00007FF619BC2620: MessageBoxW.USER32 ref: 00007FF619BC272C
                                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 00000000.00000002.1925722330.00007FF619BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF619BC0000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1925682521.00007FF619BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1925758127.00007FF619BEA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1925809705.00007FF619BFD000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1925809705.00007FF619C0C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1925902396.00007FF619C0E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_0_2_7ff619bc0000_NEVER OPEN!.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: ErrorFileLastMessageModuleName
                                                                                                                                                                                                                                              • String ID: Failed to convert executable path to UTF-8.$Failed to get executable path.$GetModuleFileNameW
                                                                                                                                                                                                                                              • API String ID: 2581892565-1977442011
                                                                                                                                                                                                                                              • Opcode ID: f8ba9f07eefac00cb7b5b0959671e8cba28b74ac583d28598444145a4f5a2d24
                                                                                                                                                                                                                                              • Instruction ID: a31bcd8ce8856a64d081c40b954d7b7d5bd7c50aaff030531b37154b86fedb60
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: f8ba9f07eefac00cb7b5b0959671e8cba28b74ac583d28598444145a4f5a2d24
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 6501A721B1DE4A81FA719F25D8563B72359AF4EFACF801031F84EC6696EE5DE2448700
                                                                                                                                                                                                                                              Function 00007FF619BDBDE0 Relevance: 6.3, APIs: 4, Instructions: 305fileCOMMON
                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 00000000.00000002.1925722330.00007FF619BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF619BC0000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1925682521.00007FF619BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1925758127.00007FF619BEA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1925809705.00007FF619BFD000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1925809705.00007FF619C0C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1925902396.00007FF619C0E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_0_2_7ff619bc0000_NEVER OPEN!.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: FileWrite$ConsoleErrorLastOutput
                                                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                                                              • API String ID: 2718003287-0
                                                                                                                                                                                                                                              • Opcode ID: 1b79c134a33bd4231d66c587d2526c3880ce128d08015e7c63db30693dd1efe9
                                                                                                                                                                                                                                              • Instruction ID: fa262bfa06b117c700a7056b6eba9aeb8a2d5e36f3ff7b1780bd3171a45561c5
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 1b79c134a33bd4231d66c587d2526c3880ce128d08015e7c63db30693dd1efe9
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 80D10432B08E898AE720CFB9D4401AE37B5F756BACB104236DE5D97B99CE38D446C740
                                                                                                                                                                                                                                              Function 00007FF619BE59B8 Relevance: 6.2, APIs: 4, Instructions: 159COMMON
                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 00000000.00000002.1925722330.00007FF619BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF619BC0000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1925682521.00007FF619BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1925758127.00007FF619BEA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1925809705.00007FF619BFD000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1925809705.00007FF619C0C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1925902396.00007FF619C0E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_0_2_7ff619bc0000_NEVER OPEN!.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: _invalid_parameter_noinfo$_get_daylight
                                                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                                                              • API String ID: 72036449-0
                                                                                                                                                                                                                                              • Opcode ID: 142d09892d70a128fabe7da41fc771e354b7d6daf49b9f9834e29c658f9ef022
                                                                                                                                                                                                                                              • Instruction ID: 99491eb5a51c5ac9cff583131d14628610d8528fc807dc48c5577c6724adfd7f
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 142d09892d70a128fabe7da41fc771e354b7d6daf49b9f9834e29c658f9ef022
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: DC51D236D0CA4E86FB784D2A958537F6689AF42F3CF195075CA0DC72C6EEACE8408641
                                                                                                                                                                                                                                              Function 00007FF619BC1F70 Relevance: 6.1, APIs: 4, Instructions: 52COMMON
                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 00000000.00000002.1925722330.00007FF619BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF619BC0000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1925682521.00007FF619BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1925758127.00007FF619BEA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1925809705.00007FF619BFD000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1925809705.00007FF619C0C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1925902396.00007FF619C0E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_0_2_7ff619bc0000_NEVER OPEN!.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: LongWindow$DialogInvalidateRect
                                                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                                                              • API String ID: 1956198572-0
                                                                                                                                                                                                                                              • Opcode ID: 162ef6909b0da24e61350fefbcaa0130b5f771c4d53ef42d88aea1c24daf7f6c
                                                                                                                                                                                                                                              • Instruction ID: 8fc364818019999867b0e8afc994f1b2af56a86abafa3a2e1197bc33824ac566
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 162ef6909b0da24e61350fefbcaa0130b5f771c4d53ef42d88aea1c24daf7f6c
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 2E11CC21F1894A42F6759F6AE5442BB5296FF8AFA4F448031E94987BDDCE3CE4C58600
                                                                                                                                                                                                                                              Function 00007FF619BE4C64 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 121COMMON
                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 00000000.00000002.1925722330.00007FF619BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF619BC0000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1925682521.00007FF619BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1925758127.00007FF619BEA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1925809705.00007FF619BFD000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1925809705.00007FF619C0C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1925902396.00007FF619C0E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_0_2_7ff619bc0000_NEVER OPEN!.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: _get_daylight$_invalid_parameter_noinfo
                                                                                                                                                                                                                                              • String ID: ?
                                                                                                                                                                                                                                              • API String ID: 1286766494-1684325040
                                                                                                                                                                                                                                              • Opcode ID: 69f73b520b21b0f9adcb6a2582fe92c3a8c1df3c3bf5317e1890c6602cce7a7a
                                                                                                                                                                                                                                              • Instruction ID: 03828a301baadf5510d9b0555910a434e70cef00c9dd957da0be43526b6b4673
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 69f73b520b21b0f9adcb6a2582fe92c3a8c1df3c3bf5317e1890c6602cce7a7a
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 5141D522A18A8A46FB349F26950137B76A6EB82FBCF144275EF5C87BD5DE3CD4418700
                                                                                                                                                                                                                                              Function 00007FF619BD81C4 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 111COMMON
                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                              • _invalid_parameter_noinfo.LIBCMT ref: 00007FF619BD81F6
                                                                                                                                                                                                                                                • Part of subcall function 00007FF619BDA168: RtlFreeHeap.NTDLL(?,?,?,00007FF619BE214A,?,?,?,00007FF619BE2187,?,?,00000000,00007FF619BE2658,?,?,?,00007FF619BE258B), ref: 00007FF619BDA17E
                                                                                                                                                                                                                                                • Part of subcall function 00007FF619BDA168: GetLastError.KERNEL32(?,?,?,00007FF619BE214A,?,?,?,00007FF619BE2187,?,?,00000000,00007FF619BE2658,?,?,?,00007FF619BE258B), ref: 00007FF619BDA188
                                                                                                                                                                                                                                              • GetModuleFileNameW.KERNEL32(?,?,?,?,?,00007FF619BCAD95), ref: 00007FF619BD8214
                                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 00000000.00000002.1925722330.00007FF619BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF619BC0000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1925682521.00007FF619BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1925758127.00007FF619BEA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1925809705.00007FF619BFD000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1925809705.00007FF619C0C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1925902396.00007FF619C0E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_0_2_7ff619bc0000_NEVER OPEN!.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: ErrorFileFreeHeapLastModuleName_invalid_parameter_noinfo
                                                                                                                                                                                                                                              • String ID: C:\Users\user\Desktop\NEVER OPEN!.exe
                                                                                                                                                                                                                                              • API String ID: 3580290477-2776542587
                                                                                                                                                                                                                                              • Opcode ID: a176173fef0ccbd4d4bed4da712cca46ab69a23226048f5ac1d1c883bcbfc120
                                                                                                                                                                                                                                              • Instruction ID: 0c9fb4a3757f411f50d4d6731a49b63bf1298d5475cfbd9ff44549e90e482651
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: a176173fef0ccbd4d4bed4da712cca46ab69a23226048f5ac1d1c883bcbfc120
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 92415D76A08F5685EB249F2598500BA27E4EF46FACF584035E94DC7B95DF3CE4818301
                                                                                                                                                                                                                                              Function 00007FF619BDC48C Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 100fileCOMMON
                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 00000000.00000002.1925722330.00007FF619BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF619BC0000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1925682521.00007FF619BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1925758127.00007FF619BEA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1925809705.00007FF619BFD000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1925809705.00007FF619C0C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1925902396.00007FF619C0E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_0_2_7ff619bc0000_NEVER OPEN!.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: ErrorFileLastWrite
                                                                                                                                                                                                                                              • String ID: U
                                                                                                                                                                                                                                              • API String ID: 442123175-4171548499
                                                                                                                                                                                                                                              • Opcode ID: 67252725bafe0fa8bf31364f03df59fb9b2e68de5134f9a7070a1cd20fbc7f94
                                                                                                                                                                                                                                              • Instruction ID: 22321d87725aa2051f57942ca6d4aa9835da4d6a5ef03690e2191764b912766c
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 67252725bafe0fa8bf31364f03df59fb9b2e68de5134f9a7070a1cd20fbc7f94
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 4341A232A18A4582DB20CF65E8453AA77A5FB99BACF844035EE4EC7794DF3CD541C740
                                                                                                                                                                                                                                              Function 00007FF619BDE8A8 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 66COMMON
                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 00000000.00000002.1925722330.00007FF619BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF619BC0000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1925682521.00007FF619BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1925758127.00007FF619BEA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1925809705.00007FF619BFD000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1925809705.00007FF619C0C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1925902396.00007FF619C0E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_0_2_7ff619bc0000_NEVER OPEN!.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: CurrentDirectory
                                                                                                                                                                                                                                              • String ID: :
                                                                                                                                                                                                                                              • API String ID: 1611563598-336475711
                                                                                                                                                                                                                                              • Opcode ID: 16cf962f557399a5b9a88750217ef475d70c6cb8f93fcbd39997db375700c90f
                                                                                                                                                                                                                                              • Instruction ID: 84aaca8b24a7f919da834f0f5949ac4c6f0c28dd199f11089bc90c8ea1bb6561
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 16cf962f557399a5b9a88750217ef475d70c6cb8f93fcbd39997db375700c90f
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: FE21B122A08A8A82EB709F15D44827F63E5FB86F9CF858035DA8D83385CF7CE945C750
                                                                                                                                                                                                                                              Function 00007FF619BC2880 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 55windowCOMMON
                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 00000000.00000002.1925722330.00007FF619BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF619BC0000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1925682521.00007FF619BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1925758127.00007FF619BEA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1925809705.00007FF619BFD000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1925809705.00007FF619C0C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1925902396.00007FF619C0E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_0_2_7ff619bc0000_NEVER OPEN!.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: Message$ByteCharMultiWide
                                                                                                                                                                                                                                              • String ID: Error detected
                                                                                                                                                                                                                                              • API String ID: 1878133881-3513342764
                                                                                                                                                                                                                                              • Opcode ID: 18eadb67fbb2c3cbef872a99c290c15a109ae082efd03a83ae2dadf328579188
                                                                                                                                                                                                                                              • Instruction ID: 98b1ed5e84292c9642fe6d84010e5ecb9c426467469c046eb453f9aeada07b42
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 18eadb67fbb2c3cbef872a99c290c15a109ae082efd03a83ae2dadf328579188
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 7B21B272628A8681E7309B11F4503EB6368FB85B9CF805035EA8D87A99CF3CD205C740
                                                                                                                                                                                                                                              Function 00007FF619BC2770 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 55windowCOMMON
                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 00000000.00000002.1925722330.00007FF619BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF619BC0000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1925682521.00007FF619BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1925758127.00007FF619BEA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1925809705.00007FF619BFD000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1925809705.00007FF619C0C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1925902396.00007FF619C0E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_0_2_7ff619bc0000_NEVER OPEN!.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: Message$ByteCharMultiWide
                                                                                                                                                                                                                                              • String ID: Fatal error detected
                                                                                                                                                                                                                                              • API String ID: 1878133881-4025702859
                                                                                                                                                                                                                                              • Opcode ID: ac47e685d134c055f7f1d81993406eeced8960994c7a98791e9bcb406dc1c58f
                                                                                                                                                                                                                                              • Instruction ID: b59531e00a11e5213de59feb1d7e7c42114e5ec6079ad4ec956f26c30c5a51e5
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: ac47e685d134c055f7f1d81993406eeced8960994c7a98791e9bcb406dc1c58f
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 9F216072628A8691EB309B11F4517EB6368FB85B9CF805135EA8D87A99DF3CD205CB40
                                                                                                                                                                                                                                              Function 00007FF619BCEED0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 42COMMON
                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 00000000.00000002.1925722330.00007FF619BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF619BC0000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1925682521.00007FF619BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1925758127.00007FF619BEA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1925809705.00007FF619BFD000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1925809705.00007FF619C0C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1925902396.00007FF619C0E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_0_2_7ff619bc0000_NEVER OPEN!.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: ExceptionFileHeaderRaise
                                                                                                                                                                                                                                              • String ID: csm
                                                                                                                                                                                                                                              • API String ID: 2573137834-1018135373
                                                                                                                                                                                                                                              • Opcode ID: f2f421f33013e271a98c8c3cf8ccb065ddc751b20d67eed513ec00e007a6c83c
                                                                                                                                                                                                                                              • Instruction ID: b0484badf860f67e3c887c05944cca03ebdd24dbccdfbe6adaeeaa3b415f3477
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: f2f421f33013e271a98c8c3cf8ccb065ddc751b20d67eed513ec00e007a6c83c
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: B8114F32618F4582EB218F15E54026A77A4FB89FA8F184234EE8C47764DF3CE951CB00
                                                                                                                                                                                                                                              Function 00007FF619BDF37C Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 34COMMON
                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 00000000.00000002.1925722330.00007FF619BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF619BC0000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1925682521.00007FF619BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1925758127.00007FF619BEA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1925809705.00007FF619BFD000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1925809705.00007FF619C0C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1925902396.00007FF619C0E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_0_2_7ff619bc0000_NEVER OPEN!.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: _invalid_parameter_noinfo
                                                                                                                                                                                                                                              • String ID: :
                                                                                                                                                                                                                                              • API String ID: 3215553584-336475711
                                                                                                                                                                                                                                              • Opcode ID: b117a36f57bb58375fdb7b4df102a580f1cf3bacb37996ca0fb675bd0c3d3589
                                                                                                                                                                                                                                              • Instruction ID: 12432e5533f731889c74c77a3fff5f7afe1d5de7c833e065cdffacb6d9ff7c39
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: b117a36f57bb58375fdb7b4df102a580f1cf3bacb37996ca0fb675bd0c3d3589
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 8F01AD6292CA4A82F730AF60A4622BF63A0EF5AF2CF810035D94DC6785DF2CE5048B14

                                                                                                                                                                                                                                              Execution Graph

                                                                                                                                                                                                                                              Execution Coverage:2.5%
                                                                                                                                                                                                                                              Dynamic/Decrypted Code Coverage:0%
                                                                                                                                                                                                                                              Signature Coverage:0.8%
                                                                                                                                                                                                                                              Total number of Nodes:1054
                                                                                                                                                                                                                                              Total number of Limit Nodes:74
                                                                                                                                                                                                                                              execution_graph 75820 7ffdfae3ff20 75821 7ffdfae3ff6c 75820->75821 75822 7ffdfae3ff7e 00007FFE1FFB5630 75821->75822 75823 7ffdfae3ff91 75821->75823 75822->75823 75824 7ffdfae25330 new[] 4 API calls 75823->75824 75829 7ffdfae3fffa 75824->75829 75825 7ffdfaf46490 4 API calls 75827 7ffdfae400bf 75825->75827 75826 7ffdfae25330 new[] 4 API calls 75828 7ffdfae402ec 75826->75828 75837 7ffdfae400a2 75828->75837 75840 7ffdfae37850 75828->75840 75831 7ffdfae25330 new[] 4 API calls 75829->75831 75836 7ffdfae40092 75829->75836 75829->75837 75831->75836 75832 7ffdfae40347 75834 7ffdfae403c8 75832->75834 75838 7ffdfae404b7 75832->75838 75839 7ffdfae2c000 11 API calls 75832->75839 75834->75838 75857 7ffdfae36dc0 IsProcessorFeaturePresent RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind 75834->75857 75836->75826 75836->75837 75836->75838 75837->75825 75838->75837 75858 7ffdfae36fa0 30 API calls 75838->75858 75839->75834 75841 7ffdfae37a33 75840->75841 75842 7ffdfae378e1 75840->75842 75846 7ffdfae25330 new[] 4 API calls 75841->75846 75850 7ffdfae37915 75841->75850 75842->75841 75843 7ffdfae378fa 75842->75843 75848 7ffdfae25330 new[] 4 API calls 75843->75848 75844 7ffdfae25330 new[] 4 API calls 75845 7ffdfae37989 75844->75845 75847 7ffdfae37995 00007FFE1A4519C0 75845->75847 75855 7ffdfae37b63 75845->75855 75852 7ffdfae37a6b 75846->75852 75849 7ffdfae379fb 75847->75849 75848->75850 75854 7ffdfae37cf8 75849->75854 75859 7ffdfae2e600 75849->75859 75850->75844 75850->75855 75852->75850 75852->75852 75852->75855 75873 7ffdfaedd060 IsProcessorFeaturePresent RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind 75852->75873 75854->75855 75874 7ffdfae36dc0 IsProcessorFeaturePresent RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind 75854->75874 75855->75832 75857->75838 75858->75837 75867 7ffdfae2e64e 75859->75867 75862 7ffdfaf46490 4 API calls 75863 7ffdfae2ec79 75862->75863 75863->75854 75864 7ffdfae2e820 CreateFileW 75864->75867 75867->75864 75868 7ffdfae2eaa2 75867->75868 75870 7ffdfae2e9d5 75867->75870 75875 7ffdfae2b580 75867->75875 75881 7ffdfae2e040 15 API calls new[] 75867->75881 75882 7ffdfae2ee50 10 API calls 75867->75882 75883 7ffdfae286b0 IsProcessorFeaturePresent RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind 75867->75883 75884 7ffdfae2be30 9 API calls 75868->75884 75870->75862 75871 7ffdfae2eacd 75885 7ffdfaedd060 IsProcessorFeaturePresent RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind 75871->75885 75873->75850 75874->75855 75876 7ffdfae2b5be 75875->75876 75877 7ffdfae25330 new[] 4 API calls 75876->75877 75880 7ffdfae2b607 75876->75880 75878 7ffdfae2b5d3 75877->75878 75879 7ffdfae2b5db 00007FFE1A4519C0 75878->75879 75878->75880 75879->75880 75880->75867 75881->75867 75882->75867 75883->75867 75884->75871 75885->75870 75431 7ffdfb413230 75432 7ffdfb413dc7 75431->75432 75433 7ffdfb413248 75431->75433 75434 7ffdfb413cd4 LoadLibraryA 75433->75434 75437 7ffdfb413d2f VirtualProtect VirtualProtect 75433->75437 75435 7ffdfb413cee 75434->75435 75435->75433 75438 7ffdfb413d0d GetProcAddress 75435->75438 75437->75432 75438->75435 75439 7ffdfb413d24 75438->75439 75886 7ffdfae0f920 75887 7ffdfae0f938 75886->75887 75894 7ffdfae10514 75886->75894 75888 7ffdfae1042d LoadLibraryA 75887->75888 75891 7ffdfae1047c VirtualProtect VirtualProtect 75887->75891 75893 7ffdfae10447 75888->75893 75889 7ffdfae10450 GetProcAddress 75892 7ffdfae10471 75889->75892 75889->75893 75891->75894 75893->75887 75893->75889 75894->75894 75440 7ffdfae7bff0 75441 7ffdfae7c01c 75440->75441 75442 7ffdfae7c021 75440->75442 75453 7ffdfae9e9f0 75441->75453 75444 7ffdfae7c119 75442->75444 75450 7ffdfae7c11d 75442->75450 75452 7ffdfae7c106 75442->75452 75457 7ffdfaeb6820 5 API calls new[] 75442->75457 75445 7ffdfae7c15f 75444->75445 75446 7ffdfae7c175 75444->75446 75444->75450 75459 7ffdfae29310 IsProcessorFeaturePresent RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind 75445->75459 75460 7ffdfae29310 IsProcessorFeaturePresent RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind 75446->75460 75452->75444 75458 7ffdfaeb85d0 5 API calls new[] 75452->75458 75454 7ffdfae9ea09 75453->75454 75456 7ffdfae9ea15 75453->75456 75461 7ffdfae9e920 75454->75461 75456->75442 75457->75452 75458->75444 75459->75450 75460->75450 75462 7ffdfae9e95a 75461->75462 75465 7ffdfae9e967 75461->75465 75467 7ffdfae9e490 75462->75467 75464 7ffdfae9e9bd 75464->75456 75465->75464 75466 7ffdfae9e490 47 API calls 75465->75466 75466->75465 75497 7ffdfae9e1b0 75467->75497 75469 7ffdfae9e573 75544 7ffdfaf46490 75469->75544 75470 7ffdfae9e8e7 75543 7ffdfae7c550 00007FFE1A4519C0 IsProcessorFeaturePresent RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind 75470->75543 75472 7ffdfae9e54c 75472->75469 75480 7ffdfae9e628 75472->75480 75482 7ffdfae9e5f7 75472->75482 75526 7ffdfae41510 75472->75526 75476 7ffdfae9e907 75476->75465 75477 7ffdfae9e5bd 75478 7ffdfae9e5c3 75477->75478 75477->75480 75478->75482 75534 7ffdfae259e0 IsProcessorFeaturePresent RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind new[] 75478->75534 75481 7ffdfae9e6b5 75480->75481 75484 7ffdfae9e692 75480->75484 75535 7ffdfae259e0 IsProcessorFeaturePresent RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind new[] 75481->75535 75482->75469 75482->75470 75542 7ffdfae25de0 IsProcessorFeaturePresent RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind 75482->75542 75485 7ffdfae9e78e 75484->75485 75487 7ffdfae9e7d4 75484->75487 75536 7ffdfae259e0 IsProcessorFeaturePresent RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind new[] 75485->75536 75537 7ffdfae284c0 IsProcessorFeaturePresent RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind 75487->75537 75489 7ffdfae9e80c 75538 7ffdfae97d80 47 API calls new[] 75489->75538 75491 7ffdfae9e838 75494 7ffdfae9e866 75491->75494 75539 7ffdfae798a0 47 API calls 75491->75539 75493 7ffdfae9e6c2 75493->75482 75541 7ffdfae42850 33 API calls 75493->75541 75494->75493 75540 7ffdfae7c860 00007FFE1A4519C0 IsProcessorFeaturePresent RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind 75494->75540 75498 7ffdfae9e1d6 75497->75498 75517 7ffdfae9e36c 75497->75517 75499 7ffdfae9e1fc 75498->75499 75500 7ffdfae9e1df 75498->75500 75503 7ffdfae9e3d0 75499->75503 75506 7ffdfae9e23b 75499->75506 75593 7ffdfae9e0a0 IsProcessorFeaturePresent RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind 75500->75593 75502 7ffdfae9e1ea 75502->75472 75503->75517 75601 7ffdfae9e0a0 IsProcessorFeaturePresent RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind 75503->75601 75505 7ffdfae9e288 75551 7ffdfae9ed10 00007FFE1A4519C0 75505->75551 75506->75505 75594 7ffdfae9e0a0 IsProcessorFeaturePresent RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind 75506->75594 75510 7ffdfae9e2f0 75511 7ffdfae9e335 75510->75511 75510->75517 75518 7ffdfae9e371 75510->75518 75598 7ffdfae286b0 IsProcessorFeaturePresent RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind 75511->75598 75512 7ffdfae9e2e8 75595 7ffdfae25de0 IsProcessorFeaturePresent RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind 75512->75595 75513 7ffdfae9e2f2 75513->75510 75596 7ffdfaedb490 00007FFE1A4519C0 IsProcessorFeaturePresent RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind 75513->75596 75516 7ffdfae9e344 75599 7ffdfae286b0 IsProcessorFeaturePresent RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind 75516->75599 75517->75472 75524 7ffdfae9e3a5 75518->75524 75600 7ffdfae52830 40 API calls 75518->75600 75522 7ffdfae9e303 75597 7ffdfae9e0a0 IsProcessorFeaturePresent RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind 75522->75597 75583 7ffdfaed9c00 75524->75583 75530 7ffdfae41547 75526->75530 75527 7ffdfae415a9 75527->75477 75530->75527 75533 7ffdfae41764 75530->75533 75693 7ffdfae410f0 75530->75693 75707 7ffdfae41440 00007FFE1A4519C0 IsProcessorFeaturePresent RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind 75530->75707 75708 7ffdfae35820 22 API calls 75530->75708 75533->75527 75709 7ffdfae39880 6 API calls new[] 75533->75709 75534->75482 75535->75493 75536->75493 75537->75489 75538->75491 75539->75494 75540->75493 75541->75482 75542->75470 75543->75469 75545 7ffdfaf46499 75544->75545 75546 7ffdfaf464a4 75545->75546 75547 7ffdfaf464e4 IsProcessorFeaturePresent 75545->75547 75546->75476 75548 7ffdfaf464fc 75547->75548 75819 7ffdfaf466d8 RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind 75548->75819 75550 7ffdfaf4650f 75550->75476 75552 7ffdfae9ede3 75551->75552 75565 7ffdfae9edf4 75551->75565 75620 7ffdfae29310 IsProcessorFeaturePresent RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind 75552->75620 75554 7ffdfae9efa4 75602 7ffdfaed7890 75554->75602 75555 7ffdfae9eee8 75555->75554 75557 7ffdfae9ef14 75555->75557 75558 7ffdfae9ef45 75557->75558 75559 7ffdfae9ef1d 75557->75559 75563 7ffdfae9ef7d 75558->75563 75623 7ffdfae259e0 IsProcessorFeaturePresent RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind new[] 75558->75623 75622 7ffdfae291f0 IsProcessorFeaturePresent RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind 75559->75622 75561 7ffdfae9eee3 75630 7ffdfae9ea50 00007FFE1A4519C0 IsProcessorFeaturePresent RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind 75561->75630 75579 7ffdfae9f006 75563->75579 75624 7ffdfae259e0 IsProcessorFeaturePresent RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind new[] 75563->75624 75564 7ffdfae9ef56 75564->75563 75573 7ffdfaed7890 5 API calls 75564->75573 75565->75555 75566 7ffdfae9eec3 75565->75566 75621 7ffdfae291f0 IsProcessorFeaturePresent RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind 75566->75621 75570 7ffdfae9f17c 75570->75561 75629 7ffdfae291f0 IsProcessorFeaturePresent RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind 75570->75629 75571 7ffdfae9f256 75575 7ffdfaf46490 4 API calls 75571->75575 75573->75563 75576 7ffdfae9e2c4 75575->75576 75576->75510 75576->75512 75576->75513 75577 7ffdfae9f037 75577->75570 75628 7ffdfae52830 40 API calls 75577->75628 75578 7ffdfae41510 34 API calls 75578->75579 75579->75561 75579->75577 75579->75578 75625 7ffdfae25de0 IsProcessorFeaturePresent RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind 75579->75625 75626 7ffdfae7c550 00007FFE1A4519C0 IsProcessorFeaturePresent RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind 75579->75626 75627 7ffdfae42850 33 API calls 75579->75627 75584 7ffdfaed9c15 75583->75584 75592 7ffdfaed9e09 75583->75592 75584->75592 75675 7ffdfaeda000 75584->75675 75586 7ffdfaed9cc1 75590 7ffdfaed9cd3 75586->75590 75681 7ffdfae86140 75586->75681 75589 7ffdfaed9c72 75589->75586 75688 7ffdfae408a0 31 API calls 75589->75688 75591 7ffdfae7cbe0 5 API calls 75590->75591 75590->75592 75591->75590 75592->75517 75593->75502 75594->75505 75595->75510 75596->75522 75597->75510 75598->75516 75599->75517 75600->75524 75601->75517 75617 7ffdfaed78e1 75602->75617 75604 7ffdfaed7cfb 75643 7ffdfae286b0 IsProcessorFeaturePresent RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind 75604->75643 75606 7ffdfaed7ca4 75641 7ffdfae29310 IsProcessorFeaturePresent RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind 75606->75641 75607 7ffdfaed7d19 75614 7ffdfaed7dba 75607->75614 75644 7ffdfae7cbe0 75607->75644 75609 7ffdfaed7bee 75609->75604 75609->75607 75642 7ffdfae284c0 IsProcessorFeaturePresent RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind 75609->75642 75611 7ffdfaed7e13 75612 7ffdfaf46490 4 API calls 75611->75612 75615 7ffdfaed7e5c 75612->75615 75614->75611 75659 7ffdfaeadec0 00007FFE1A4519C0 IsProcessorFeaturePresent RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind 75614->75659 75615->75563 75617->75606 75617->75609 75631 7ffdfaed6cc0 75617->75631 75618 7ffdfaed7de1 75618->75611 75660 7ffdfae691d0 00007FFE1A4519C0 IsProcessorFeaturePresent RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind 75618->75660 75620->75565 75621->75561 75622->75561 75623->75564 75624->75579 75625->75579 75626->75579 75627->75579 75628->75570 75629->75561 75630->75571 75634 7ffdfaed6d04 75631->75634 75632 7ffdfaed6e27 75635 7ffdfaed6e5b 75632->75635 75636 7ffdfaed6e6e 75632->75636 75640 7ffdfaed6e00 75632->75640 75633 7ffdfaed6de2 75633->75640 75661 7ffdfaed3fc0 IsProcessorFeaturePresent RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind 75633->75661 75634->75632 75634->75633 75662 7ffdfae29310 IsProcessorFeaturePresent RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind 75635->75662 75663 7ffdfae29310 IsProcessorFeaturePresent RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind 75636->75663 75640->75617 75641->75609 75642->75604 75643->75607 75645 7ffdfae7cc94 75644->75645 75656 7ffdfae7cc07 75644->75656 75646 7ffdfae7ccac 75645->75646 75647 7ffdfae7cc9c 75645->75647 75650 7ffdfae7cca7 75646->75650 75672 7ffdfae9f730 00007FFE1A4519C0 IsProcessorFeaturePresent RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind 75646->75672 75671 7ffdfae91690 00007FFE1A4519C0 IsProcessorFeaturePresent RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind 75647->75671 75664 7ffdfae7cb10 75650->75664 75654 7ffdfae7cd6a 75657 7ffdfae7cda6 75654->75657 75673 7ffdfae6a900 00007FFE1A4519C0 IsProcessorFeaturePresent RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind 75654->75673 75656->75645 75668 7ffdfae2ad50 5 API calls new[] 75656->75668 75669 7ffdfae691d0 00007FFE1A4519C0 IsProcessorFeaturePresent RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind 75656->75669 75670 7ffdfae6a900 00007FFE1A4519C0 IsProcessorFeaturePresent RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind 75656->75670 75659->75618 75660->75611 75661->75640 75662->75640 75663->75640 75665 7ffdfae7cb32 75664->75665 75666 7ffdfae7cb9b 75664->75666 75665->75666 75674 7ffdfae6a900 00007FFE1A4519C0 IsProcessorFeaturePresent RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind 75665->75674 75666->75654 75668->75656 75669->75656 75671->75650 75672->75650 75676 7ffdfaeda02f 75675->75676 75678 7ffdfaeda09f 75676->75678 75689 7ffdfae429c0 23 API calls 75676->75689 75680 7ffdfaeda104 75678->75680 75690 7ffdfae7c860 00007FFE1A4519C0 IsProcessorFeaturePresent RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind 75678->75690 75680->75589 75686 7ffdfae86197 75681->75686 75683 7ffdfae8632b 75684 7ffdfae8637e 75683->75684 75685 7ffdfae7cbe0 5 API calls 75683->75685 75684->75590 75685->75683 75686->75683 75691 7ffdfaeadec0 00007FFE1A4519C0 IsProcessorFeaturePresent RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind 75686->75691 75692 7ffdfae691d0 00007FFE1A4519C0 IsProcessorFeaturePresent RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind 75686->75692 75688->75589 75689->75676 75690->75680 75691->75686 75692->75686 75710 7ffdfae38290 75693->75710 75697 7ffdfae412d9 75700 7ffdfae41224 75697->75700 75759 7ffdfae35820 22 API calls 75697->75759 75700->75530 75701 7ffdfae41214 75701->75697 75701->75700 75702 7ffdfae412b7 75701->75702 75703 7ffdfae4128c 75701->75703 75702->75697 75758 7ffdfaedcfe0 IsProcessorFeaturePresent RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind 75702->75758 75757 7ffdfae36dc0 IsProcessorFeaturePresent RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind 75703->75757 75707->75530 75709->75527 75711 7ffdfae38559 75710->75711 75715 7ffdfae382c0 75710->75715 75712 7ffdfae385fe 75711->75712 75766 7ffdfae3ca40 10 API calls 75711->75766 75725 7ffdfae38325 75712->75725 75768 7ffdfae35270 00007FFE1A4519C0 75712->75768 75715->75711 75718 7ffdfae3832a 75715->75718 75723 7ffdfae3831d 75715->75723 75716 7ffdfaf46490 4 API calls 75717 7ffdfae38659 75716->75717 75717->75700 75735 7ffdfae38670 75717->75735 75718->75712 75719 7ffdfae38363 75718->75719 75727 7ffdfae3849a 75718->75727 75731 7ffdfae38375 75718->75731 75761 7ffdfae35270 00007FFE1A4519C0 75719->75761 75720 7ffdfae385bb 75720->75712 75720->75720 75767 7ffdfae328f0 00007FFE1A4519C0 75720->75767 75760 7ffdfae35270 00007FFE1A4519C0 75723->75760 75725->75716 75726 7ffdfae38467 75726->75727 75729 7ffdfae38486 75726->75729 75727->75711 75727->75712 75765 7ffdfae39fd0 00007FFE1A4519C0 IsProcessorFeaturePresent RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind 75727->75765 75728 7ffdfae38424 75728->75726 75728->75729 75763 7ffdfae36070 9 API calls 75728->75763 75764 7ffdfae35270 00007FFE1A4519C0 75729->75764 75731->75712 75731->75728 75762 7ffdfaedd060 IsProcessorFeaturePresent RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind 75731->75762 75736 7ffdfae38692 75735->75736 75737 7ffdfae386c5 75735->75737 75781 7ffdfae286b0 IsProcessorFeaturePresent RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind 75736->75781 75769 7ffdfae336f0 75737->75769 75739 7ffdfae386e9 75740 7ffdfae386be 75739->75740 75741 7ffdfae387ed 75739->75741 75742 7ffdfae3881b 75739->75742 75751 7ffdfae38798 75739->75751 75740->75697 75740->75700 75740->75701 75756 7ffdfae39fd0 00007FFE1A4519C0 IsProcessorFeaturePresent RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind 75740->75756 75782 7ffdfae286b0 IsProcessorFeaturePresent RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind 75741->75782 75745 7ffdfae3884d 75742->75745 75748 7ffdfae38833 75742->75748 75747 7ffdfae38882 75745->75747 75745->75751 75746 7ffdfae388bd 00007FFE1A4519C0 75746->75740 75747->75746 75750 7ffdfae388a5 75747->75750 75784 7ffdfae319e0 6 API calls new[] 75747->75784 75775 7ffdfae36410 75748->75775 75785 7ffdfae34f20 8 API calls new[] 75750->75785 75751->75740 75783 7ffdfae35820 22 API calls 75751->75783 75754 7ffdfae388af 75754->75746 75756->75701 75757->75700 75758->75697 75760->75725 75761->75725 75762->75728 75763->75726 75764->75725 75765->75711 75766->75720 75767->75712 75768->75725 75770 7ffdfae33747 75769->75770 75773 7ffdfae3376e 75770->75773 75774 7ffdfae33783 75770->75774 75795 7ffdfae33040 5 API calls new[] 75770->75795 75773->75739 75774->75773 75786 7ffdfae32e70 75774->75786 75776 7ffdfae3643f 75775->75776 75777 7ffdfae3644c 75775->75777 75816 7ffdfae3ce20 6 API calls 75776->75816 75779 7ffdfae3645c 75777->75779 75806 7ffdfae2c000 75777->75806 75779->75751 75781->75740 75782->75751 75784->75750 75785->75754 75787 7ffdfae32f89 75786->75787 75792 7ffdfae32e98 75786->75792 75787->75773 75788 7ffdfae32f8e 75801 7ffdfae32be0 IsProcessorFeaturePresent RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind new[] 75788->75801 75789 7ffdfae32f06 75789->75787 75789->75788 75791 7ffdfae32f7f 75789->75791 75800 7ffdfae32be0 IsProcessorFeaturePresent RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind new[] 75791->75800 75792->75789 75796 7ffdfae25330 75792->75796 75795->75774 75797 7ffdfae25349 75796->75797 75798 7ffdfae253f5 75796->75798 75797->75798 75802 7ffdfae24b85 75797->75802 75798->75789 75800->75787 75801->75787 75803 7ffdfae24b96 75802->75803 75804 7ffdfae24bb0 75803->75804 75805 7ffdfae286b0 IsProcessorFeaturePresent RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind 75803->75805 75804->75798 75805->75804 75814 7ffdfae2c02d 75806->75814 75807 7ffdfae2c0a4 ReadFile 75808 7ffdfae2c13a 75807->75808 75807->75814 75809 7ffdfae2c16a 75808->75809 75818 7ffdfae286b0 IsProcessorFeaturePresent RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind 75808->75818 75811 7ffdfae2c179 00007FFE1A4519C0 75809->75811 75812 7ffdfae2c044 75809->75812 75811->75812 75812->75779 75813 7ffdfae2c114 75817 7ffdfae2be30 9 API calls 75813->75817 75814->75807 75814->75808 75814->75812 75814->75813 75816->75777 75817->75812 75818->75809 75819->75550 75895 7ff619bd8b11 75907 7ff619bd9438 75895->75907 75897 7ff619bd8b16 75898 7ff619bd8b3d GetModuleHandleW 75897->75898 75899 7ff619bd8b87 75897->75899 75898->75899 75905 7ff619bd8b4a 75898->75905 75900 7ff619bd8a14 11 API calls 75899->75900 75901 7ff619bd8bc3 75900->75901 75902 7ff619bd8bca 75901->75902 75903 7ff619bd8be0 11 API calls 75901->75903 75904 7ff619bd8bdc 75903->75904 75905->75899 75906 7ff619bd8c44 GetModuleHandleExW GetProcAddress FreeLibrary 75905->75906 75906->75899 75912 7ff619bda960 45 API calls 3 library calls 75907->75912 75909 7ff619bd9441 75913 7ff619bd956c 45 API calls 2 library calls 75909->75913 75912->75909 75914 7ff619bcae2c 75935 7ff619bcb29c 75914->75935 75917 7ff619bcaf78 76031 7ff619bcb5cc 7 API calls 2 library calls 75917->76031 75918 7ff619bcae48 __scrt_acquire_startup_lock 75920 7ff619bcaf82 75918->75920 75927 7ff619bcae66 __scrt_release_startup_lock 75918->75927 76032 7ff619bcb5cc 7 API calls 2 library calls 75920->76032 75922 7ff619bcae8b 75923 7ff619bcaf8d __CxxCallCatchBlock 75924 7ff619bcaf11 75941 7ff619bcb718 75924->75941 75926 7ff619bcaf16 75944 7ff619bc1000 75926->75944 75927->75922 75927->75924 76028 7ff619bd8ce8 45 API calls 75927->76028 75932 7ff619bcaf39 75932->75923 76030 7ff619bcb430 7 API calls __scrt_initialize_crt 75932->76030 75934 7ff619bcaf50 75934->75922 76033 7ff619bcb89c 75935->76033 75938 7ff619bcae40 75938->75917 75938->75918 75939 7ff619bcb2cb __scrt_initialize_crt 75939->75938 76035 7ff619bcc9f8 7 API calls 2 library calls 75939->76035 76036 7ff619bcc140 75941->76036 75945 7ff619bc100b 75944->75945 76038 7ff619bc7560 75945->76038 75947 7ff619bc101d 76045 7ff619bd4cc8 75947->76045 75949 7ff619bc365b 76052 7ff619bc1af0 75949->76052 75955 7ff619bc3679 76019 7ff619bc377a 75955->76019 76068 7ff619bc3b00 75955->76068 75957 7ff619bc36ab 75957->76019 76071 7ff619bc6950 75957->76071 75959 7ff619bc36c7 75960 7ff619bc3713 75959->75960 75961 7ff619bc6950 61 API calls 75959->75961 76086 7ff619bc6ef0 75960->76086 75966 7ff619bc36e8 __std_exception_copy 75961->75966 75963 7ff619bc3728 76090 7ff619bc19d0 75963->76090 75966->75960 75969 7ff619bc6ef0 58 API calls 75966->75969 75967 7ff619bc19d0 121 API calls 75968 7ff619bc375e 75967->75968 75973 7ff619bc3762 75968->75973 75977 7ff619bc37a0 75968->75977 75969->75960 75972 7ff619bc3868 75974 7ff619bc387e SetDllDirectoryW 75972->75974 75975 7ff619bc386d 75972->75975 76166 7ff619bc2770 59 API calls 2 library calls 75973->76166 75979 7ff619bc388b 75974->75979 76201 7ff619bc2770 59 API calls 2 library calls 75975->76201 75993 7ff619bc381d 75977->75993 76176 7ff619bc3c90 75977->76176 75978 7ff619bc3848 75978->75979 76101 7ff619bc7990 75978->76101 76115 7ff619bc5e20 75979->76115 75985 7ff619bc38e6 75994 7ff619bc39a6 75985->75994 76000 7ff619bc38f9 75985->76000 75986 7ff619bc37c2 76199 7ff619bc2770 59 API calls 2 library calls 75986->76199 75989 7ff619bc37f0 75992 7ff619bc37f5 75989->75992 75989->75993 75991 7ff619bc38a8 75991->75985 76203 7ff619bc5620 161 API calls 3 library calls 75991->76203 76195 7ff619bcf1c8 75992->76195 75993->75978 76200 7ff619bc3260 59 API calls 75993->76200 76156 7ff619bc30f0 75994->76156 75998 7ff619bc38b9 76001 7ff619bc38bd 75998->76001 76002 7ff619bc38dc 75998->76002 76009 7ff619bc3945 76000->76009 76207 7ff619bc1b30 76000->76207 76204 7ff619bc55b0 91 API calls 76001->76204 76206 7ff619bc5870 FreeLibrary 76002->76206 76007 7ff619bc38c7 76007->76002 76010 7ff619bc38cb 76007->76010 76008 7ff619bc39db 76011 7ff619bc6950 61 API calls 76008->76011 76009->76019 76119 7ff619bc3090 76009->76119 76205 7ff619bc5c70 60 API calls 76010->76205 76014 7ff619bc39e7 76011->76014 76017 7ff619bc39f8 76014->76017 76014->76019 76015 7ff619bc3981 76211 7ff619bc5870 FreeLibrary 76015->76211 76016 7ff619bc38da 76016->75985 76213 7ff619bc6f30 64 API calls 2 library calls 76017->76213 76167 7ff619bcacc0 76019->76167 76021 7ff619bc3a10 76214 7ff619bc5870 FreeLibrary 76021->76214 76023 7ff619bc3a1c 76024 7ff619bc3a37 76023->76024 76215 7ff619bc6bf0 67 API calls 2 library calls 76023->76215 76216 7ff619bc1ab0 74 API calls __std_exception_copy 76024->76216 76027 7ff619bc3a3f 76027->76019 76028->75924 76029 7ff619bcb75c GetModuleHandleW 76029->75932 76030->75934 76031->75920 76032->75923 76034 7ff619bcb2be __scrt_dllmain_crt_thread_attach 76033->76034 76034->75938 76034->75939 76035->75938 76037 7ff619bcb72f GetStartupInfoW 76036->76037 76037->75926 76040 7ff619bc757f 76038->76040 76039 7ff619bc75d0 WideCharToMultiByte 76039->76040 76042 7ff619bc7678 76039->76042 76040->76039 76040->76042 76043 7ff619bc7626 WideCharToMultiByte 76040->76043 76044 7ff619bc7587 __std_exception_copy 76040->76044 76217 7ff619bc2620 57 API calls 2 library calls 76042->76217 76043->76040 76043->76042 76044->75947 76048 7ff619bdef9c 76045->76048 76046 7ff619bdefef 76218 7ff619bda030 37 API calls 2 library calls 76046->76218 76048->76046 76049 7ff619bdf045 76048->76049 76219 7ff619bdee74 71 API calls _fread_nolock 76049->76219 76051 7ff619bdf018 76051->75949 76053 7ff619bc1b05 76052->76053 76054 7ff619bc1b20 76053->76054 76220 7ff619bc24d0 59 API calls 2 library calls 76053->76220 76054->76019 76056 7ff619bc3b80 76054->76056 76221 7ff619bcacf0 76056->76221 76059 7ff619bc3bd2 76224 7ff619bc7aa0 59 API calls 76059->76224 76060 7ff619bc3bbb 76223 7ff619bc2620 57 API calls 2 library calls 76060->76223 76063 7ff619bc3bce 76066 7ff619bcacc0 _wfindfirst32i64 8 API calls 76063->76066 76064 7ff619bc3be5 76064->76063 76225 7ff619bc2770 59 API calls 2 library calls 76064->76225 76067 7ff619bc3c0f 76066->76067 76067->75955 76069 7ff619bc1b30 49 API calls 76068->76069 76070 7ff619bc3b1d 76069->76070 76070->75957 76072 7ff619bc695a 76071->76072 76073 7ff619bc7990 57 API calls 76072->76073 76074 7ff619bc697c GetEnvironmentVariableW 76073->76074 76075 7ff619bc6994 ExpandEnvironmentStringsW 76074->76075 76076 7ff619bc69e6 76074->76076 76226 7ff619bc7aa0 59 API calls 76075->76226 76077 7ff619bcacc0 _wfindfirst32i64 8 API calls 76076->76077 76079 7ff619bc69f8 76077->76079 76079->75959 76080 7ff619bc69bc 76080->76076 76081 7ff619bc69c6 76080->76081 76227 7ff619bd946c 37 API calls 2 library calls 76081->76227 76083 7ff619bc69ce 76084 7ff619bcacc0 _wfindfirst32i64 8 API calls 76083->76084 76085 7ff619bc69de 76084->76085 76085->75959 76087 7ff619bc7990 57 API calls 76086->76087 76088 7ff619bc6f07 SetEnvironmentVariableW 76087->76088 76089 7ff619bc6f1f __std_exception_copy 76088->76089 76089->75963 76091 7ff619bc1b30 49 API calls 76090->76091 76092 7ff619bc1a00 76091->76092 76093 7ff619bc1b30 49 API calls 76092->76093 76099 7ff619bc1a7a 76092->76099 76094 7ff619bc1a22 76093->76094 76095 7ff619bc3b00 49 API calls 76094->76095 76094->76099 76096 7ff619bc1a3b 76095->76096 76228 7ff619bc17b0 76096->76228 76099->75967 76099->75993 76100 7ff619bcf1c8 74 API calls 76100->76099 76102 7ff619bc79b1 MultiByteToWideChar 76101->76102 76103 7ff619bc7a37 MultiByteToWideChar 76101->76103 76106 7ff619bc79d7 76102->76106 76107 7ff619bc79fc 76102->76107 76104 7ff619bc7a7f 76103->76104 76105 7ff619bc7a5a 76103->76105 76104->75972 76313 7ff619bc2620 57 API calls 2 library calls 76105->76313 76311 7ff619bc2620 57 API calls 2 library calls 76106->76311 76107->76103 76112 7ff619bc7a12 76107->76112 76110 7ff619bc7a6d 76110->75972 76111 7ff619bc79ea 76111->75972 76312 7ff619bc2620 57 API calls 2 library calls 76112->76312 76114 7ff619bc7a25 76114->75972 76116 7ff619bc5e35 76115->76116 76117 7ff619bc3890 76116->76117 76314 7ff619bc24d0 59 API calls 2 library calls 76116->76314 76117->75985 76202 7ff619bc5ac0 122 API calls 2 library calls 76117->76202 76315 7ff619bc4940 76119->76315 76122 7ff619bc30dd 76122->76015 76124 7ff619bc30b4 76124->76122 76371 7ff619bc46c0 76124->76371 76126 7ff619bc30c0 76126->76122 76381 7ff619bc4820 76126->76381 76128 7ff619bc30cc 76128->76122 76129 7ff619bc3307 76128->76129 76130 7ff619bc331c 76128->76130 76412 7ff619bc2770 59 API calls 2 library calls 76129->76412 76132 7ff619bc333c 76130->76132 76144 7ff619bc3352 __std_exception_copy 76130->76144 76413 7ff619bc2770 59 API calls 2 library calls 76132->76413 76133 7ff619bcacc0 _wfindfirst32i64 8 API calls 76135 7ff619bc34aa 76133->76135 76135->76015 76136 7ff619bc3313 __std_exception_copy 76136->76133 76139 7ff619bc1b30 49 API calls 76139->76144 76140 7ff619bc35eb 76421 7ff619bc2770 59 API calls 2 library calls 76140->76421 76142 7ff619bc35c5 76420 7ff619bc2770 59 API calls 2 library calls 76142->76420 76144->76136 76144->76139 76144->76140 76144->76142 76145 7ff619bc34b6 76144->76145 76386 7ff619bc12b0 76144->76386 76414 7ff619bc1780 59 API calls 76144->76414 76146 7ff619bc3522 76145->76146 76415 7ff619bd946c 37 API calls 2 library calls 76145->76415 76416 7ff619bc16d0 59 API calls 76146->76416 76149 7ff619bc3544 76150 7ff619bc3549 76149->76150 76151 7ff619bc3557 76149->76151 76417 7ff619bd946c 37 API calls 2 library calls 76150->76417 76418 7ff619bc2de0 37 API calls 76151->76418 76154 7ff619bc3555 76419 7ff619bc23b0 62 API calls __std_exception_copy 76154->76419 76162 7ff619bc3163 76156->76162 76165 7ff619bc31a4 76156->76165 76157 7ff619bc31e3 76158 7ff619bcacc0 _wfindfirst32i64 8 API calls 76157->76158 76160 7ff619bc31f5 76158->76160 76160->76019 76212 7ff619bc6e80 57 API calls __std_exception_copy 76160->76212 76162->76165 76537 7ff619bc2990 76162->76537 76591 7ff619bc1440 161 API calls 2 library calls 76162->76591 76593 7ff619bc1780 59 API calls 76162->76593 76165->76157 76592 7ff619bc1ab0 74 API calls __std_exception_copy 76165->76592 76166->76019 76169 7ff619bcacc9 76167->76169 76168 7ff619bc378e 76168->76029 76169->76168 76170 7ff619bcaff0 IsProcessorFeaturePresent 76169->76170 76171 7ff619bcb008 76170->76171 76693 7ff619bcb1e4 RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind 76171->76693 76173 7ff619bcb01b 76694 7ff619bcafb4 SetUnhandledExceptionFilter UnhandledExceptionFilter GetCurrentProcess TerminateProcess 76173->76694 76177 7ff619bc3c9c 76176->76177 76178 7ff619bc7990 57 API calls 76177->76178 76179 7ff619bc3cc7 76178->76179 76180 7ff619bc7990 57 API calls 76179->76180 76181 7ff619bc3cda 76180->76181 76695 7ff619bd5278 76181->76695 76184 7ff619bcacc0 _wfindfirst32i64 8 API calls 76185 7ff619bc37ba 76184->76185 76185->75986 76186 7ff619bc7160 76185->76186 76187 7ff619bc7184 76186->76187 76188 7ff619bc725b __std_exception_copy 76187->76188 76189 7ff619bcf830 73 API calls 76187->76189 76188->75989 76190 7ff619bc719e 76189->76190 76190->76188 76863 7ff619bd7c94 76190->76863 76192 7ff619bc71b3 76192->76188 76193 7ff619bcf830 73 API calls 76192->76193 76194 7ff619bcf518 _fread_nolock 53 API calls 76192->76194 76193->76192 76194->76192 76196 7ff619bcf1f8 76195->76196 76879 7ff619bcefa8 76196->76879 76198 7ff619bcf211 76198->75986 76199->76019 76200->75978 76201->76019 76202->75991 76203->75998 76204->76007 76205->76016 76206->75985 76208 7ff619bc1b55 76207->76208 76209 7ff619bd3994 49 API calls 76208->76209 76210 7ff619bc1b78 76209->76210 76210->76009 76211->76019 76212->76008 76213->76021 76214->76023 76215->76024 76216->76027 76217->76044 76218->76051 76219->76051 76220->76054 76222 7ff619bc3b8c GetModuleFileNameW 76221->76222 76222->76059 76222->76060 76223->76063 76224->76064 76225->76063 76226->76080 76227->76083 76229 7ff619bc17e4 76228->76229 76230 7ff619bc17d4 76228->76230 76232 7ff619bc7160 83 API calls 76229->76232 76257 7ff619bc1842 76229->76257 76231 7ff619bc3c90 116 API calls 76230->76231 76231->76229 76233 7ff619bc1815 76232->76233 76233->76257 76262 7ff619bcf830 76233->76262 76235 7ff619bcacc0 _wfindfirst32i64 8 API calls 76237 7ff619bc19c0 76235->76237 76236 7ff619bc182b 76238 7ff619bc182f 76236->76238 76239 7ff619bc184c 76236->76239 76237->76099 76237->76100 76275 7ff619bc24d0 59 API calls 2 library calls 76238->76275 76266 7ff619bcf518 76239->76266 76243 7ff619bc1867 76276 7ff619bc24d0 59 API calls 2 library calls 76243->76276 76244 7ff619bcf830 73 API calls 76246 7ff619bc18d1 76244->76246 76247 7ff619bc18fe 76246->76247 76248 7ff619bc18e3 76246->76248 76249 7ff619bcf518 _fread_nolock 53 API calls 76247->76249 76277 7ff619bc24d0 59 API calls 2 library calls 76248->76277 76251 7ff619bc1913 76249->76251 76251->76243 76252 7ff619bc1925 76251->76252 76269 7ff619bcf28c 76252->76269 76255 7ff619bc193d 76278 7ff619bc2770 59 API calls 2 library calls 76255->76278 76257->76235 76258 7ff619bc1993 76258->76257 76260 7ff619bcf1c8 74 API calls 76258->76260 76259 7ff619bc1950 76259->76258 76279 7ff619bc2770 59 API calls 2 library calls 76259->76279 76260->76257 76263 7ff619bcf860 76262->76263 76280 7ff619bcf5e0 76263->76280 76265 7ff619bcf879 76265->76236 76293 7ff619bcf538 76266->76293 76270 7ff619bcf295 76269->76270 76271 7ff619bc1939 76269->76271 76309 7ff619bd41f4 11 API calls _wfindfirst32i64 76270->76309 76271->76255 76271->76259 76273 7ff619bcf29a 76310 7ff619bda100 37 API calls _invalid_parameter_noinfo 76273->76310 76275->76257 76276->76257 76277->76257 76278->76257 76279->76258 76281 7ff619bcf64a 76280->76281 76282 7ff619bcf60a 76280->76282 76281->76282 76283 7ff619bcf64f 76281->76283 76292 7ff619bda030 37 API calls 2 library calls 76282->76292 76291 7ff619bd409c EnterCriticalSection 76283->76291 76286 7ff619bcf631 76286->76265 76287 7ff619bcf654 76288 7ff619bcf758 71 API calls 76287->76288 76289 7ff619bcf666 76288->76289 76290 7ff619bd40a8 _fread_nolock LeaveCriticalSection 76289->76290 76290->76286 76292->76286 76294 7ff619bcf562 76293->76294 76295 7ff619bc1861 76293->76295 76294->76295 76296 7ff619bcf5ae 76294->76296 76297 7ff619bcf571 memcpy_s 76294->76297 76295->76243 76295->76244 76306 7ff619bd409c EnterCriticalSection 76296->76306 76307 7ff619bd41f4 11 API calls _wfindfirst32i64 76297->76307 76300 7ff619bcf5b6 76302 7ff619bcf2b8 _fread_nolock 51 API calls 76300->76302 76301 7ff619bcf586 76308 7ff619bda100 37 API calls _invalid_parameter_noinfo 76301->76308 76304 7ff619bcf5cd 76302->76304 76305 7ff619bd40a8 _fread_nolock LeaveCriticalSection 76304->76305 76305->76295 76307->76301 76309->76273 76311->76111 76312->76114 76313->76110 76314->76117 76316 7ff619bc4950 76315->76316 76317 7ff619bc1b30 49 API calls 76316->76317 76318 7ff619bc4982 76317->76318 76319 7ff619bc49ab 76318->76319 76320 7ff619bc498b 76318->76320 76322 7ff619bc4a02 76319->76322 76422 7ff619bc3d10 76319->76422 76435 7ff619bc2770 59 API calls 2 library calls 76320->76435 76323 7ff619bc3d10 49 API calls 76322->76323 76325 7ff619bc4a1b 76323->76325 76327 7ff619bc4a39 76325->76327 76437 7ff619bc2770 59 API calls 2 library calls 76325->76437 76326 7ff619bc49cc 76328 7ff619bc49ea 76326->76328 76436 7ff619bc2770 59 API calls 2 library calls 76326->76436 76431 7ff619bc7110 76327->76431 76425 7ff619bc3c20 76328->76425 76329 7ff619bcacc0 _wfindfirst32i64 8 API calls 76334 7ff619bc309e 76329->76334 76334->76122 76343 7ff619bc4cc0 76334->76343 76335 7ff619bc4a46 76337 7ff619bc4a6d 76335->76337 76338 7ff619bc4a4b 76335->76338 76439 7ff619bc3dd0 112 API calls 76337->76439 76438 7ff619bc2620 57 API calls 2 library calls 76338->76438 76341 7ff619bc7110 58 API calls 76341->76322 76342 7ff619bc49a1 76342->76329 76344 7ff619bc6950 61 API calls 76343->76344 76346 7ff619bc4cd5 76344->76346 76345 7ff619bc4cf0 76347 7ff619bc7990 57 API calls 76345->76347 76346->76345 76467 7ff619bc2880 59 API calls 2 library calls 76346->76467 76349 7ff619bc4d34 76347->76349 76350 7ff619bc4d50 76349->76350 76351 7ff619bc4d39 76349->76351 76354 7ff619bc7990 57 API calls 76350->76354 76468 7ff619bc2770 59 API calls 2 library calls 76351->76468 76353 7ff619bc4d45 76353->76124 76355 7ff619bc4d85 76354->76355 76358 7ff619bc1b30 49 API calls 76355->76358 76369 7ff619bc4d8a __std_exception_copy 76355->76369 76357 7ff619bc4f31 76357->76124 76359 7ff619bc4e07 76358->76359 76360 7ff619bc4e0e 76359->76360 76361 7ff619bc4e33 76359->76361 76469 7ff619bc2770 59 API calls 2 library calls 76360->76469 76362 7ff619bc7990 57 API calls 76361->76362 76365 7ff619bc4e4c 76362->76365 76364 7ff619bc4e23 76364->76124 76365->76369 76440 7ff619bc4aa0 76365->76440 76370 7ff619bc4f1a 76369->76370 76471 7ff619bc2770 59 API calls 2 library calls 76369->76471 76370->76124 76372 7ff619bc46d7 76371->76372 76373 7ff619bc4700 76372->76373 76374 7ff619bc4717 __std_exception_copy 76372->76374 76487 7ff619bc2770 59 API calls 2 library calls 76373->76487 76377 7ff619bc12b0 122 API calls 76374->76377 76379 7ff619bc47ff 76374->76379 76488 7ff619bc2770 59 API calls 2 library calls 76374->76488 76489 7ff619bc1780 59 API calls 76374->76489 76376 7ff619bc470c 76376->76126 76377->76374 76379->76126 76382 7ff619bc4927 76381->76382 76384 7ff619bc483b 76381->76384 76382->76128 76384->76382 76385 7ff619bc2770 59 API calls 76384->76385 76490 7ff619bc1780 59 API calls 76384->76490 76385->76384 76387 7ff619bc12f8 76386->76387 76388 7ff619bc12c6 76386->76388 76389 7ff619bcf830 73 API calls 76387->76389 76390 7ff619bc3c90 116 API calls 76388->76390 76391 7ff619bc130a 76389->76391 76392 7ff619bc12d6 76390->76392 76393 7ff619bc132f 76391->76393 76394 7ff619bc130e 76391->76394 76392->76387 76395 7ff619bc12de 76392->76395 76400 7ff619bc1364 76393->76400 76401 7ff619bc1344 76393->76401 76510 7ff619bc24d0 59 API calls 2 library calls 76394->76510 76509 7ff619bc2770 59 API calls 2 library calls 76395->76509 76398 7ff619bc1325 76398->76144 76399 7ff619bc12ee 76399->76144 76403 7ff619bc137e 76400->76403 76405 7ff619bc1395 76400->76405 76511 7ff619bc24d0 59 API calls 2 library calls 76401->76511 76491 7ff619bc1050 76403->76491 76406 7ff619bc135f __std_exception_copy 76405->76406 76407 7ff619bcf518 _fread_nolock 53 API calls 76405->76407 76410 7ff619bc13de 76405->76410 76408 7ff619bc1421 76406->76408 76409 7ff619bcf1c8 74 API calls 76406->76409 76407->76405 76408->76144 76409->76408 76512 7ff619bc24d0 59 API calls 2 library calls 76410->76512 76412->76136 76413->76136 76414->76144 76415->76146 76416->76149 76417->76154 76418->76154 76419->76136 76420->76136 76421->76136 76423 7ff619bc1b30 49 API calls 76422->76423 76424 7ff619bc3d40 76423->76424 76424->76326 76426 7ff619bc3c2a 76425->76426 76427 7ff619bc7990 57 API calls 76426->76427 76428 7ff619bc3c52 76427->76428 76429 7ff619bcacc0 _wfindfirst32i64 8 API calls 76428->76429 76430 7ff619bc3c7a 76429->76430 76430->76322 76430->76341 76432 7ff619bc7990 57 API calls 76431->76432 76433 7ff619bc7127 LoadLibraryExW 76432->76433 76434 7ff619bc7144 __std_exception_copy 76433->76434 76434->76335 76435->76342 76436->76328 76437->76327 76438->76342 76439->76342 76448 7ff619bc4aba 76440->76448 76441 7ff619bc4c71 76442 7ff619bcacc0 _wfindfirst32i64 8 API calls 76441->76442 76443 7ff619bc4c90 76442->76443 76470 7ff619bc7b90 59 API calls __std_exception_copy 76443->76470 76446 7ff619bc4bd3 76446->76441 76474 7ff619bd94e4 76446->76474 76448->76441 76448->76446 76450 7ff619bc4ca9 76448->76450 76472 7ff619bd5480 47 API calls 76448->76472 76473 7ff619bc1780 59 API calls 76448->76473 76484 7ff619bc2770 59 API calls 2 library calls 76450->76484 76453 7ff619bc4bf6 76454 7ff619bd94e4 _fread_nolock 37 API calls 76453->76454 76455 7ff619bc4c08 76454->76455 76481 7ff619bd558c 39 API calls 3 library calls 76455->76481 76457 7ff619bc4c14 76482 7ff619bd5af4 73 API calls 76457->76482 76459 7ff619bc4c26 76483 7ff619bd5af4 73 API calls 76459->76483 76461 7ff619bc4c38 76462 7ff619bd4cc8 71 API calls 76461->76462 76463 7ff619bc4c49 76462->76463 76464 7ff619bd4cc8 71 API calls 76463->76464 76465 7ff619bc4c5d 76464->76465 76466 7ff619bd4cc8 71 API calls 76465->76466 76466->76441 76467->76345 76468->76353 76469->76364 76470->76369 76471->76357 76472->76448 76473->76448 76475 7ff619bc4bea 76474->76475 76476 7ff619bd94ed 76474->76476 76480 7ff619bd558c 39 API calls 3 library calls 76475->76480 76485 7ff619bd41f4 11 API calls _wfindfirst32i64 76476->76485 76478 7ff619bd94f2 76486 7ff619bda100 37 API calls _invalid_parameter_noinfo 76478->76486 76480->76453 76481->76457 76482->76459 76483->76461 76484->76441 76485->76478 76487->76376 76488->76374 76489->76374 76490->76384 76492 7ff619bc10a6 76491->76492 76493 7ff619bc10d3 76492->76493 76494 7ff619bc10ad 76492->76494 76497 7ff619bc1109 76493->76497 76498 7ff619bc10ed 76493->76498 76517 7ff619bc2770 59 API calls 2 library calls 76494->76517 76496 7ff619bc10c0 76496->76406 76500 7ff619bc111b 76497->76500 76504 7ff619bc1137 memcpy_s 76497->76504 76518 7ff619bc24d0 59 API calls 2 library calls 76498->76518 76519 7ff619bc24d0 59 API calls 2 library calls 76500->76519 76502 7ff619bcf518 _fread_nolock 53 API calls 76502->76504 76503 7ff619bc1104 __std_exception_copy 76503->76406 76504->76502 76504->76503 76507 7ff619bc11fe 76504->76507 76508 7ff619bcf28c 37 API calls 76504->76508 76513 7ff619bcfc24 76504->76513 76520 7ff619bc2770 59 API calls 2 library calls 76507->76520 76508->76504 76509->76399 76510->76398 76511->76406 76512->76406 76514 7ff619bcfc54 76513->76514 76521 7ff619bcf988 76514->76521 76516 7ff619bcfc72 76516->76504 76517->76496 76518->76503 76519->76503 76520->76503 76522 7ff619bcf9d5 76521->76522 76523 7ff619bcf9a8 76521->76523 76522->76516 76523->76522 76524 7ff619bcf9b2 76523->76524 76525 7ff619bcf9dd 76523->76525 76535 7ff619bda030 37 API calls 2 library calls 76524->76535 76528 7ff619bcf8c8 76525->76528 76536 7ff619bd409c EnterCriticalSection 76528->76536 76530 7ff619bcf8e5 76531 7ff619bcf908 74 API calls 76530->76531 76532 7ff619bcf8ee 76531->76532 76533 7ff619bd40a8 _fread_nolock LeaveCriticalSection 76532->76533 76534 7ff619bcf8f9 76533->76534 76534->76522 76535->76522 76538 7ff619bc29a6 76537->76538 76539 7ff619bc1b30 49 API calls 76538->76539 76541 7ff619bc29db 76539->76541 76540 7ff619bc2dc9 76541->76540 76542 7ff619bc3b00 49 API calls 76541->76542 76543 7ff619bc2a57 76542->76543 76594 7ff619bc2ff0 76543->76594 76546 7ff619bc2ae7 76602 7ff619bc66e0 98 API calls 76546->76602 76547 7ff619bc2ff0 75 API calls 76549 7ff619bc2ae3 76547->76549 76549->76546 76551 7ff619bc2b55 76549->76551 76550 7ff619bc2aef 76552 7ff619bc2b0c 76550->76552 76603 7ff619bc65c0 134 API calls 2 library calls 76550->76603 76553 7ff619bc2ff0 75 API calls 76551->76553 76558 7ff619bc2b26 76552->76558 76604 7ff619bc2770 59 API calls 2 library calls 76552->76604 76556 7ff619bc2b7e 76553->76556 76557 7ff619bc2bd8 76556->76557 76560 7ff619bc2ff0 75 API calls 76556->76560 76557->76552 76605 7ff619bc66e0 98 API calls 76557->76605 76561 7ff619bcacc0 _wfindfirst32i64 8 API calls 76558->76561 76562 7ff619bc2bab 76560->76562 76563 7ff619bc2b4a 76561->76563 76562->76557 76564 7ff619bc2ff0 75 API calls 76562->76564 76563->76162 76564->76557 76565 7ff619bc2be8 76565->76552 76566 7ff619bc1af0 59 API calls 76565->76566 76568 7ff619bc2d06 76565->76568 76567 7ff619bc2c3f 76566->76567 76567->76552 76569 7ff619bc1b30 49 API calls 76567->76569 76568->76552 76581 7ff619bc2d1e 76568->76581 76570 7ff619bc2c67 76569->76570 76571 7ff619bc2da2 76570->76571 76572 7ff619bc1b30 49 API calls 76570->76572 76611 7ff619bc2770 59 API calls 2 library calls 76571->76611 76574 7ff619bc2c94 76572->76574 76574->76571 76576 7ff619bc1b30 49 API calls 76574->76576 76577 7ff619bc2cc1 76576->76577 76577->76571 76580 7ff619bc2ccc 76577->76580 76582 7ff619bc17b0 121 API calls 76580->76582 76581->76558 76583 7ff619bc2d84 76581->76583 76607 7ff619bc1440 161 API calls 2 library calls 76581->76607 76608 7ff619bc1780 59 API calls 76581->76608 76584 7ff619bc2ce3 76582->76584 76609 7ff619bc2770 59 API calls 2 library calls 76583->76609 76584->76581 76586 7ff619bc2ce7 76584->76586 76606 7ff619bc24d0 59 API calls 2 library calls 76586->76606 76587 7ff619bc2d95 76610 7ff619bc1ab0 74 API calls __std_exception_copy 76587->76610 76590 7ff619bc2d01 76612 7ff619bc1ab0 74 API calls __std_exception_copy 76590->76612 76591->76162 76592->76165 76593->76162 76595 7ff619bc3024 76594->76595 76613 7ff619bd3994 76595->76613 76598 7ff619bc305b 76600 7ff619bcacc0 _wfindfirst32i64 8 API calls 76598->76600 76601 7ff619bc2a96 76600->76601 76601->76546 76601->76547 76602->76550 76603->76552 76604->76558 76605->76565 76606->76590 76607->76581 76608->76581 76609->76587 76610->76558 76611->76590 76612->76552 76616 7ff619bd39ee 76613->76616 76614 7ff619bd3a13 76648 7ff619bda030 37 API calls 2 library calls 76614->76648 76615 7ff619bd3a4f 76649 7ff619bd1ca0 49 API calls _invalid_parameter_noinfo 76615->76649 76616->76614 76616->76615 76619 7ff619bd3a3d 76621 7ff619bcacc0 _wfindfirst32i64 8 API calls 76619->76621 76620 7ff619bd3af8 76628 7ff619bd3b01 76620->76628 76629 7ff619bd3b2c 76620->76629 76624 7ff619bc304a 76621->76624 76622 7ff619bda168 __free_lconv_mon 11 API calls 76622->76619 76623 7ff619bd3ae6 76623->76620 76625 7ff619bd3b50 76623->76625 76623->76628 76623->76629 76624->76598 76631 7ff619bd4bbc 76624->76631 76626 7ff619bd3b5a 76625->76626 76625->76629 76630 7ff619bda168 __free_lconv_mon 11 API calls 76626->76630 76650 7ff619bda168 76628->76650 76629->76622 76630->76619 76632 7ff619bd4be5 76631->76632 76633 7ff619bd4bd9 76631->76633 76682 7ff619bd47cc 45 API calls __CxxCallCatchBlock 76632->76682 76657 7ff619bd4430 76633->76657 76636 7ff619bd4c0d 76638 7ff619bd4c1d 76636->76638 76683 7ff619bde370 5 API calls __crtLCMapStringW 76636->76683 76684 7ff619bd42b4 14 API calls 3 library calls 76638->76684 76640 7ff619bd4c75 76641 7ff619bd4c8d 76640->76641 76642 7ff619bd4c79 76640->76642 76644 7ff619bd4430 69 API calls 76641->76644 76643 7ff619bd4bde 76642->76643 76645 7ff619bda168 __free_lconv_mon 11 API calls 76642->76645 76643->76598 76646 7ff619bd4c99 76644->76646 76645->76643 76646->76643 76647 7ff619bda168 __free_lconv_mon 11 API calls 76646->76647 76647->76643 76648->76619 76649->76623 76651 7ff619bda19c 76650->76651 76652 7ff619bda16d RtlFreeHeap 76650->76652 76651->76619 76652->76651 76653 7ff619bda188 GetLastError 76652->76653 76654 7ff619bda195 __free_lconv_mon 76653->76654 76656 7ff619bd41f4 11 API calls _wfindfirst32i64 76654->76656 76656->76651 76658 7ff619bd444a 76657->76658 76659 7ff619bd4467 76657->76659 76685 7ff619bd41d4 11 API calls _wfindfirst32i64 76658->76685 76659->76658 76660 7ff619bd447a CreateFileW 76659->76660 76662 7ff619bd44e4 76660->76662 76663 7ff619bd44ae 76660->76663 76689 7ff619bd4aac 46 API calls 2 library calls 76662->76689 76688 7ff619bd4584 59 API calls 2 library calls 76663->76688 76664 7ff619bd444f 76686 7ff619bd41f4 11 API calls _wfindfirst32i64 76664->76686 76668 7ff619bd44bc 76671 7ff619bd44c3 CloseHandle 76668->76671 76672 7ff619bd44d9 CloseHandle 76668->76672 76669 7ff619bd44e9 76673 7ff619bd44ed 76669->76673 76674 7ff619bd4518 76669->76674 76670 7ff619bd4457 76687 7ff619bda100 37 API calls _invalid_parameter_noinfo 76670->76687 76676 7ff619bd4462 76671->76676 76672->76676 76690 7ff619bd4168 11 API calls 2 library calls 76673->76690 76691 7ff619bd4868 51 API calls 76674->76691 76676->76643 76679 7ff619bd4525 76692 7ff619bd49a4 21 API calls _fread_nolock 76679->76692 76681 7ff619bd44f7 76681->76676 76682->76636 76683->76638 76684->76640 76685->76664 76686->76670 76688->76668 76689->76669 76690->76681 76691->76679 76692->76681 76693->76173 76696 7ff619bd51ac 76695->76696 76697 7ff619bd51d2 76696->76697 76699 7ff619bd5205 76696->76699 76726 7ff619bd41f4 11 API calls _wfindfirst32i64 76697->76726 76701 7ff619bd520b 76699->76701 76702 7ff619bd5218 76699->76702 76700 7ff619bd51d7 76727 7ff619bda100 37 API calls _invalid_parameter_noinfo 76700->76727 76728 7ff619bd41f4 11 API calls _wfindfirst32i64 76701->76728 76714 7ff619bda448 76702->76714 76706 7ff619bc3ce9 76706->76184 76708 7ff619bd522c 76729 7ff619bd41f4 11 API calls _wfindfirst32i64 76708->76729 76709 7ff619bd5239 76721 7ff619bdf7d8 76709->76721 76712 7ff619bd524c 76730 7ff619bd40a8 LeaveCriticalSection 76712->76730 76731 7ff619bdfac8 EnterCriticalSection 76714->76731 76716 7ff619bda45f 76717 7ff619bda4bc 19 API calls 76716->76717 76718 7ff619bda46a 76717->76718 76719 7ff619bdfb28 _isindst LeaveCriticalSection 76718->76719 76720 7ff619bd5222 76719->76720 76720->76708 76720->76709 76732 7ff619bdf4d4 76721->76732 76724 7ff619bdf832 76724->76712 76726->76700 76728->76706 76729->76706 76737 7ff619bdf50f __vcrt_FlsAlloc 76732->76737 76734 7ff619bdf7ad 76751 7ff619bda100 37 API calls _invalid_parameter_noinfo 76734->76751 76736 7ff619bdf6df 76736->76724 76744 7ff619be6078 76736->76744 76737->76737 76742 7ff619bdf6d6 76737->76742 76747 7ff619be5398 51 API calls 3 library calls 76737->76747 76739 7ff619bdf741 76739->76742 76748 7ff619be5398 51 API calls 3 library calls 76739->76748 76741 7ff619bdf760 76741->76742 76749 7ff619be5398 51 API calls 3 library calls 76741->76749 76742->76736 76750 7ff619bd41f4 11 API calls _wfindfirst32i64 76742->76750 76752 7ff619be567c 76744->76752 76747->76739 76748->76741 76749->76742 76750->76734 76753 7ff619be5693 76752->76753 76754 7ff619be56b1 76752->76754 76806 7ff619bd41f4 11 API calls _wfindfirst32i64 76753->76806 76754->76753 76757 7ff619be56cd 76754->76757 76756 7ff619be5698 76807 7ff619bda100 37 API calls _invalid_parameter_noinfo 76756->76807 76763 7ff619be5c88 76757->76763 76760 7ff619be56a4 76760->76724 76809 7ff619be59b8 76763->76809 76766 7ff619be5d15 76829 7ff619bd6a8c 76766->76829 76767 7ff619be5cfd 76841 7ff619bd41d4 11 API calls _wfindfirst32i64 76767->76841 76785 7ff619be5d02 76842 7ff619bd41f4 11 API calls _wfindfirst32i64 76785->76842 76799 7ff619be56f8 76799->76760 76808 7ff619bd6a64 LeaveCriticalSection 76799->76808 76806->76756 76810 7ff619be59e4 76809->76810 76812 7ff619be59fe 76809->76812 76810->76812 76854 7ff619bd41f4 11 API calls _wfindfirst32i64 76810->76854 76816 7ff619be5a7e 76812->76816 76856 7ff619bd41f4 11 API calls _wfindfirst32i64 76812->76856 76813 7ff619be59f3 76855 7ff619bda100 37 API calls _invalid_parameter_noinfo 76813->76855 76815 7ff619be5ad2 76828 7ff619be5b2e 76815->76828 76860 7ff619bd551c 37 API calls 2 library calls 76815->76860 76816->76815 76858 7ff619bd41f4 11 API calls _wfindfirst32i64 76816->76858 76819 7ff619be5ac7 76859 7ff619bda100 37 API calls _invalid_parameter_noinfo 76819->76859 76821 7ff619be5b2a 76822 7ff619be5bac 76821->76822 76821->76828 76861 7ff619bda120 17 API calls _wfindfirst32i64 76822->76861 76824 7ff619be5a73 76857 7ff619bda100 37 API calls _invalid_parameter_noinfo 76824->76857 76828->76766 76828->76767 76862 7ff619bdfac8 EnterCriticalSection 76829->76862 76841->76785 76842->76799 76854->76813 76856->76824 76858->76819 76860->76821 76864 7ff619bd7cc4 76863->76864 76867 7ff619bd77a8 76864->76867 76866 7ff619bd7cdd 76866->76192 76868 7ff619bd77f2 76867->76868 76869 7ff619bd77c3 76867->76869 76877 7ff619bd409c EnterCriticalSection 76868->76877 76878 7ff619bda030 37 API calls 2 library calls 76869->76878 76872 7ff619bd77e3 76872->76866 76873 7ff619bd77f7 76874 7ff619bd7814 38 API calls 76873->76874 76875 7ff619bd7803 76874->76875 76876 7ff619bd40a8 _fread_nolock LeaveCriticalSection 76875->76876 76876->76872 76878->76872 76880 7ff619bcefc3 76879->76880 76881 7ff619bceff1 76879->76881 76890 7ff619bda030 37 API calls 2 library calls 76880->76890 76884 7ff619bcefe3 76881->76884 76889 7ff619bd409c EnterCriticalSection 76881->76889 76884->76198 76885 7ff619bcf007 76886 7ff619bcf024 72 API calls 76885->76886 76887 7ff619bcf013 76886->76887 76888 7ff619bd40a8 _fread_nolock LeaveCriticalSection 76887->76888 76888->76884 76890->76884 76891 7ffdfae9f280 76892 7ffdfae9f303 76891->76892 76894 7ffdfae9f2b0 76891->76894 76893 7ffdfae9f325 76892->76893 76892->76894 76896 7ffdfae9f2c8 76893->76896 76899 7ffdfae9f32a 76893->76899 76903 7ffdfae286b0 IsProcessorFeaturePresent RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind 76894->76903 76904 7ffdfae286b0 IsProcessorFeaturePresent RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind 76896->76904 76898 7ffdfae9f2f2 76900 7ffdfae9ed10 46 API calls 76899->76900 76901 7ffdfae9f3df 76899->76901 76905 7ffdfae7c550 00007FFE1A4519C0 IsProcessorFeaturePresent RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind 76899->76905 76900->76899 76903->76896 76904->76898 76905->76899

                                                                                                                                                                                                                                              Executed Functions

                                                                                                                                                                                                                                              Function 00007FF619BDB28C Relevance: 10.8, APIs: 7, Instructions: 286COMMONLIBRARYCODE
                                                                                                                                                                                                                                              Download Yara Rule

                                                                                                                                                                                                                                              Control-flow Graph

                                                                                                                                                                                                                                              • Executed
                                                                                                                                                                                                                                              • Not Executed
                                                                                                                                                                                                                                              control_flow_graph 646 7ff619bdb28c-7ff619bdb2ad 647 7ff619bdb2af-7ff619bdb2c2 call 7ff619bd41d4 call 7ff619bd41f4 646->647 648 7ff619bdb2c7-7ff619bdb2c9 646->648 662 7ff619bdb6c3 647->662 649 7ff619bdb2cf-7ff619bdb2d6 648->649 650 7ff619bdb6ab-7ff619bdb6b8 call 7ff619bd41d4 call 7ff619bd41f4 648->650 649->650 652 7ff619bdb2dc-7ff619bdb310 649->652 669 7ff619bdb6be call 7ff619bda100 650->669 652->650 655 7ff619bdb316-7ff619bdb31d 652->655 659 7ff619bdb31f-7ff619bdb332 call 7ff619bd41d4 call 7ff619bd41f4 655->659 660 7ff619bdb337-7ff619bdb33a 655->660 659->669 665 7ff619bdb340-7ff619bdb342 660->665 666 7ff619bdb6a7-7ff619bdb6a9 660->666 667 7ff619bdb6c6-7ff619bdb6d5 662->667 665->666 670 7ff619bdb348-7ff619bdb34b 665->670 666->667 669->662 670->659 673 7ff619bdb34d-7ff619bdb371 670->673 675 7ff619bdb373-7ff619bdb376 673->675 676 7ff619bdb3a6-7ff619bdb3ae 673->676 679 7ff619bdb39e-7ff619bdb3a4 675->679 680 7ff619bdb378-7ff619bdb380 675->680 677 7ff619bdb382-7ff619bdb399 call 7ff619bd41d4 call 7ff619bd41f4 call 7ff619bda100 676->677 678 7ff619bdb3b0-7ff619bdb3be call 7ff619bdce50 676->678 710 7ff619bdb535 677->710 687 7ff619bdb3c3-7ff619bdb3da call 7ff619bda168 * 2 678->687 682 7ff619bdb425-7ff619bdb436 679->682 680->677 680->679 685 7ff619bdb4bd-7ff619bdb4c7 call 7ff619be2a30 682->685 686 7ff619bdb43c-7ff619bdb444 682->686 697 7ff619bdb553 685->697 698 7ff619bdb4cd-7ff619bdb4e3 685->698 686->685 690 7ff619bdb446-7ff619bdb448 686->690 706 7ff619bdb3dc-7ff619bdb3f2 call 7ff619bd41f4 call 7ff619bd41d4 687->706 707 7ff619bdb3f7-7ff619bdb421 call 7ff619bdbabc 687->707 690->685 694 7ff619bdb44a-7ff619bdb468 690->694 694->685 699 7ff619bdb46a-7ff619bdb476 694->699 701 7ff619bdb558-7ff619bdb579 ReadFile 697->701 698->697 703 7ff619bdb4e5-7ff619bdb4f7 GetConsoleMode 698->703 699->685 704 7ff619bdb478-7ff619bdb47a 699->704 708 7ff619bdb57f-7ff619bdb587 701->708 709 7ff619bdb671-7ff619bdb67a GetLastError 701->709 703->697 711 7ff619bdb4f9-7ff619bdb501 703->711 704->685 712 7ff619bdb47c-7ff619bdb494 704->712 706->710 707->682 708->709 714 7ff619bdb58d 708->714 717 7ff619bdb67c-7ff619bdb692 call 7ff619bd41f4 call 7ff619bd41d4 709->717 718 7ff619bdb697-7ff619bdb69a 709->718 719 7ff619bdb538-7ff619bdb542 call 7ff619bda168 710->719 711->701 716 7ff619bdb503-7ff619bdb526 ReadConsoleW 711->716 712->685 720 7ff619bdb496-7ff619bdb4a2 712->720 725 7ff619bdb594-7ff619bdb5ab 714->725 727 7ff619bdb547-7ff619bdb551 716->727 728 7ff619bdb528 GetLastError 716->728 717->710 722 7ff619bdb52e-7ff619bdb530 call 7ff619bd4168 718->722 723 7ff619bdb6a0-7ff619bdb6a2 718->723 719->667 720->685 721 7ff619bdb4a4-7ff619bdb4a6 720->721 721->685 731 7ff619bdb4a8-7ff619bdb4b8 721->731 722->710 723->719 725->719 733 7ff619bdb5ad-7ff619bdb5b8 725->733 727->725 728->722 731->685 738 7ff619bdb5df-7ff619bdb5e7 733->738 739 7ff619bdb5ba-7ff619bdb5d3 call 7ff619bdae9c 733->739 742 7ff619bdb65f-7ff619bdb66c call 7ff619bdacc4 738->742 743 7ff619bdb5e9-7ff619bdb5fb 738->743 746 7ff619bdb5d8-7ff619bdb5da 739->746 742->746 747 7ff619bdb652-7ff619bdb65a 743->747 748 7ff619bdb5fd 743->748 746->719 747->719 750 7ff619bdb603-7ff619bdb60a 748->750 751 7ff619bdb60c-7ff619bdb610 750->751 752 7ff619bdb647-7ff619bdb64c 750->752 753 7ff619bdb612-7ff619bdb619 751->753 754 7ff619bdb62d 751->754 752->747 753->754 755 7ff619bdb61b-7ff619bdb61f 753->755 756 7ff619bdb633-7ff619bdb643 754->756 755->754 757 7ff619bdb621-7ff619bdb62b 755->757 756->750 758 7ff619bdb645 756->758 757->756 758->747
                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 00000001.00000002.1895497148.00007FF619BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF619BC0000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 00000001.00000002.1895473888.00007FF619BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000001.00000002.1895544098.00007FF619BEA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000001.00000002.1895573832.00007FF619BFD000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000001.00000002.1895573832.00007FF619C00000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000001.00000002.1895573832.00007FF619C0C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000001.00000002.1895651091.00007FF619C0E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_1_2_7ff619bc0000_NEVER OPEN!.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: _invalid_parameter_noinfo
                                                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                                                              • API String ID: 3215553584-0
                                                                                                                                                                                                                                              • Opcode ID: 22d1731cf412099a23e1ead51438d500d5773651b0eacba01d8040f2528079e5
                                                                                                                                                                                                                                              • Instruction ID: 34e8390eae6af35a6c6dd7222e12f717ec27c2145903f913767c9f4b5584750c
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 22d1731cf412099a23e1ead51438d500d5773651b0eacba01d8040f2528079e5
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: ABC19C62A0CEAA95EB709F1594503BF6AE1EB82FACF444135DA4E87791CF7CE4548700
                                                                                                                                                                                                                                              Function 00007FFDFAE9ED10 Relevance: 7.4, APIs: 1, Strings: 3, Instructions: 358COMMON
                                                                                                                                                                                                                                              Download Yara Rule

                                                                                                                                                                                                                                              Control-flow Graph

                                                                                                                                                                                                                                              • Executed
                                                                                                                                                                                                                                              • Not Executed
                                                                                                                                                                                                                                              control_flow_graph 1244 7ffdfae9ed10-7ffdfae9ede1 00007FFE1A4519C0 1245 7ffdfae9edf4-7ffdfae9edfa 1244->1245 1246 7ffdfae9ede3-7ffdfae9edef call 7ffdfae29310 1244->1246 1248 7ffdfae9edfc-7ffdfae9ee06 1245->1248 1249 7ffdfae9ee0d-7ffdfae9ee1c 1245->1249 1246->1245 1248->1249 1250 7ffdfae9eef2-7ffdfae9eefd call 7ffdfaeb6d40 1249->1250 1251 7ffdfae9ee22-7ffdfae9ee28 1249->1251 1259 7ffdfae9efa4-7ffdfae9efac call 7ffdfaed7890 1250->1259 1260 7ffdfae9ef03-7ffdfae9ef06 1250->1260 1253 7ffdfae9ee2e 1251->1253 1254 7ffdfae9eeed 1251->1254 1255 7ffdfae9ee31-7ffdfae9ee3d 1253->1255 1254->1250 1257 7ffdfae9eeaf-7ffdfae9eeba 1255->1257 1258 7ffdfae9ee3f-7ffdfae9ee43 1255->1258 1264 7ffdfae9eee8 1257->1264 1265 7ffdfae9eebc-7ffdfae9eebe 1257->1265 1261 7ffdfae9ee45-7ffdfae9ee4c 1258->1261 1262 7ffdfae9ee58-7ffdfae9ee60 1258->1262 1271 7ffdfae9efb1-7ffdfae9efb4 1259->1271 1266 7ffdfae9ef08-7ffdfae9ef0e 1260->1266 1267 7ffdfae9ef14-7ffdfae9ef1b 1260->1267 1261->1262 1270 7ffdfae9ee4e-7ffdfae9ee56 call 7ffdfae3dc00 1261->1270 1262->1257 1272 7ffdfae9ee62-7ffdfae9ee69 1262->1272 1264->1254 1265->1255 1266->1259 1266->1267 1268 7ffdfae9ef45-7ffdfae9ef48 1267->1268 1269 7ffdfae9ef1d-7ffdfae9ef40 call 7ffdfae291f0 call 7ffdfae25ec0 1267->1269 1277 7ffdfae9ef97-7ffdfae9efa2 1268->1277 1278 7ffdfae9ef4a-7ffdfae9ef5c call 7ffdfae25a20 1268->1278 1309 7ffdfae9f24c-7ffdfae9f27a call 7ffdfae9ea50 call 7ffdfaf46490 1269->1309 1270->1262 1275 7ffdfae9efb6-7ffdfae9efbd 1271->1275 1276 7ffdfae9efc0-7ffdfae9efcc 1271->1276 1279 7ffdfae9ee78-7ffdfae9ee7f 1272->1279 1280 7ffdfae9ee6b-7ffdfae9ee6f 1272->1280 1275->1276 1283 7ffdfae9efce-7ffdfae9efda 1276->1283 1284 7ffdfae9f031-7ffdfae9f035 1276->1284 1277->1271 1278->1277 1305 7ffdfae9ef5e-7ffdfae9ef95 call 7ffdfaf47444 call 7ffdfaed7890 call 7ffdfae25600 1278->1305 1287 7ffdfae9ee9b 1279->1287 1288 7ffdfae9ee81-7ffdfae9ee84 1279->1288 1280->1279 1286 7ffdfae9ee71-7ffdfae9ee76 1280->1286 1283->1284 1293 7ffdfae9efdc-7ffdfae9efe6 1283->1293 1291 7ffdfae9f037-7ffdfae9f044 1284->1291 1292 7ffdfae9f049-7ffdfae9f04f 1284->1292 1289 7ffdfae9ee9d-7ffdfae9eea1 1286->1289 1287->1289 1295 7ffdfae9ee86-7ffdfae9ee8a 1288->1295 1296 7ffdfae9ee92-7ffdfae9ee99 1288->1296 1297 7ffdfae9eeab-7ffdfae9eead 1289->1297 1298 7ffdfae9eea3-7ffdfae9eea6 call 7ffdfae3dbd0 1289->1298 1300 7ffdfae9f166-7ffdfae9f169 1291->1300 1301 7ffdfae9f055-7ffdfae9f058 1292->1301 1302 7ffdfae9f1e3-7ffdfae9f201 1292->1302 1303 7ffdfae9efe8 1293->1303 1304 7ffdfae9eff2-7ffdfae9eff8 1293->1304 1295->1296 1306 7ffdfae9ee8c-7ffdfae9ee90 1295->1306 1296->1287 1296->1288 1297->1257 1308 7ffdfae9eec3-7ffdfae9eee3 call 7ffdfae291f0 1297->1308 1298->1297 1311 7ffdfae9f16b-7ffdfae9f172 1300->1311 1312 7ffdfae9f184-7ffdfae9f190 1300->1312 1301->1302 1310 7ffdfae9f05e-7ffdfae9f063 1301->1310 1313 7ffdfae9f221-7ffdfae9f228 1302->1313 1314 7ffdfae9f203-7ffdfae9f20c 1302->1314 1303->1304 1315 7ffdfae9effa-7ffdfae9f00c call 7ffdfae25a20 1304->1315 1316 7ffdfae9f023 1304->1316 1305->1271 1306->1286 1306->1296 1308->1309 1310->1300 1322 7ffdfae9f069-7ffdfae9f070 1310->1322 1323 7ffdfae9f17c-7ffdfae9f17f call 7ffdfae529a0 1311->1323 1324 7ffdfae9f174-7ffdfae9f177 call 7ffdfae52830 1311->1324 1329 7ffdfae9f1b7-7ffdfae9f1c0 1312->1329 1330 7ffdfae9f192-7ffdfae9f1ab call 7ffdfae291f0 1312->1330 1313->1309 1318 7ffdfae9f22a 1313->1318 1325 7ffdfae9f218-7ffdfae9f21d 1314->1325 1326 7ffdfae9f20e-7ffdfae9f216 call 7ffdfae4d7a0 1314->1326 1319 7ffdfae9f025-7ffdfae9f02c 1315->1319 1350 7ffdfae9f00e-7ffdfae9f021 call 7ffdfaf47444 1315->1350 1316->1319 1336 7ffdfae9f230-7ffdfae9f24a call 7ffdfae25600 1318->1336 1319->1284 1322->1300 1338 7ffdfae9f076-7ffdfae9f082 1322->1338 1323->1312 1324->1323 1325->1313 1326->1313 1331 7ffdfae9f1d5-7ffdfae9f1e1 call 7ffdfae29110 1329->1331 1332 7ffdfae9f1c2-7ffdfae9f1ca 1329->1332 1330->1313 1352 7ffdfae9f1ad-7ffdfae9f1b5 call 7ffdfae25600 1330->1352 1331->1313 1332->1331 1345 7ffdfae9f1cc-7ffdfae9f1d3 1332->1345 1336->1309 1338->1300 1348 7ffdfae9f088-7ffdfae9f08b 1338->1348 1345->1313 1357 7ffdfae9f090-7ffdfae9f09f 1348->1357 1350->1319 1352->1313 1362 7ffdfae9f0a5-7ffdfae9f0a9 1357->1362 1363 7ffdfae9f150-7ffdfae9f15b 1357->1363 1366 7ffdfae9f0ab-7ffdfae9f0be call 7ffdfae41510 1362->1366 1367 7ffdfae9f0e4-7ffdfae9f0ec 1362->1367 1363->1357 1365 7ffdfae9f161 1363->1365 1365->1300 1375 7ffdfae9f0c7-7ffdfae9f0cf call 7ffdfae25de0 1366->1375 1376 7ffdfae9f0c0-7ffdfae9f0c5 1366->1376 1368 7ffdfae9f0ee-7ffdfae9f0f5 1367->1368 1369 7ffdfae9f0ff-7ffdfae9f112 1367->1369 1368->1369 1371 7ffdfae9f0f7-7ffdfae9f0fa call 7ffdfae3dc00 1368->1371 1372 7ffdfae9f122-7ffdfae9f12e 1369->1372 1373 7ffdfae9f114-7ffdfae9f118 1369->1373 1371->1369 1379 7ffdfae9f130-7ffdfae9f13b call 7ffdfae7c550 1372->1379 1380 7ffdfae9f143-7ffdfae9f146 1372->1380 1373->1372 1378 7ffdfae9f11a-7ffdfae9f11d call 7ffdfae3dbd0 1373->1378 1381 7ffdfae9f0d7-7ffdfae9f0da 1375->1381 1376->1375 1376->1381 1378->1372 1379->1380 1380->1363 1385 7ffdfae9f148-7ffdfae9f14b call 7ffdfae42850 1380->1385 1381->1365 1389 7ffdfae9f0e0 1381->1389 1385->1363 1389->1367
                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 00000001.00000002.1896332214.00007FFDFAE21000.00000040.00000001.01000000.0000001E.sdmp, Offset: 00007FFDFAE20000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 00000001.00000002.1896301415.00007FFDFAE20000.00000002.00000001.01000000.0000001E.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000001.00000002.1896332214.00007FFDFAF73000.00000040.00000001.01000000.0000001E.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000001.00000002.1896332214.00007FFDFAF75000.00000040.00000001.01000000.0000001E.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000001.00000002.1896332214.00007FFDFAF8A000.00000040.00000001.01000000.0000001E.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000001.00000002.1896536596.00007FFDFAF8C000.00000080.00000001.01000000.0000001E.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000001.00000002.1896632509.00007FFDFAF8E000.00000004.00000001.01000000.0000001E.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_1_2_7ffdfae20000_NEVER OPEN!.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: 00007A4519
                                                                                                                                                                                                                                              • String ID: database schema is locked: %s$out of memory$statement too long
                                                                                                                                                                                                                                              • API String ID: 817585512-1046679716
                                                                                                                                                                                                                                              • Opcode ID: ffd349dea8819c43c891fa3c0915b0aaa672d1a411e2712ca41d878cb690906a
                                                                                                                                                                                                                                              • Instruction ID: a8f3b99223e4e7703828a7f44b624dea7b1e3be6d16d480f92ba9254d41c543c
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: ffd349dea8819c43c891fa3c0915b0aaa672d1a411e2712ca41d878cb690906a
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 5FF16422B0878285FB28AF259464BBA67A0FF49748F044175DEAE077D9DF7EE5418310
                                                                                                                                                                                                                                              Function 00007FFDFAE0F920 Relevance: 6.9, APIs: 4, Instructions: 894librarymemoryloaderCOMMON
                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 00000001.00000002.1896236951.00007FFDFAE0F000.00000080.00000001.01000000.0000003D.sdmp, Offset: 00007FFDFABC0000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 00000001.00000002.1895680667.00007FFDFABC0000.00000002.00000001.01000000.0000003D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000001.00000002.1895708568.00007FFDFABC1000.00000040.00000001.01000000.0000003D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000001.00000002.1895708568.00007FFDFAD69000.00000040.00000001.01000000.0000003D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000001.00000002.1895708568.00007FFDFAD79000.00000040.00000001.01000000.0000003D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000001.00000002.1895708568.00007FFDFAD82000.00000040.00000001.01000000.0000003D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000001.00000002.1895708568.00007FFDFAD92000.00000040.00000001.01000000.0000003D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000001.00000002.1895708568.00007FFDFADCD000.00000040.00000001.01000000.0000003D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000001.00000002.1895708568.00007FFDFADF1000.00000040.00000001.01000000.0000003D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000001.00000002.1895708568.00007FFDFADF9000.00000040.00000001.01000000.0000003D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000001.00000002.1895708568.00007FFDFAE0D000.00000040.00000001.01000000.0000003D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000001.00000002.1896269578.00007FFDFAE11000.00000004.00000001.01000000.0000003D.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_1_2_7ffdfabc0000_NEVER OPEN!.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: ProtectVirtual$AddressLibraryLoadProc
                                                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                                                              • API String ID: 3300690313-0
                                                                                                                                                                                                                                              • Opcode ID: 2bf6b3f272edacfbcbda0df58fc887f6adbacf2aa0d5a0646a567f2f7c189ee1
                                                                                                                                                                                                                                              • Instruction ID: fc1567b29f325c256ee00bbc46730f8aaae0fab55e4fde7a42aef24f09cfbaf1
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 2bf6b3f272edacfbcbda0df58fc887f6adbacf2aa0d5a0646a567f2f7c189ee1
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 6E62152272C1A286E71D9E38D4506BC77A1E708785F185536EEAFD37C8EA3DEA45C700
                                                                                                                                                                                                                                              Function 00007FFDFB413230 Relevance: 6.8, APIs: 4, Instructions: 848librarymemoryloaderCOMMON
                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 00000001.00000002.1898476615.00007FFDFB413000.00000080.00000001.01000000.00000018.sdmp, Offset: 00007FFDFB0C0000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 00000001.00000002.1897529155.00007FFDFB0C0000.00000002.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000001.00000002.1897592652.00007FFDFB0C1000.00000040.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000001.00000002.1897592652.00007FFDFB0CD000.00000040.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000001.00000002.1897592652.00007FFDFB125000.00000040.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000001.00000002.1897592652.00007FFDFB139000.00000040.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000001.00000002.1897592652.00007FFDFB149000.00000040.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000001.00000002.1897592652.00007FFDFB15D000.00000040.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000001.00000002.1897592652.00007FFDFB30C000.00000040.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000001.00000002.1897592652.00007FFDFB30E000.00000040.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000001.00000002.1897592652.00007FFDFB339000.00000040.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000001.00000002.1897592652.00007FFDFB36A000.00000040.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000001.00000002.1897592652.00007FFDFB390000.00000040.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000001.00000002.1897592652.00007FFDFB3DE000.00000040.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000001.00000002.1897592652.00007FFDFB3E4000.00000040.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000001.00000002.1897592652.00007FFDFB3E6000.00000040.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000001.00000002.1897592652.00007FFDFB402000.00000040.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000001.00000002.1897592652.00007FFDFB40F000.00000040.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000001.00000002.1898503424.00007FFDFB414000.00000004.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_1_2_7ffdfb0c0000_NEVER OPEN!.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: ProtectVirtual$AddressLibraryLoadProc
                                                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                                                              • API String ID: 3300690313-0
                                                                                                                                                                                                                                              • Opcode ID: aec70106c9885d01e9cbe863bed1cea0d376cefded8bd2f4e52220915c2b8235
                                                                                                                                                                                                                                              • Instruction ID: 18f69a6edf43acf49588daf454aa05499513b65e6b1aa5580451afc1d0bdb4ed
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: aec70106c9885d01e9cbe863bed1cea0d376cefded8bd2f4e52220915c2b8235
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: A1623862B29192A6E71ACF38D55067C77A0E704789F146135EEAFD37D8EA3CEA44C700
                                                                                                                                                                                                                                              Function 00007FFDFAE3FF20 Relevance: 4.1, APIs: 1, Strings: 1, Instructions: 590COMMON
                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 00000001.00000002.1896332214.00007FFDFAE21000.00000040.00000001.01000000.0000001E.sdmp, Offset: 00007FFDFAE20000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 00000001.00000002.1896301415.00007FFDFAE20000.00000002.00000001.01000000.0000001E.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000001.00000002.1896332214.00007FFDFAF73000.00000040.00000001.01000000.0000001E.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000001.00000002.1896332214.00007FFDFAF75000.00000040.00000001.01000000.0000001E.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000001.00000002.1896332214.00007FFDFAF8A000.00000040.00000001.01000000.0000001E.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000001.00000002.1896536596.00007FFDFAF8C000.00000080.00000001.01000000.0000001E.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000001.00000002.1896632509.00007FFDFAF8E000.00000004.00000001.01000000.0000001E.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_1_2_7ffdfae20000_NEVER OPEN!.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: 00007B5630
                                                                                                                                                                                                                                              • String ID: :memory:
                                                                                                                                                                                                                                              • API String ID: 2248877218-2920599690
                                                                                                                                                                                                                                              • Opcode ID: 143b806c0c83d26fe958636cc3ff90d9e8b65579401ef3cfe2339439d0e5ea09
                                                                                                                                                                                                                                              • Instruction ID: d99a7a5b90ce17dfb0418469be4d242f776e48f10c24da173350bf30563677b5
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 143b806c0c83d26fe958636cc3ff90d9e8b65579401ef3cfe2339439d0e5ea09
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 6242A026B0978382EB68AB25A460B7927A4FF85B54F0402B5DE6F077D8DF3DE590C700
                                                                                                                                                                                                                                              Function 00007FFDFAE2F820 Relevance: 1.7, APIs: 1, Instructions: 213COMMON
                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                              • GetSystemInfo.KERNEL32(?,?,?,?,00007FFDFAED890C,?,?,?,?,00007FFDFAE285DD,?,?,?,?,00007FFDFAE54567), ref: 00007FFDFAE2F848
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 00000001.00000002.1896332214.00007FFDFAE21000.00000040.00000001.01000000.0000001E.sdmp, Offset: 00007FFDFAE20000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 00000001.00000002.1896301415.00007FFDFAE20000.00000002.00000001.01000000.0000001E.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000001.00000002.1896332214.00007FFDFAF73000.00000040.00000001.01000000.0000001E.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000001.00000002.1896332214.00007FFDFAF75000.00000040.00000001.01000000.0000001E.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000001.00000002.1896332214.00007FFDFAF8A000.00000040.00000001.01000000.0000001E.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000001.00000002.1896536596.00007FFDFAF8C000.00000080.00000001.01000000.0000001E.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000001.00000002.1896632509.00007FFDFAF8E000.00000004.00000001.01000000.0000001E.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_1_2_7ffdfae20000_NEVER OPEN!.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: InfoSystem
                                                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                                                              • API String ID: 31276548-0
                                                                                                                                                                                                                                              • Opcode ID: 75f1db212b269ba8466c8530d3d4b3f45e34fba6d528fb4c6e7acba09ac25192
                                                                                                                                                                                                                                              • Instruction ID: 0ecbaccf9d7be0648aee95b38ba175afb51a6387ae52de42177b36cb5b77f185
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 75f1db212b269ba8466c8530d3d4b3f45e34fba6d528fb4c6e7acba09ac25192
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 47A10664F09B0381FF9CAB55B870AB422E4BF44B54F5406B5DD2F0A3E8DF6EE8658250
                                                                                                                                                                                                                                              Function 00007FF619BC17B0 Relevance: 21.1, APIs: 2, Strings: 10, Instructions: 144COMMON
                                                                                                                                                                                                                                              Download Yara Rule

                                                                                                                                                                                                                                              Control-flow Graph

                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 00000001.00000002.1895497148.00007FF619BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF619BC0000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 00000001.00000002.1895473888.00007FF619BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000001.00000002.1895544098.00007FF619BEA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000001.00000002.1895573832.00007FF619BFD000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000001.00000002.1895573832.00007FF619C00000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000001.00000002.1895573832.00007FF619C0C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000001.00000002.1895651091.00007FF619C0E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_1_2_7ff619bc0000_NEVER OPEN!.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: _fread_nolock$Message_invalid_parameter_noinfo
                                                                                                                                                                                                                                              • String ID: Cannot read Table of Contents.$Could not allocate buffer for TOC!$Could not read full TOC!$Error on file.$Failed to read cookie!$Failed to seek to cookie position!$MEI$fread$fseek$malloc
                                                                                                                                                                                                                                              • API String ID: 2153230061-4158440160
                                                                                                                                                                                                                                              • Opcode ID: e774a889fe255f9532b466abc373ce7953e19be8f2e2373b257992636ef6268c
                                                                                                                                                                                                                                              • Instruction ID: cbd21400f8b79d03137b53b682e729b8261fa20175850ca3b05d16cd7f06b040
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: e774a889fe255f9532b466abc373ce7953e19be8f2e2373b257992636ef6268c
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 6A513872A09E0A86EB64CF29D49427A33A4FB4AF6CB518136DA0DD7399DF7CE441C740
                                                                                                                                                                                                                                              Function 00007FF619BC12B0 Relevance: 14.1, APIs: 1, Strings: 7, Instructions: 106COMMON
                                                                                                                                                                                                                                              Download Yara Rule

                                                                                                                                                                                                                                              Control-flow Graph

                                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 00000001.00000002.1895497148.00007FF619BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF619BC0000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 00000001.00000002.1895473888.00007FF619BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000001.00000002.1895544098.00007FF619BEA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000001.00000002.1895573832.00007FF619BFD000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000001.00000002.1895573832.00007FF619C00000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000001.00000002.1895573832.00007FF619C0C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000001.00000002.1895651091.00007FF619C0E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_1_2_7ff619bc0000_NEVER OPEN!.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: Message
                                                                                                                                                                                                                                              • String ID: Failed to extract %s: failed to allocate data buffer (%u bytes)!$Failed to extract %s: failed to open archive file!$Failed to extract %s: failed to read data chunk!$Failed to extract %s: failed to seek to the entry's data!$fread$fseek$malloc
                                                                                                                                                                                                                                              • API String ID: 2030045667-3659356012
                                                                                                                                                                                                                                              • Opcode ID: 041dcb5eba2c2f8543da0cffedf4572d65ed085ab0adf99581d0c687122e9da9
                                                                                                                                                                                                                                              • Instruction ID: d1e8ede81bca9f67c5701be9a229380ddc0e8ce4ed3ffc0420fce541a2a3de5e
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 041dcb5eba2c2f8543da0cffedf4572d65ed085ab0adf99581d0c687122e9da9
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: C9416061A08E4A92EA34DF12E4402AB63A4FF46FACF844436DE4D97B55EE3CE542C700
                                                                                                                                                                                                                                              Function 00007FF619BE5C88 Relevance: 13.8, APIs: 9, Instructions: 276fileCOMMON
                                                                                                                                                                                                                                              Download Yara Rule

                                                                                                                                                                                                                                              Control-flow Graph

                                                                                                                                                                                                                                              • Executed
                                                                                                                                                                                                                                              • Not Executed
                                                                                                                                                                                                                                              control_flow_graph 237 7ff619be5c88-7ff619be5cfb call 7ff619be59b8 240 7ff619be5d15-7ff619be5d1f call 7ff619bd6a8c 237->240 241 7ff619be5cfd-7ff619be5d06 call 7ff619bd41d4 237->241 246 7ff619be5d21-7ff619be5d38 call 7ff619bd41d4 call 7ff619bd41f4 240->246 247 7ff619be5d3a-7ff619be5da3 CreateFileW 240->247 248 7ff619be5d09-7ff619be5d10 call 7ff619bd41f4 241->248 246->248 250 7ff619be5da5-7ff619be5dab 247->250 251 7ff619be5e20-7ff619be5e2b GetFileType 247->251 259 7ff619be6057-7ff619be6077 248->259 256 7ff619be5ded-7ff619be5e1b GetLastError call 7ff619bd4168 250->256 257 7ff619be5dad-7ff619be5db1 250->257 253 7ff619be5e7e-7ff619be5e85 251->253 254 7ff619be5e2d-7ff619be5e68 GetLastError call 7ff619bd4168 CloseHandle 251->254 262 7ff619be5e8d-7ff619be5e90 253->262 263 7ff619be5e87-7ff619be5e8b 253->263 254->248 271 7ff619be5e6e-7ff619be5e79 call 7ff619bd41f4 254->271 256->248 257->256 264 7ff619be5db3-7ff619be5deb CreateFileW 257->264 268 7ff619be5e96-7ff619be5eeb call 7ff619bd69a4 262->268 269 7ff619be5e92 262->269 263->268 264->251 264->256 276 7ff619be5f0a-7ff619be5f3b call 7ff619be5740 268->276 277 7ff619be5eed-7ff619be5ef9 call 7ff619be5bc4 268->277 269->268 271->248 283 7ff619be5f41-7ff619be5f84 276->283 284 7ff619be5f3d-7ff619be5f3f 276->284 277->276 282 7ff619be5efb 277->282 285 7ff619be5efd-7ff619be5f05 call 7ff619bda2e0 282->285 286 7ff619be5fa6-7ff619be5fb1 283->286 287 7ff619be5f86-7ff619be5f8a 283->287 284->285 285->259 290 7ff619be6055 286->290 291 7ff619be5fb7-7ff619be5fbb 286->291 287->286 289 7ff619be5f8c-7ff619be5fa1 287->289 289->286 290->259 291->290 293 7ff619be5fc1-7ff619be6006 CloseHandle CreateFileW 291->293 294 7ff619be603b-7ff619be6050 293->294 295 7ff619be6008-7ff619be6036 GetLastError call 7ff619bd4168 call 7ff619bd6bcc 293->295 294->290 295->294
                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 00000001.00000002.1895497148.00007FF619BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF619BC0000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 00000001.00000002.1895473888.00007FF619BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000001.00000002.1895544098.00007FF619BEA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000001.00000002.1895573832.00007FF619BFD000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000001.00000002.1895573832.00007FF619C00000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000001.00000002.1895573832.00007FF619C0C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000001.00000002.1895651091.00007FF619C0E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_1_2_7ff619bc0000_NEVER OPEN!.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: File$CreateErrorLast_invalid_parameter_noinfo$CloseHandle$Type_get_daylight
                                                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                                                              • API String ID: 1330151763-0
                                                                                                                                                                                                                                              • Opcode ID: e7a227fa92ea7581bfd134bfea7d4b548e5a44fbdc42318de0dcb122e3032d81
                                                                                                                                                                                                                                              • Instruction ID: 7ac71263ec66ef3603c4661aec47525be3be020f60aa170523440283f7192dff
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: e7a227fa92ea7581bfd134bfea7d4b548e5a44fbdc42318de0dcb122e3032d81
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 22C1B136B28E4A85EB20CFA9C4806AE3765FB4AFACB015235DA1E977D5DF38D455C300
                                                                                                                                                                                                                                              Function 00007FF619BC1000 Relevance: 12.5, APIs: 1, Strings: 6, Instructions: 273COMMON
                                                                                                                                                                                                                                              Download Yara Rule

                                                                                                                                                                                                                                              Control-flow Graph

                                                                                                                                                                                                                                              • Executed
                                                                                                                                                                                                                                              • Not Executed
                                                                                                                                                                                                                                              control_flow_graph 300 7ff619bc1000-7ff619bc3666 call 7ff619bcefa0 call 7ff619bcef98 call 7ff619bc7560 call 7ff619bcef98 call 7ff619bcacf0 call 7ff619bd4020 call 7ff619bd4cc8 call 7ff619bc1af0 318 7ff619bc366c-7ff619bc367b call 7ff619bc3b80 300->318 319 7ff619bc377a 300->319 318->319 324 7ff619bc3681-7ff619bc3694 call 7ff619bc3a50 318->324 321 7ff619bc377f-7ff619bc379f call 7ff619bcacc0 319->321 324->319 328 7ff619bc369a-7ff619bc36ad call 7ff619bc3b00 324->328 328->319 331 7ff619bc36b3-7ff619bc36da call 7ff619bc6950 328->331 334 7ff619bc371c-7ff619bc3744 call 7ff619bc6ef0 call 7ff619bc19d0 331->334 335 7ff619bc36dc-7ff619bc36eb call 7ff619bc6950 331->335 345 7ff619bc382d-7ff619bc383e 334->345 346 7ff619bc374a-7ff619bc3760 call 7ff619bc19d0 334->346 335->334 340 7ff619bc36ed-7ff619bc36f3 335->340 343 7ff619bc36ff-7ff619bc3719 call 7ff619bd3e4c call 7ff619bc6ef0 340->343 344 7ff619bc36f5-7ff619bc36fd 340->344 343->334 344->343 350 7ff619bc3840-7ff619bc384a call 7ff619bc3260 345->350 351 7ff619bc3853-7ff619bc386b call 7ff619bc7990 345->351 357 7ff619bc37a0-7ff619bc37a3 346->357 358 7ff619bc3762-7ff619bc3775 call 7ff619bc2770 346->358 365 7ff619bc384c 350->365 366 7ff619bc388b-7ff619bc3898 call 7ff619bc5e20 350->366 361 7ff619bc387e-7ff619bc3885 SetDllDirectoryW 351->361 362 7ff619bc386d-7ff619bc3879 call 7ff619bc2770 351->362 357->345 364 7ff619bc37a9-7ff619bc37c0 call 7ff619bc3c90 357->364 358->319 361->366 362->319 375 7ff619bc37c2-7ff619bc37c5 364->375 376 7ff619bc37c7-7ff619bc37f3 call 7ff619bc7160 364->376 365->351 373 7ff619bc38e6-7ff619bc38eb call 7ff619bc5da0 366->373 374 7ff619bc389a-7ff619bc38aa call 7ff619bc5ac0 366->374 383 7ff619bc38f0-7ff619bc38f3 373->383 374->373 390 7ff619bc38ac-7ff619bc38bb call 7ff619bc5620 374->390 380 7ff619bc3802-7ff619bc3818 call 7ff619bc2770 375->380 385 7ff619bc37f5-7ff619bc37fd call 7ff619bcf1c8 376->385 386 7ff619bc381d-7ff619bc382b 376->386 380->319 388 7ff619bc38f9-7ff619bc3906 383->388 389 7ff619bc39a6-7ff619bc39ae call 7ff619bc30f0 383->389 385->380 386->350 392 7ff619bc3910-7ff619bc391a 388->392 399 7ff619bc39b3-7ff619bc39b5 389->399 403 7ff619bc38bd-7ff619bc38c9 call 7ff619bc55b0 390->403 404 7ff619bc38dc-7ff619bc38e1 call 7ff619bc5870 390->404 396 7ff619bc3923-7ff619bc3925 392->396 397 7ff619bc391c-7ff619bc3921 392->397 401 7ff619bc3971-7ff619bc3986 call 7ff619bc3250 call 7ff619bc3090 call 7ff619bc3240 396->401 402 7ff619bc3927-7ff619bc394a call 7ff619bc1b30 396->402 397->392 397->396 399->319 400 7ff619bc39bb-7ff619bc39f2 call 7ff619bc6e80 call 7ff619bc6950 call 7ff619bc53c0 399->400 400->319 427 7ff619bc39f8-7ff619bc3a2d call 7ff619bc3250 call 7ff619bc6f30 call 7ff619bc5870 call 7ff619bc5da0 400->427 426 7ff619bc398b-7ff619bc39a1 call 7ff619bc5870 call 7ff619bc5da0 401->426 402->319 414 7ff619bc3950-7ff619bc395b 402->414 403->404 415 7ff619bc38cb-7ff619bc38da call 7ff619bc5c70 403->415 404->373 418 7ff619bc3960-7ff619bc396f 414->418 415->383 418->401 418->418 426->321 440 7ff619bc3a2f-7ff619bc3a32 call 7ff619bc6bf0 427->440 441 7ff619bc3a37-7ff619bc3a41 call 7ff619bc1ab0 427->441 440->441 441->321
                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                                • Part of subcall function 00007FF619BC3B80: GetModuleFileNameW.KERNEL32(?,00007FF619BC3679), ref: 00007FF619BC3BB1
                                                                                                                                                                                                                                              • SetDllDirectoryW.KERNEL32 ref: 00007FF619BC3885
                                                                                                                                                                                                                                                • Part of subcall function 00007FF619BC6950: GetEnvironmentVariableW.KERNEL32(00007FF619BC36C7), ref: 00007FF619BC698A
                                                                                                                                                                                                                                                • Part of subcall function 00007FF619BC6950: ExpandEnvironmentStringsW.KERNEL32 ref: 00007FF619BC69A7
                                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 00000001.00000002.1895497148.00007FF619BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF619BC0000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 00000001.00000002.1895473888.00007FF619BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000001.00000002.1895544098.00007FF619BEA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000001.00000002.1895573832.00007FF619BFD000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000001.00000002.1895573832.00007FF619C00000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000001.00000002.1895573832.00007FF619C0C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000001.00000002.1895651091.00007FF619C0E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_1_2_7ff619bc0000_NEVER OPEN!.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: Environment$DirectoryExpandFileModuleNameStringsVariable
                                                                                                                                                                                                                                              • String ID: Cannot open PyInstaller archive from executable (%s) or external archive (%s)$Cannot side-load external archive %s (code %d)!$Failed to convert DLL search path!$MEI$_MEIPASS2$_PYI_ONEDIR_MODE
                                                                                                                                                                                                                                              • API String ID: 2344891160-3602715111
                                                                                                                                                                                                                                              • Opcode ID: 8880a3fa9da2dc254b0726fb08fbf0d2d852ff570dfc38cd9ce8d13e7548d239
                                                                                                                                                                                                                                              • Instruction ID: 5b18c65e6a4185351a7c542fbc6f5166c9eac7bfe068f0f5fbf4a712142d8d01
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 8880a3fa9da2dc254b0726fb08fbf0d2d852ff570dfc38cd9ce8d13e7548d239
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 63B16E61A1DE8B41FA75AF2198516FF2254BF46FACF804032EA4DC7796EE2CE605C740
                                                                                                                                                                                                                                              Function 00007FF619BC1050 Relevance: 12.4, APIs: 1, Strings: 6, Instructions: 156COMMON
                                                                                                                                                                                                                                              Download Yara Rule

                                                                                                                                                                                                                                              Control-flow Graph

                                                                                                                                                                                                                                              • Executed
                                                                                                                                                                                                                                              • Not Executed
                                                                                                                                                                                                                                              control_flow_graph 445 7ff619bc1050-7ff619bc10ab call 7ff619bc98a0 448 7ff619bc10d3-7ff619bc10eb call 7ff619bd3e60 445->448 449 7ff619bc10ad-7ff619bc10d2 call 7ff619bc2770 445->449 454 7ff619bc1109-7ff619bc1119 call 7ff619bd3e60 448->454 455 7ff619bc10ed-7ff619bc1104 call 7ff619bc24d0 448->455 461 7ff619bc1137-7ff619bc1147 454->461 462 7ff619bc111b-7ff619bc1132 call 7ff619bc24d0 454->462 460 7ff619bc126c-7ff619bc1281 call 7ff619bc9590 call 7ff619bd3e4c * 2 455->460 478 7ff619bc1286-7ff619bc12a0 460->478 463 7ff619bc1150-7ff619bc1175 call 7ff619bcf518 461->463 462->460 471 7ff619bc125e 463->471 472 7ff619bc117b-7ff619bc1185 call 7ff619bcf28c 463->472 474 7ff619bc1264 471->474 472->471 479 7ff619bc118b-7ff619bc1197 472->479 474->460 480 7ff619bc11a0-7ff619bc11c8 call 7ff619bc7d10 479->480 483 7ff619bc1241-7ff619bc125c call 7ff619bc2770 480->483 484 7ff619bc11ca-7ff619bc11cd 480->484 483->474 485 7ff619bc11cf-7ff619bc11d9 484->485 486 7ff619bc123c 484->486 488 7ff619bc1203-7ff619bc1206 485->488 489 7ff619bc11db-7ff619bc11e8 call 7ff619bcfc24 485->489 486->483 491 7ff619bc1219-7ff619bc121e 488->491 492 7ff619bc1208-7ff619bc1216 call 7ff619bcba90 488->492 496 7ff619bc11ed-7ff619bc11f0 489->496 491->480 495 7ff619bc1220-7ff619bc1223 491->495 492->491 498 7ff619bc1225-7ff619bc1228 495->498 499 7ff619bc1237-7ff619bc123a 495->499 500 7ff619bc11fe-7ff619bc1201 496->500 501 7ff619bc11f2-7ff619bc11fc call 7ff619bcf28c 496->501 498->483 503 7ff619bc122a-7ff619bc1232 498->503 499->474 500->483 501->491 501->500 503->463
                                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 00000001.00000002.1895497148.00007FF619BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF619BC0000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 00000001.00000002.1895473888.00007FF619BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000001.00000002.1895544098.00007FF619BEA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000001.00000002.1895573832.00007FF619BFD000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000001.00000002.1895573832.00007FF619C00000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000001.00000002.1895573832.00007FF619C0C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000001.00000002.1895651091.00007FF619C0E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_1_2_7ff619bc0000_NEVER OPEN!.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: Message
                                                                                                                                                                                                                                              • String ID: 1.2.12$Failed to extract %s: decompression resulted in return code %d!$Failed to extract %s: failed to allocate temporary input buffer!$Failed to extract %s: failed to allocate temporary output buffer!$Failed to extract %s: inflateInit() failed with return code %d!$malloc
                                                                                                                                                                                                                                              • API String ID: 2030045667-1282086711
                                                                                                                                                                                                                                              • Opcode ID: 97735c4434dd2775e0f996fbdb36e03bae9300694db4db13ae1890443f1f3343
                                                                                                                                                                                                                                              • Instruction ID: 7f76304541f4b7ea47553d867fa7a84fe40b3c6db2dd7136ac293367922c2709
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 97735c4434dd2775e0f996fbdb36e03bae9300694db4db13ae1890443f1f3343
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 0651CF22A09E8A85EA709F51E4403BB6294FB86FACF444136EE4DDB785EF3CE545C700
                                                                                                                                                                                                                                              Function 00007FFDFAE2E600 Relevance: 9.2, APIs: 1, Strings: 4, Instructions: 412fileCOMMON
                                                                                                                                                                                                                                              Download Yara Rule

                                                                                                                                                                                                                                              Control-flow Graph

                                                                                                                                                                                                                                              • Executed
                                                                                                                                                                                                                                              • Not Executed
                                                                                                                                                                                                                                              control_flow_graph 759 7ffdfae2e600-7ffdfae2e649 760 7ffdfae2e64e-7ffdfae2e6c2 759->760 761 7ffdfae2e6c4-7ffdfae2e6d3 call 7ffdfae2e040 760->761 762 7ffdfae2e6ec-7ffdfae2e6fc call 7ffdfae2b580 760->762 767 7ffdfae2ec69-7ffdfae2ec8c call 7ffdfaf46490 761->767 768 7ffdfae2e6d9-7ffdfae2e6e4 761->768 769 7ffdfae2ec04-7ffdfae2ec07 762->769 770 7ffdfae2e702-7ffdfae2e72b 762->770 768->762 772 7ffdfae2ec64 769->772 773 7ffdfae2ec09-7ffdfae2ec10 769->773 774 7ffdfae2e730-7ffdfae2e745 770->774 772->767 776 7ffdfae2ec12-7ffdfae2ec1c 773->776 777 7ffdfae2ec5b 773->777 781 7ffdfae2e782-7ffdfae2e78c 774->781 782 7ffdfae2e747-7ffdfae2e753 774->782 779 7ffdfae2ec1e 776->779 780 7ffdfae2ec24-7ffdfae2ec51 776->780 777->772 779->780 780->772 798 7ffdfae2ec53-7ffdfae2ec59 780->798 784 7ffdfae2e78e-7ffdfae2e790 781->784 785 7ffdfae2e796-7ffdfae2e7b3 781->785 782->785 791 7ffdfae2e755-7ffdfae2e75b 782->791 784->785 789 7ffdfae2e9d5-7ffdfae2e9dc 784->789 787 7ffdfae2e7b5-7ffdfae2e7b9 785->787 788 7ffdfae2e7bb-7ffdfae2e7c4 785->788 790 7ffdfae2e7c7-7ffdfae2e7d9 call 7ffdfaeddeb0 787->790 788->790 793 7ffdfae2e9de-7ffdfae2e9e8 789->793 794 7ffdfae2ea27 789->794 806 7ffdfae2e7f6 790->806 807 7ffdfae2e7db-7ffdfae2e7f4 call 7ffdfae98cf0 790->807 796 7ffdfae2e75d-7ffdfae2e761 791->796 797 7ffdfae2e763-7ffdfae2e766 791->797 799 7ffdfae2e9f0-7ffdfae2ea1d 793->799 800 7ffdfae2e9ea 793->800 803 7ffdfae2ea30 794->803 796->797 802 7ffdfae2e76f-7ffdfae2e780 796->802 797->802 804 7ffdfae2e768-7ffdfae2e76d 797->804 798->772 808 7ffdfae2ea37-7ffdfae2ea3a 799->808 820 7ffdfae2ea1f-7ffdfae2ea25 799->820 800->799 802->774 803->808 804->785 804->802 811 7ffdfae2e7f8-7ffdfae2e81a 806->811 807->811 813 7ffdfae2ea98-7ffdfae2ea9d 808->813 814 7ffdfae2ea3c-7ffdfae2ea43 808->814 817 7ffdfae2e820-7ffdfae2e847 CreateFileW 811->817 813->767 818 7ffdfae2ea8f 814->818 819 7ffdfae2ea45-7ffdfae2ea48 814->819 821 7ffdfae2e8f0 817->821 822 7ffdfae2e84d-7ffdfae2e84f 817->822 818->813 823 7ffdfae2ea50-7ffdfae2ea7d 819->823 824 7ffdfae2ea4a 819->824 820->803 825 7ffdfae2e8f4-7ffdfae2e8f7 821->825 826 7ffdfae2e89f-7ffdfae2e8ac 822->826 827 7ffdfae2e851-7ffdfae2e863 822->827 823->813 849 7ffdfae2ea7f-7ffdfae2ea8a 823->849 824->823 829 7ffdfae2e927-7ffdfae2e92b 825->829 830 7ffdfae2e8f9-7ffdfae2e922 call 7ffdfae286b0 825->830 842 7ffdfae2e8ae-7ffdfae2e8b4 826->842 843 7ffdfae2e8ec-7ffdfae2e8ee 826->843 832 7ffdfae2e867-7ffdfae2e88d call 7ffdfae2ee50 827->832 833 7ffdfae2e865 827->833 835 7ffdfae2e931-7ffdfae2e941 call 7ffdfae25520 829->835 836 7ffdfae2eadc-7ffdfae2eaea 829->836 830->829 846 7ffdfae2e88f 832->846 847 7ffdfae2e891-7ffdfae2e893 832->847 833->832 856 7ffdfae2e99e-7ffdfae2e9a3 835->856 857 7ffdfae2e943-7ffdfae2e94a 835->857 844 7ffdfae2eaec-7ffdfae2eaf8 836->844 845 7ffdfae2eafa-7ffdfae2eb13 call 7ffdfae25520 836->845 851 7ffdfae2e8c6-7ffdfae2e8c9 842->851 852 7ffdfae2e8b6-7ffdfae2e8c4 842->852 843->825 844->845 860 7ffdfae2eb70-7ffdfae2eb73 845->860 861 7ffdfae2eb15-7ffdfae2eb1c 845->861 846->847 854 7ffdfae2e895-7ffdfae2e899 847->854 855 7ffdfae2e89b 847->855 849->767 858 7ffdfae2e8d2-7ffdfae2e8e7 851->858 859 7ffdfae2e8cb-7ffdfae2e8d0 851->859 852->851 852->858 854->821 854->855 855->826 863 7ffdfae2eaa2-7ffdfae2ead7 call 7ffdfae2be30 call 7ffdfaedd060 856->863 864 7ffdfae2e9a9-7ffdfae2e9ae 856->864 865 7ffdfae2e995 857->865 866 7ffdfae2e94c-7ffdfae2e956 857->866 858->817 859->843 859->858 867 7ffdfae2eb75-7ffdfae2eb78 860->867 868 7ffdfae2eb7a 860->868 869 7ffdfae2eb1e-7ffdfae2eb28 861->869 870 7ffdfae2eb67 861->870 863->767 864->863 871 7ffdfae2e9b4-7ffdfae2e9d0 864->871 865->856 872 7ffdfae2e95e-7ffdfae2e98b 866->872 873 7ffdfae2e958 866->873 876 7ffdfae2eb81-7ffdfae2eb96 867->876 868->876 877 7ffdfae2eb30-7ffdfae2eb5d 869->877 878 7ffdfae2eb2a 869->878 870->860 871->760 872->856 890 7ffdfae2e98d-7ffdfae2e993 872->890 873->872 880 7ffdfae2eb98 876->880 881 7ffdfae2eb9c-7ffdfae2eba4 876->881 877->860 895 7ffdfae2eb5f-7ffdfae2eb65 877->895 878->877 880->881 884 7ffdfae2eba6-7ffdfae2ebba call 7ffdfaeddeb0 881->884 885 7ffdfae2ebdc-7ffdfae2ec02 881->885 893 7ffdfae2ebd8 884->893 894 7ffdfae2ebbc-7ffdfae2ebd6 call 7ffdfae98cf0 884->894 885->767 890->856 893->885 894->885 894->893 895->860
                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 00000001.00000002.1896332214.00007FFDFAE21000.00000040.00000001.01000000.0000001E.sdmp, Offset: 00007FFDFAE20000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 00000001.00000002.1896301415.00007FFDFAE20000.00000002.00000001.01000000.0000001E.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000001.00000002.1896332214.00007FFDFAF73000.00000040.00000001.01000000.0000001E.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000001.00000002.1896332214.00007FFDFAF75000.00000040.00000001.01000000.0000001E.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000001.00000002.1896332214.00007FFDFAF8A000.00000040.00000001.01000000.0000001E.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000001.00000002.1896536596.00007FFDFAF8C000.00000080.00000001.01000000.0000001E.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000001.00000002.1896632509.00007FFDFAF8E000.00000004.00000001.01000000.0000001E.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_1_2_7ffdfae20000_NEVER OPEN!.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: 00007A4519$CreateFile
                                                                                                                                                                                                                                              • String ID: delayed %dms for lock/sharing conflict at line %d$exclusive$psow$winOpen
                                                                                                                                                                                                                                              • API String ID: 1717138855-3829269058
                                                                                                                                                                                                                                              • Opcode ID: b2a484d92630390903fb77acb3acde49be17e115408bbefa8c12a6bd82aebf68
                                                                                                                                                                                                                                              • Instruction ID: b31eac609b8aee732710de880a6ef7f6d40abc4750d8a835a07507d945f10f64
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: b2a484d92630390903fb77acb3acde49be17e115408bbefa8c12a6bd82aebf68
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 17028321F0965286FB6C9B51F860A7967A4FF84B64F0402B9EDAF466E8DF3DE444C700
                                                                                                                                                                                                                                              Function 00007FFDFAE37850 Relevance: 7.5, APIs: 1, Strings: 3, Instructions: 514COMMON
                                                                                                                                                                                                                                              Download Yara Rule

                                                                                                                                                                                                                                              Control-flow Graph

                                                                                                                                                                                                                                              • Executed
                                                                                                                                                                                                                                              • Not Executed
                                                                                                                                                                                                                                              control_flow_graph 1089 7ffdfae37850-7ffdfae378db 1090 7ffdfae37a33-7ffdfae37a49 1089->1090 1091 7ffdfae378e1-7ffdfae378eb 1089->1091 1093 7ffdfae37a4f-7ffdfae37a55 1090->1093 1094 7ffdfae37946-7ffdfae3798f call 7ffdfae25330 1090->1094 1091->1090 1092 7ffdfae378f1-7ffdfae378f4 1091->1092 1092->1093 1095 7ffdfae378fa 1092->1095 1093->1094 1096 7ffdfae37a5b-7ffdfae37a71 call 7ffdfae25330 1093->1096 1101 7ffdfae37995-7ffdfae379f5 00007FFE1A4519C0 1094->1101 1102 7ffdfae3800b-7ffdfae3800e 1094->1102 1099 7ffdfae37901-7ffdfae3790a 1095->1099 1108 7ffdfae3806b 1096->1108 1110 7ffdfae37a77-7ffdfae37a93 1096->1110 1099->1099 1103 7ffdfae3790c-7ffdfae3791b call 7ffdfae25330 1099->1103 1105 7ffdfae37c21-7ffdfae37c3c 1101->1105 1106 7ffdfae379fb-7ffdfae37a17 call 7ffdfaf47444 1101->1106 1107 7ffdfae38010-7ffdfae38017 1102->1107 1102->1108 1103->1108 1124 7ffdfae37921-7ffdfae37930 call 7ffdfaf47444 1103->1124 1115 7ffdfae37c9e-7ffdfae37cb8 1105->1115 1116 7ffdfae37c3e-7ffdfae37c41 1105->1116 1128 7ffdfae37a1d-7ffdfae37a2e call 7ffdfaf47444 1106->1128 1129 7ffdfae37bcc 1106->1129 1113 7ffdfae38062 1107->1113 1114 7ffdfae38019-7ffdfae38023 1107->1114 1112 7ffdfae38070-7ffdfae38080 1108->1112 1126 7ffdfae37a95-7ffdfae37aa2 1110->1126 1127 7ffdfae37aa9 1110->1127 1113->1108 1119 7ffdfae38025 1114->1119 1120 7ffdfae3802b-7ffdfae38058 1114->1120 1121 7ffdfae37cbe-7ffdfae37cc3 1115->1121 1122 7ffdfae37dd5 1115->1122 1116->1115 1123 7ffdfae37c43-7ffdfae37c4a 1116->1123 1119->1120 1120->1108 1166 7ffdfae3805a-7ffdfae38060 1120->1166 1121->1122 1131 7ffdfae37cc9-7ffdfae37cf5 call 7ffdfae2e600 1121->1131 1130 7ffdfae37dda-7ffdfae37de8 1122->1130 1132 7ffdfae37c95 1123->1132 1133 7ffdfae37c4c-7ffdfae37c56 1123->1133 1149 7ffdfae37937-7ffdfae3793e 1124->1149 1126->1127 1136 7ffdfae37ab0-7ffdfae37ab7 1127->1136 1135 7ffdfae37bcf-7ffdfae37c1f call 7ffdfaf47444 * 2 1128->1135 1129->1135 1138 7ffdfae37deb-7ffdfae37dee 1130->1138 1148 7ffdfae37cf8-7ffdfae37d18 1131->1148 1132->1115 1139 7ffdfae37c5e-7ffdfae37c8b 1133->1139 1140 7ffdfae37c58 1133->1140 1135->1116 1136->1136 1144 7ffdfae37ab9-7ffdfae37ac0 1136->1144 1146 7ffdfae37df4-7ffdfae37e0d call 7ffdfae36dc0 1138->1146 1147 7ffdfae37e9a-7ffdfae37ea4 1138->1147 1139->1115 1176 7ffdfae37c8d-7ffdfae37c93 1139->1176 1140->1139 1153 7ffdfae37ac7-7ffdfae37ace 1144->1153 1146->1147 1173 7ffdfae37e13-7ffdfae37e94 1146->1173 1150 7ffdfae37eb2-7ffdfae37ec5 call 7ffdfae32d40 1147->1150 1151 7ffdfae37ea6-7ffdfae37eaf 1147->1151 1155 7ffdfae37dd0-7ffdfae37dd3 1148->1155 1156 7ffdfae37d1e-7ffdfae37d28 1148->1156 1149->1149 1158 7ffdfae37940 1149->1158 1179 7ffdfae37ffd-7ffdfae38009 1150->1179 1180 7ffdfae37ecb-7ffdfae37ed5 1150->1180 1151->1150 1153->1153 1162 7ffdfae37ad0-7ffdfae37ae7 1153->1162 1155->1138 1164 7ffdfae37d2e-7ffdfae37d31 1156->1164 1165 7ffdfae37d2a-7ffdfae37d2c 1156->1165 1158->1094 1171 7ffdfae37b37-7ffdfae37b3e 1162->1171 1172 7ffdfae37ae9 1162->1172 1174 7ffdfae37d33-7ffdfae37d3b 1164->1174 1165->1174 1166->1108 1182 7ffdfae37b40-7ffdfae37b48 1171->1182 1183 7ffdfae37b63-7ffdfae37b6a 1171->1183 1181 7ffdfae37af0-7ffdfae37af7 1172->1181 1201 7ffdfae37ef8-7ffdfae37efe 1173->1201 1202 7ffdfae37e96 1173->1202 1177 7ffdfae37d5f-7ffdfae37d75 call 7ffdfaeddeb0 1174->1177 1178 7ffdfae37d3d-7ffdfae37d51 call 7ffdfae35ff0 1174->1178 1176->1115 1207 7ffdfae37d8d 1177->1207 1208 7ffdfae37d77-7ffdfae37d8b call 7ffdfae98cf0 1177->1208 1178->1177 1206 7ffdfae37d53-7ffdfae37d58 1178->1206 1179->1112 1189 7ffdfae37edd-7ffdfae37ef0 1180->1189 1190 7ffdfae37ed7 1180->1190 1191 7ffdfae37b00-7ffdfae37b09 1181->1191 1182->1094 1193 7ffdfae37b4e-7ffdfae37b5d call 7ffdfaedd060 1182->1193 1186 7ffdfae37bbb 1183->1186 1187 7ffdfae37b6c-7ffdfae37b76 1183->1187 1205 7ffdfae37bc4-7ffdfae37bc7 1186->1205 1197 7ffdfae37b7e-7ffdfae37bab 1187->1197 1198 7ffdfae37b78 1187->1198 1189->1201 1190->1189 1191->1191 1200 7ffdfae37b0b-7ffdfae37b19 1191->1200 1193->1094 1193->1183 1197->1205 1227 7ffdfae37bad-7ffdfae37bb6 1197->1227 1198->1197 1209 7ffdfae37b20-7ffdfae37b29 1200->1209 1211 7ffdfae37f00-7ffdfae37f23 1201->1211 1212 7ffdfae37f27-7ffdfae37f37 1201->1212 1202->1147 1205->1112 1206->1177 1216 7ffdfae37d8f-7ffdfae37d94 1207->1216 1208->1216 1209->1209 1215 7ffdfae37b2b-7ffdfae37b35 1209->1215 1211->1212 1221 7ffdfae37f3f-7ffdfae37f74 1212->1221 1222 7ffdfae37f39 1212->1222 1215->1171 1215->1181 1219 7ffdfae37dc8-7ffdfae37dce 1216->1219 1220 7ffdfae37d96-7ffdfae37dac call 7ffdfaeddeb0 1216->1220 1219->1130 1220->1155 1229 7ffdfae37dae-7ffdfae37dc6 call 7ffdfae98cf0 1220->1229 1225 7ffdfae37f7d-7ffdfae37f9e call 7ffdfae35ff0 1221->1225 1226 7ffdfae37f76 1221->1226 1222->1221 1235 7ffdfae37fa0-7ffdfae37fa4 1225->1235 1236 7ffdfae37fa6-7ffdfae37fa9 1225->1236 1226->1225 1227->1112 1229->1155 1229->1219 1237 7ffdfae37fb4-7ffdfae37fc6 1235->1237 1238 7ffdfae37fb0 1236->1238 1239 7ffdfae37fab-7ffdfae37fae 1236->1239 1240 7ffdfae37fd1-7ffdfae37fe3 1237->1240 1241 7ffdfae37fc8-7ffdfae37fcf 1237->1241 1238->1237 1239->1237 1239->1238 1242 7ffdfae37fe7-7ffdfae37ffb 1240->1242 1241->1242 1242->1112
                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 00000001.00000002.1896332214.00007FFDFAE21000.00000040.00000001.01000000.0000001E.sdmp, Offset: 00007FFDFAE20000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 00000001.00000002.1896301415.00007FFDFAE20000.00000002.00000001.01000000.0000001E.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000001.00000002.1896332214.00007FFDFAF73000.00000040.00000001.01000000.0000001E.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000001.00000002.1896332214.00007FFDFAF75000.00000040.00000001.01000000.0000001E.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000001.00000002.1896332214.00007FFDFAF8A000.00000040.00000001.01000000.0000001E.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000001.00000002.1896536596.00007FFDFAF8C000.00000080.00000001.01000000.0000001E.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000001.00000002.1896632509.00007FFDFAF8E000.00000004.00000001.01000000.0000001E.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_1_2_7ffdfae20000_NEVER OPEN!.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: 00007A4519
                                                                                                                                                                                                                                              • String ID: -journal$immutable$nolock
                                                                                                                                                                                                                                              • API String ID: 817585512-4201244970
                                                                                                                                                                                                                                              • Opcode ID: 0fe75a12e25a0bd2d085f24739822dd787093ae36985571f68a0b08e36edfca0
                                                                                                                                                                                                                                              • Instruction ID: f5e4e5edb791855d49ad666140d93c31531297793c893aa5de02205068fc20df
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 0fe75a12e25a0bd2d085f24739822dd787093ae36985571f68a0b08e36edfca0
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 3B32A062B0978286EB68DF25A460B793BA1FF45BA4F044274DA6E077D8DF3DE495C300
                                                                                                                                                                                                                                              Function 00007FFDFAE38670 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 172COMMON
                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 00000001.00000002.1896332214.00007FFDFAE21000.00000040.00000001.01000000.0000001E.sdmp, Offset: 00007FFDFAE20000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 00000001.00000002.1896301415.00007FFDFAE20000.00000002.00000001.01000000.0000001E.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000001.00000002.1896332214.00007FFDFAF73000.00000040.00000001.01000000.0000001E.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000001.00000002.1896332214.00007FFDFAF75000.00000040.00000001.01000000.0000001E.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000001.00000002.1896332214.00007FFDFAF8A000.00000040.00000001.01000000.0000001E.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000001.00000002.1896536596.00007FFDFAF8C000.00000080.00000001.01000000.0000001E.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000001.00000002.1896632509.00007FFDFAF8E000.00000004.00000001.01000000.0000001E.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_1_2_7ffdfae20000_NEVER OPEN!.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID:
                                                                                                                                                                                                                                              • String ID: %s at line %d of [%.10s]$a29f9949895322123f7c38fbe94c649a9d6e6c9cd0c3b41c96d694552f26b309$database corruption
                                                                                                                                                                                                                                              • API String ID: 0-481979681
                                                                                                                                                                                                                                              • Opcode ID: 1eedd298c97080c16f1be0e5adbc717ca0ae1a2951dbec36216f3e95c1df864e
                                                                                                                                                                                                                                              • Instruction ID: 1ad5ec3bd2bdac93a7d0b6f5804d516aaea2565e3248b6a46b1b743803d6982e
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 1eedd298c97080c16f1be0e5adbc717ca0ae1a2951dbec36216f3e95c1df864e
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 0E718F62B0874281FB68AB11E460B7A6BA2FF84B84F544075DA6F476D8DF7FF4818300
                                                                                                                                                                                                                                              Function 00007FFDFAE2C000 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 110fileCOMMON
                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 00000001.00000002.1896332214.00007FFDFAE21000.00000040.00000001.01000000.0000001E.sdmp, Offset: 00007FFDFAE20000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 00000001.00000002.1896301415.00007FFDFAE20000.00000002.00000001.01000000.0000001E.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000001.00000002.1896332214.00007FFDFAF73000.00000040.00000001.01000000.0000001E.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000001.00000002.1896332214.00007FFDFAF75000.00000040.00000001.01000000.0000001E.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000001.00000002.1896332214.00007FFDFAF8A000.00000040.00000001.01000000.0000001E.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000001.00000002.1896536596.00007FFDFAF8C000.00000080.00000001.01000000.0000001E.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000001.00000002.1896632509.00007FFDFAF8E000.00000004.00000001.01000000.0000001E.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_1_2_7ffdfae20000_NEVER OPEN!.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: 00007A4519FileRead
                                                                                                                                                                                                                                              • String ID: delayed %dms for lock/sharing conflict at line %d$winRead
                                                                                                                                                                                                                                              • API String ID: 857436965-1843600136
                                                                                                                                                                                                                                              • Opcode ID: c42462ee678e96c825723e9381acb87a1b22cd2c90639cf46ca189585d33ef91
                                                                                                                                                                                                                                              • Instruction ID: a3aafffbfca12245039b19f1bc0e7d580610f49f516fc65cea15dade9267171c
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: c42462ee678e96c825723e9381acb87a1b22cd2c90639cf46ca189585d33ef91
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 8E410422F08A0281E718AF15E860DB977A5FF84B84F440172EE6E477D8DF3DE9468740
                                                                                                                                                                                                                                              Function 00007FF619BCAE2C Relevance: 6.1, APIs: 4, Instructions: 94COMMON
                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 00000001.00000002.1895497148.00007FF619BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF619BC0000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 00000001.00000002.1895473888.00007FF619BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000001.00000002.1895544098.00007FF619BEA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000001.00000002.1895573832.00007FF619BFD000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000001.00000002.1895573832.00007FF619C00000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000001.00000002.1895573832.00007FF619C0C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000001.00000002.1895651091.00007FF619C0E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_1_2_7ff619bc0000_NEVER OPEN!.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: __scrt_acquire_startup_lock__scrt_dllmain_crt_thread_attach__scrt_get_show_window_mode__scrt_initialize_crt__scrt_release_startup_lock
                                                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                                                              • API String ID: 1452418845-0
                                                                                                                                                                                                                                              • Opcode ID: 2dfea9045f881ff78022f3a65fc22168407db2ca461a817ccd3f57a6f463f9a5
                                                                                                                                                                                                                                              • Instruction ID: ddad11dad88b26954ec2b3970e425729b6eeaf6e647957d09e5c934a91a89cc4
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 2dfea9045f881ff78022f3a65fc22168407db2ca461a817ccd3f57a6f463f9a5
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: F5311721E08E1F86EA34AF6594553BF22A59F83F6CF440038E94ECB7D3DE2CA805D251
                                                                                                                                                                                                                                              Function 00007FF619BD4430 Relevance: 6.1, APIs: 4, Instructions: 90fileCOMMON
                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 00000001.00000002.1895497148.00007FF619BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF619BC0000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 00000001.00000002.1895473888.00007FF619BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000001.00000002.1895544098.00007FF619BEA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000001.00000002.1895573832.00007FF619BFD000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000001.00000002.1895573832.00007FF619C00000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000001.00000002.1895573832.00007FF619C0C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000001.00000002.1895651091.00007FF619C0E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_1_2_7ff619bc0000_NEVER OPEN!.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: CloseCreateFileHandle_invalid_parameter_noinfo
                                                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                                                              • API String ID: 1279662727-0
                                                                                                                                                                                                                                              • Opcode ID: 21887a76fab70bdc55b3b9b565396f93ca79333e6ee6190ac96417c2d9d1ce6a
                                                                                                                                                                                                                                              • Instruction ID: 4120dc962e54ac8e9046ad6bed1c6f7d4c8a2b99f0523f60cc2b0a4fb60bde6b
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 21887a76fab70bdc55b3b9b565396f93ca79333e6ee6190ac96417c2d9d1ce6a
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: DC418222D18B8683F7648F6195103AA63A1FB96F7CF109334EA9C43BD1DF6CA5E08700
                                                                                                                                                                                                                                              Function 00007FF619BD8BE0 Relevance: 4.5, APIs: 3, Instructions: 14COMMON
                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 00000001.00000002.1895497148.00007FF619BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF619BC0000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 00000001.00000002.1895473888.00007FF619BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000001.00000002.1895544098.00007FF619BEA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000001.00000002.1895573832.00007FF619BFD000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000001.00000002.1895573832.00007FF619C00000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000001.00000002.1895573832.00007FF619C0C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000001.00000002.1895651091.00007FF619C0E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_1_2_7ff619bc0000_NEVER OPEN!.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: Process$CurrentExitTerminate
                                                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                                                              • API String ID: 1703294689-0
                                                                                                                                                                                                                                              • Opcode ID: d62060bd09c98f63d26231482086f6b03c071e5e7110db56bdb808fa1e27c3c8
                                                                                                                                                                                                                                              • Instruction ID: 023c47a6a963ef596c7731fd7fbd099b56ba3bc42643e86dcae7bf9a29fb0eb4
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: d62060bd09c98f63d26231482086f6b03c071e5e7110db56bdb808fa1e27c3c8
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: D2D09E10B09F0A82EA797F76589557A125D5F5BF6EF141478C80F86393CD2CA4898302
                                                                                                                                                                                                                                              Function 00007FFDFAED8620 Relevance: 3.8, APIs: 1, Strings: 1, Instructions: 320COMMON
                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                              • 00007FFE1A4519C0.VCRUNTIME140(?,?,?,?,00007FFDFAE285DD,?,?,?,?,00007FFDFAE54567,?,?,?,?,?,00007FFDFAE2207B), ref: 00007FFDFAED87B8
                                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 00000001.00000002.1896332214.00007FFDFAE21000.00000040.00000001.01000000.0000001E.sdmp, Offset: 00007FFDFAE20000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 00000001.00000002.1896301415.00007FFDFAE20000.00000002.00000001.01000000.0000001E.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000001.00000002.1896332214.00007FFDFAF73000.00000040.00000001.01000000.0000001E.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000001.00000002.1896332214.00007FFDFAF75000.00000040.00000001.01000000.0000001E.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000001.00000002.1896332214.00007FFDFAF8A000.00000040.00000001.01000000.0000001E.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000001.00000002.1896536596.00007FFDFAF8C000.00000080.00000001.01000000.0000001E.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000001.00000002.1896632509.00007FFDFAF8E000.00000004.00000001.01000000.0000001E.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_1_2_7ffdfae20000_NEVER OPEN!.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: 00007A4519
                                                                                                                                                                                                                                              • String ID: gfff
                                                                                                                                                                                                                                              • API String ID: 817585512-1553575800
                                                                                                                                                                                                                                              • Opcode ID: 256921db80dc625c037577772ea5bac6b3f9cb5dd9d562555d42c27896aa6bad
                                                                                                                                                                                                                                              • Instruction ID: 6df4cbdea6557a536af50c75b6df1c5f742558fdbea9fe529f73703ab97e19aa
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 256921db80dc625c037577772ea5bac6b3f9cb5dd9d562555d42c27896aa6bad
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 4FF1FA64F0D60785FB9CAB15B970E7422A9AF44B60F4402B9E93E4E7E9DF6DF8408300
                                                                                                                                                                                                                                              Function 00007FF619BCF2B8 Relevance: 3.2, APIs: 2, Instructions: 175COMMONLIBRARYCODE
                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 00000001.00000002.1895497148.00007FF619BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF619BC0000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 00000001.00000002.1895473888.00007FF619BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000001.00000002.1895544098.00007FF619BEA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000001.00000002.1895573832.00007FF619BFD000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000001.00000002.1895573832.00007FF619C00000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000001.00000002.1895573832.00007FF619C0C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000001.00000002.1895651091.00007FF619C0E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_1_2_7ff619bc0000_NEVER OPEN!.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: _invalid_parameter_noinfo
                                                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                                                              • API String ID: 3215553584-0
                                                                                                                                                                                                                                              • Opcode ID: 46a2af1879c2f50747042a3ab55741b4931bc27440d9acf90303e4543271f7f8
                                                                                                                                                                                                                                              • Instruction ID: 60af2eb5fd27291d52924c93652fd45c522b7e0cf0265f29bceee99b92e86bfe
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 46a2af1879c2f50747042a3ab55741b4931bc27440d9acf90303e4543271f7f8
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: AC510321B09A9A96FB389E66940067B6691BF86FBCF144375EE6DC77C5CF3CE4018600
                                                                                                                                                                                                                                              Function 00007FF619BDB96C Relevance: 3.0, APIs: 2, Instructions: 46COMMONLIBRARYCODE
                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                              • SetFilePointerEx.KERNEL32(?,?,?,?,00000000,00007FF619BDBB05), ref: 00007FF619BDB9B8
                                                                                                                                                                                                                                              • GetLastError.KERNEL32(?,?,?,?,00000000,00007FF619BDBB05), ref: 00007FF619BDB9C2
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 00000001.00000002.1895497148.00007FF619BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF619BC0000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 00000001.00000002.1895473888.00007FF619BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000001.00000002.1895544098.00007FF619BEA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000001.00000002.1895573832.00007FF619BFD000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000001.00000002.1895573832.00007FF619C00000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000001.00000002.1895573832.00007FF619C0C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000001.00000002.1895651091.00007FF619C0E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_1_2_7ff619bc0000_NEVER OPEN!.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: ErrorFileLastPointer
                                                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                                                              • API String ID: 2976181284-0
                                                                                                                                                                                                                                              • Opcode ID: 1eb380e80a89d0b1773f03f267f74a86f3d4599d947c953e904cec0139cff5ef
                                                                                                                                                                                                                                              • Instruction ID: 9ea1c1878fbe30ba209960072135d6133c1396b5de8fbafe9d41d2aad919a042
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 1eb380e80a89d0b1773f03f267f74a86f3d4599d947c953e904cec0139cff5ef
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 3611BF61A18E9681DA208F26A40417A67A1AB86FFCF544331EABD877D9CE7CD0548740
                                                                                                                                                                                                                                              Function 00007FF619BDA168 Relevance: 3.0, APIs: 2, Instructions: 19memoryCOMMONLIBRARYCODE
                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                              • RtlFreeHeap.NTDLL(?,?,?,00007FF619BE214A,?,?,?,00007FF619BE2187,?,?,00000000,00007FF619BE2658,?,?,?,00007FF619BE258B), ref: 00007FF619BDA17E
                                                                                                                                                                                                                                              • GetLastError.KERNEL32(?,?,?,00007FF619BE214A,?,?,?,00007FF619BE2187,?,?,00000000,00007FF619BE2658,?,?,?,00007FF619BE258B), ref: 00007FF619BDA188
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 00000001.00000002.1895497148.00007FF619BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF619BC0000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 00000001.00000002.1895473888.00007FF619BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000001.00000002.1895544098.00007FF619BEA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000001.00000002.1895573832.00007FF619BFD000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000001.00000002.1895573832.00007FF619C00000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000001.00000002.1895573832.00007FF619C0C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000001.00000002.1895651091.00007FF619C0E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_1_2_7ff619bc0000_NEVER OPEN!.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: ErrorFreeHeapLast
                                                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                                                              • API String ID: 485612231-0
                                                                                                                                                                                                                                              • Opcode ID: a673a507b2d9f362c5f5c34d7f5e537087e665f3a82958f491e2c6c5d4392de6
                                                                                                                                                                                                                                              • Instruction ID: 9e1ddb109eb2b059439b5407fb77150af8176a12e0766ab9af0a31b700263de3
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: a673a507b2d9f362c5f5c34d7f5e537087e665f3a82958f491e2c6c5d4392de6
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: BCE08654F09E0A42FF399FB2A88517A25955F56F2CF040030C90DC2392DE2C68858200
                                                                                                                                                                                                                                              Function 00007FF619BDA378 Relevance: 2.6, APIs: 2, Instructions: 59COMMON
                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                              • CloseHandle.KERNEL32(?,?,?,00007FF619BDA1F5,?,?,00000000,00007FF619BDA2AA), ref: 00007FF619BDA3E6
                                                                                                                                                                                                                                              • GetLastError.KERNEL32(?,?,?,00007FF619BDA1F5,?,?,00000000,00007FF619BDA2AA), ref: 00007FF619BDA3F0
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 00000001.00000002.1895497148.00007FF619BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF619BC0000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 00000001.00000002.1895473888.00007FF619BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000001.00000002.1895544098.00007FF619BEA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000001.00000002.1895573832.00007FF619BFD000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000001.00000002.1895573832.00007FF619C00000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000001.00000002.1895573832.00007FF619C0C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000001.00000002.1895651091.00007FF619C0E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_1_2_7ff619bc0000_NEVER OPEN!.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: CloseErrorHandleLast
                                                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                                                              • API String ID: 918212764-0
                                                                                                                                                                                                                                              • Opcode ID: 6d510294f211babb34c62ae7a866304dc7809045747c103bf26d8d248780cbcb
                                                                                                                                                                                                                                              • Instruction ID: 3d680c131f722e6492fd9451d1fad8d2bcc94f93d7ab302be983eda5bb472c85
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 6d510294f211babb34c62ae7a866304dc7809045747c103bf26d8d248780cbcb
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 36219321F18F8681EE749F65949427E16D29F86FBCF584239DA2EC77D2CE6CA4458300
                                                                                                                                                                                                                                              Function 00007FF619BDB6D8 Relevance: 1.6, APIs: 1, Instructions: 105COMMONLIBRARYCODE
                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 00000001.00000002.1895497148.00007FF619BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF619BC0000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 00000001.00000002.1895473888.00007FF619BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000001.00000002.1895544098.00007FF619BEA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000001.00000002.1895573832.00007FF619BFD000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000001.00000002.1895573832.00007FF619C00000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000001.00000002.1895573832.00007FF619C0C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000001.00000002.1895651091.00007FF619C0E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_1_2_7ff619bc0000_NEVER OPEN!.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: _invalid_parameter_noinfo
                                                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                                                              • API String ID: 3215553584-0
                                                                                                                                                                                                                                              • Opcode ID: 9a2f5509c2513d59fe979e25468af22b553e7e6e41632d6b8d9265302dbfc066
                                                                                                                                                                                                                                              • Instruction ID: b4c1dec79c47801f2e26b82a65a6fe276ffad865282f1ba18ecf4d85a5b58517
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 9a2f5509c2513d59fe979e25468af22b553e7e6e41632d6b8d9265302dbfc066
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 8241AF32A09A1A87EA348F19E54127A77E0EB52FACF100135DB9EC7791CF2DE502C741
                                                                                                                                                                                                                                              Function 00007FF619BC7160 Relevance: 1.6, APIs: 1, Instructions: 85COMMON
                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 00000001.00000002.1895497148.00007FF619BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF619BC0000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 00000001.00000002.1895473888.00007FF619BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000001.00000002.1895544098.00007FF619BEA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000001.00000002.1895573832.00007FF619BFD000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000001.00000002.1895573832.00007FF619C00000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000001.00000002.1895573832.00007FF619C0C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000001.00000002.1895651091.00007FF619C0E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_1_2_7ff619bc0000_NEVER OPEN!.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: _fread_nolock
                                                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                                                              • API String ID: 840049012-0
                                                                                                                                                                                                                                              • Opcode ID: 80612ef84a710cba9f10d48bd5d8ba49aebda6c000e4a97510d41630c95a9a32
                                                                                                                                                                                                                                              • Instruction ID: 03c45bda53aadf814c509b9544c331e22243daf5ef3b6d969e2f522b93c98551
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 80612ef84a710cba9f10d48bd5d8ba49aebda6c000e4a97510d41630c95a9a32
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 2121B621B0DA9A46FA249F5265443FBA641BF47FECF884431EE0C8B786CE3CE141C600
                                                                                                                                                                                                                                              Function 00007FF619BDB170 Relevance: 1.6, APIs: 1, Instructions: 74COMMONLIBRARYCODE
                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 00000001.00000002.1895497148.00007FF619BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF619BC0000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 00000001.00000002.1895473888.00007FF619BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000001.00000002.1895544098.00007FF619BEA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000001.00000002.1895573832.00007FF619BFD000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000001.00000002.1895573832.00007FF619C00000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000001.00000002.1895573832.00007FF619C0C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000001.00000002.1895651091.00007FF619C0E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_1_2_7ff619bc0000_NEVER OPEN!.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: _invalid_parameter_noinfo
                                                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                                                              • API String ID: 3215553584-0
                                                                                                                                                                                                                                              • Opcode ID: ebce2893e7386841ed580dde05bc7058577b7e5d5ec03578d12c1ac3e6eaceb6
                                                                                                                                                                                                                                              • Instruction ID: c07bbeaf650d441d91a209648fe9c840a0edf41784540298f68de250dfa624a5
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: ebce2893e7386841ed580dde05bc7058577b7e5d5ec03578d12c1ac3e6eaceb6
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: B8318162A0CE5A85E721AF9598413BE6EE1AB93FBCF510135DA2D833D2CF7CA4418710
                                                                                                                                                                                                                                              Function 00007FF619BD8B11 Relevance: 1.6, APIs: 1, Instructions: 61COMMON
                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 00000001.00000002.1895497148.00007FF619BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF619BC0000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 00000001.00000002.1895473888.00007FF619BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000001.00000002.1895544098.00007FF619BEA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000001.00000002.1895573832.00007FF619BFD000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000001.00000002.1895573832.00007FF619C00000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000001.00000002.1895573832.00007FF619C0C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000001.00000002.1895651091.00007FF619C0E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_1_2_7ff619bc0000_NEVER OPEN!.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: HandleModule$AddressFreeLibraryProc
                                                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                                                              • API String ID: 3947729631-0
                                                                                                                                                                                                                                              • Opcode ID: e6c24619f5215b83aec1ea87e649774fc018db111b87a8e2cbcec198033a6ec0
                                                                                                                                                                                                                                              • Instruction ID: 6d2384c23373d68932896313a508a179c582fc7f46f004c61caea263d52f2320
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: e6c24619f5215b83aec1ea87e649774fc018db111b87a8e2cbcec198033a6ec0
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: E3218DB2A05B4A8AEB658F64D4402AD33B0EB05B3DF080635D61D86BC5DF38D484C745
                                                                                                                                                                                                                                              Function 00007FF619BD5278 Relevance: 1.6, APIs: 1, Instructions: 55COMMON
                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 00000001.00000002.1895497148.00007FF619BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF619BC0000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 00000001.00000002.1895473888.00007FF619BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000001.00000002.1895544098.00007FF619BEA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000001.00000002.1895573832.00007FF619BFD000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000001.00000002.1895573832.00007FF619C00000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000001.00000002.1895573832.00007FF619C0C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000001.00000002.1895651091.00007FF619C0E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_1_2_7ff619bc0000_NEVER OPEN!.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: _invalid_parameter_noinfo
                                                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                                                              • API String ID: 3215553584-0
                                                                                                                                                                                                                                              • Opcode ID: e2d81e48737d2b9edbd67630313f86d574e33faf5878dae4ee8aa738ebab6973
                                                                                                                                                                                                                                              • Instruction ID: f4f9aab4e58d8cf539df32a8af3098b44006588f1e9b7427fe1ae91b0dea30b8
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: e2d81e48737d2b9edbd67630313f86d574e33faf5878dae4ee8aa738ebab6973
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 1511A822A1DE4981EA709F5194001BFA2E4BF97FACF544031EA4C97789DFBCD5418700
                                                                                                                                                                                                                                              Function 00007FF619BE567C Relevance: 1.6, APIs: 1, Instructions: 54COMMON
                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 00000001.00000002.1895497148.00007FF619BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF619BC0000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 00000001.00000002.1895473888.00007FF619BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000001.00000002.1895544098.00007FF619BEA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000001.00000002.1895573832.00007FF619BFD000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000001.00000002.1895573832.00007FF619C00000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000001.00000002.1895573832.00007FF619C0C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000001.00000002.1895651091.00007FF619C0E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_1_2_7ff619bc0000_NEVER OPEN!.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: _invalid_parameter_noinfo
                                                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                                                              • API String ID: 3215553584-0
                                                                                                                                                                                                                                              • Opcode ID: 60d9f9acc7225305b8a94005220afb75f792b29590b70391da89a6fb11ac5e62
                                                                                                                                                                                                                                              • Instruction ID: 886555cb7e01fd75d45fef2576f53b0a51c75971e0181341a2ec3b9609166485
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 60d9f9acc7225305b8a94005220afb75f792b29590b70391da89a6fb11ac5e62
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: FE216232A08E8687DB718F19D44037A77A4EB96FA8F244234E69DC76D5EF7CD8118B00
                                                                                                                                                                                                                                              Function 00007FF619BCF538 Relevance: 1.5, APIs: 1, Instructions: 48COMMONLIBRARYCODE
                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 00000001.00000002.1895497148.00007FF619BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF619BC0000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 00000001.00000002.1895473888.00007FF619BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000001.00000002.1895544098.00007FF619BEA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000001.00000002.1895573832.00007FF619BFD000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000001.00000002.1895573832.00007FF619C00000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000001.00000002.1895573832.00007FF619C0C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000001.00000002.1895651091.00007FF619C0E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_1_2_7ff619bc0000_NEVER OPEN!.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: _invalid_parameter_noinfo
                                                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                                                              • API String ID: 3215553584-0
                                                                                                                                                                                                                                              • Opcode ID: e4873d1516dd9c3e810b3a8ea2f1d2e802796ef0a43dc58582891be639f1b00f
                                                                                                                                                                                                                                              • Instruction ID: aa88901b43f0e418dabf74ed051d915edd0659e1b8c1cad65e58eafbbc4eec67
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: e4873d1516dd9c3e810b3a8ea2f1d2e802796ef0a43dc58582891be639f1b00f
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: DF01A161A08F4941EA24DF5299010BAA795BF97FF8F484671EE6C97BD6CE3CE5028300
                                                                                                                                                                                                                                              Function 00007FF619BC7110 Relevance: 1.5, APIs: 1, Instructions: 20libraryCOMMON
                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                                • Part of subcall function 00007FF619BC7990: MultiByteToWideChar.KERNEL32 ref: 00007FF619BC79CA
                                                                                                                                                                                                                                              • LoadLibraryExW.KERNEL32(?,?,00000000,00007FF619BC309E), ref: 00007FF619BC7133
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 00000001.00000002.1895497148.00007FF619BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF619BC0000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 00000001.00000002.1895473888.00007FF619BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000001.00000002.1895544098.00007FF619BEA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000001.00000002.1895573832.00007FF619BFD000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000001.00000002.1895573832.00007FF619C00000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000001.00000002.1895573832.00007FF619C0C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000001.00000002.1895651091.00007FF619C0E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_1_2_7ff619bc0000_NEVER OPEN!.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: ByteCharLibraryLoadMultiWide
                                                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                                                              • API String ID: 2592636585-0
                                                                                                                                                                                                                                              • Opcode ID: 86e05444dea52cf24e0a8a75629ffe08367d238a3557821569fbbd866f944221
                                                                                                                                                                                                                                              • Instruction ID: ce6ff046bab2e7a210b863760b0fab585ea65c97731503f6cc8789dd8d00dcf9
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 86e05444dea52cf24e0a8a75629ffe08367d238a3557821569fbbd866f944221
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 7FE07D12B1454642EF289B67F50507BA2519F4DFD4B089030DF0D43746CC3CC4808A00
                                                                                                                                                                                                                                              Function 00007FF619BDE0E0 Relevance: 1.3, APIs: 1, Instructions: 36memoryCOMMONLIBRARYCODE
                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                              • HeapAlloc.KERNEL32(?,?,00000000,00007FF619BDABF6,?,?,?,00007FF619BD9DBF,?,?,00000000,00007FF619BDA05A), ref: 00007FF619BDE135
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 00000001.00000002.1895497148.00007FF619BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF619BC0000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 00000001.00000002.1895473888.00007FF619BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000001.00000002.1895544098.00007FF619BEA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000001.00000002.1895573832.00007FF619BFD000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000001.00000002.1895573832.00007FF619C00000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000001.00000002.1895573832.00007FF619C0C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000001.00000002.1895651091.00007FF619C0E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_1_2_7ff619bc0000_NEVER OPEN!.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: AllocHeap
                                                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                                                              • API String ID: 4292702814-0
                                                                                                                                                                                                                                              • Opcode ID: a493b6c3a5346acdfb9ba84895edf5a7b56a1aa8e9cf3a29e90864fe141fa411
                                                                                                                                                                                                                                              • Instruction ID: 15b1aea61a953e7123e847d1af8a3dd8ebd75b7fd186bea1c7b156ea6c61a5c9
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: a493b6c3a5346acdfb9ba84895edf5a7b56a1aa8e9cf3a29e90864fe141fa411
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 56F01D64B0AA0F41FF755EA699522B652D55F5AFACF4C5430C90EC63C2ED2CF4808220
                                                                                                                                                                                                                                              Function 00007FF619BDCE50 Relevance: 1.3, APIs: 1, Instructions: 29memoryCOMMONLIBRARYCODE
                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                              • HeapAlloc.KERNEL32(?,?,00000000,00007FF619BD7228,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 00007FF619BDCE8E
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 00000001.00000002.1895497148.00007FF619BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF619BC0000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 00000001.00000002.1895473888.00007FF619BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000001.00000002.1895544098.00007FF619BEA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000001.00000002.1895573832.00007FF619BFD000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000001.00000002.1895573832.00007FF619C00000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000001.00000002.1895573832.00007FF619C0C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000001.00000002.1895651091.00007FF619C0E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_1_2_7ff619bc0000_NEVER OPEN!.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: AllocHeap
                                                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                                                              • API String ID: 4292702814-0
                                                                                                                                                                                                                                              • Opcode ID: 4298054405db4a4a08a5b14e1c0068d3d506bccc87335596e9568cb5352a493e
                                                                                                                                                                                                                                              • Instruction ID: 5f3010667ee3c11cd3ffcb02f797269967a9ac674175cc07c99ccc3558062a2f
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 4298054405db4a4a08a5b14e1c0068d3d506bccc87335596e9568cb5352a493e
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: AEF0F891E09A4A46FA755FA2594527622D45F86FBCF080A30ED2EC63C2DE2CF8818510

                                                                                                                                                                                                                                              Non-executed Functions

                                                                                                                                                                                                                                              Function 00007FF619BC1B90 Relevance: 43.9, APIs: 20, Strings: 5, Instructions: 188windowCOMMON
                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 00000001.00000002.1895497148.00007FF619BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF619BC0000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 00000001.00000002.1895473888.00007FF619BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000001.00000002.1895544098.00007FF619BEA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000001.00000002.1895573832.00007FF619BFD000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000001.00000002.1895573832.00007FF619C00000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000001.00000002.1895573832.00007FF619C0C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000001.00000002.1895651091.00007FF619C0E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_1_2_7ff619bc0000_NEVER OPEN!.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: MessageSend$Window$Create$Move$ObjectSelect$#380BaseClientDialogDrawFontIndirectInfoParametersRectReleaseSystemTextUnits
                                                                                                                                                                                                                                              • String ID: BUTTON$Close$EDIT$Failed to execute script '%ls' due to unhandled exception: %ls$STATIC
                                                                                                                                                                                                                                              • API String ID: 2446303242-1601438679
                                                                                                                                                                                                                                              • Opcode ID: 7ed90ee14006bcd321cd10bdeb934db8782b761a46ad43856a2a4bf3b656c6c9
                                                                                                                                                                                                                                              • Instruction ID: ca8a52d12660aca049709209b9aedf26b9220e32ce1f6b412a9e61f27de32089
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 7ed90ee14006bcd321cd10bdeb934db8782b761a46ad43856a2a4bf3b656c6c9
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: EEA15936208F8587E7248F12E59479AB378F789BA8F504129EB8D43B24CF7DE165CB40
                                                                                                                                                                                                                                              Function 00007FFDFAE4B910 Relevance: 14.4, APIs: 1, Strings: 7, Instructions: 427COMMON
                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 00000001.00000002.1896332214.00007FFDFAE21000.00000040.00000001.01000000.0000001E.sdmp, Offset: 00007FFDFAE20000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 00000001.00000002.1896301415.00007FFDFAE20000.00000002.00000001.01000000.0000001E.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000001.00000002.1896332214.00007FFDFAF73000.00000040.00000001.01000000.0000001E.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000001.00000002.1896332214.00007FFDFAF75000.00000040.00000001.01000000.0000001E.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000001.00000002.1896332214.00007FFDFAF8A000.00000040.00000001.01000000.0000001E.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000001.00000002.1896536596.00007FFDFAF8C000.00000080.00000001.01000000.0000001E.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000001.00000002.1896632509.00007FFDFAF8E000.00000004.00000001.01000000.0000001E.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_1_2_7ffdfae20000_NEVER OPEN!.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: 00007A4519
                                                                                                                                                                                                                                              • String ID: Bad ptr map entry key=%d expected=(%d,%d) got=(%d,%d)$Failed to read ptrmap key=%d$Main freelist: $Page %d is never used$Pointer map page %d is referenced$incremental_vacuum enabled with a max rootpage of zero$max rootpage (%d) disagrees with header (%d)
                                                                                                                                                                                                                                              • API String ID: 817585512-2103957143
                                                                                                                                                                                                                                              • Opcode ID: 251f6f01a16ac9e5c21f8a1c16c7e132cfa95a75d292a56003b84ae9223e1da6
                                                                                                                                                                                                                                              • Instruction ID: ec1ae8f911f5e7cd45ab3a2b3408f4ff52b5de54ae5b56c386814585329e6f10
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 251f6f01a16ac9e5c21f8a1c16c7e132cfa95a75d292a56003b84ae9223e1da6
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 1B12CE36B08B4386FB68DB25E4A4AA933A9FB44754F1401B5DE6E4BAD8CF3DE541C700
                                                                                                                                                                                                                                              Function 00007FFDFAE2E040 Relevance: 14.4, APIs: 2, Strings: 6, Instructions: 399COMMON
                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 00000001.00000002.1896332214.00007FFDFAE21000.00000040.00000001.01000000.0000001E.sdmp, Offset: 00007FFDFAE20000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 00000001.00000002.1896301415.00007FFDFAE20000.00000002.00000001.01000000.0000001E.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000001.00000002.1896332214.00007FFDFAF73000.00000040.00000001.01000000.0000001E.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000001.00000002.1896332214.00007FFDFAF75000.00000040.00000001.01000000.0000001E.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000001.00000002.1896332214.00007FFDFAF8A000.00000040.00000001.01000000.0000001E.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000001.00000002.1896536596.00007FFDFAF8C000.00000080.00000001.01000000.0000001E.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000001.00000002.1896632509.00007FFDFAF8E000.00000004.00000001.01000000.0000001E.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_1_2_7ffdfae20000_NEVER OPEN!.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: 00007A4519
                                                                                                                                                                                                                                              • String ID: abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789$etilqs_$winGetTempname1$winGetTempname2$winGetTempname4$winGetTempname5
                                                                                                                                                                                                                                              • API String ID: 817585512-463513059
                                                                                                                                                                                                                                              • Opcode ID: 55ca4c761acccb335fe6c928deb5115e3ab3591f0641645cddbbf19c717aacf2
                                                                                                                                                                                                                                              • Instruction ID: b2d071cdc4e165b8edf9db5279de57c9b16211e89839c45e2aae38f8d30d5907
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 55ca4c761acccb335fe6c928deb5115e3ab3591f0641645cddbbf19c717aacf2
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: CEE12252F183D647EF0C9B3968219786AD1AB45780F48417AEEBE477D5DE2DB612C300
                                                                                                                                                                                                                                              Function 00007FFDFAFA3048 Relevance: 13.6, APIs: 9, Instructions: 72COMMON
                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 00000001.00000002.1896873012.00007FFDFAFA1000.00000040.00000001.01000000.0000001C.sdmp, Offset: 00007FFDFAFA0000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 00000001.00000002.1896736549.00007FFDFAFA0000.00000002.00000001.01000000.0000001C.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000001.00000002.1896873012.00007FFDFB004000.00000040.00000001.01000000.0000001C.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000001.00000002.1896873012.00007FFDFB053000.00000040.00000001.01000000.0000001C.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000001.00000002.1896873012.00007FFDFB0AC000.00000040.00000001.01000000.0000001C.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000001.00000002.1896873012.00007FFDFB0B1000.00000040.00000001.01000000.0000001C.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000001.00000002.1896873012.00007FFDFB0B4000.00000040.00000001.01000000.0000001C.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000001.00000002.1897409098.00007FFDFB0B5000.00000080.00000001.01000000.0000001C.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000001.00000002.1897449895.00007FFDFB0B7000.00000004.00000001.01000000.0000001C.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_1_2_7ffdfafa0000_NEVER OPEN!.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: 00007A4519ExceptionFilterPresentUnhandled$CaptureContextDebuggerEntryFeatureFunctionLookupProcessorUnwindVirtual
                                                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                                                              • API String ID: 3282304195-0
                                                                                                                                                                                                                                              • Opcode ID: d8a6e0e72b6848609e29a44b0cba3310e6ec791779f206a0b46e58d07e77914d
                                                                                                                                                                                                                                              • Instruction ID: 979202028a924f9f7168d5061993b3b073560e1a8add88324ffb8075823dc63f
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: d8a6e0e72b6848609e29a44b0cba3310e6ec791779f206a0b46e58d07e77914d
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: F9316F76708B818AEB648F60E8507ED7364FB84754F444639EA5E4BAD8DF3CD648C710
                                                                                                                                                                                                                                              Function 00007FFDFAE269A2 Relevance: 12.7, APIs: 2, Strings: 5, Instructions: 488COMMON
                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 00000001.00000002.1896332214.00007FFDFAE21000.00000040.00000001.01000000.0000001E.sdmp, Offset: 00007FFDFAE20000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 00000001.00000002.1896301415.00007FFDFAE20000.00000002.00000001.01000000.0000001E.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000001.00000002.1896332214.00007FFDFAF73000.00000040.00000001.01000000.0000001E.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000001.00000002.1896332214.00007FFDFAF75000.00000040.00000001.01000000.0000001E.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000001.00000002.1896332214.00007FFDFAF8A000.00000040.00000001.01000000.0000001E.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000001.00000002.1896536596.00007FFDFAF8C000.00000080.00000001.01000000.0000001E.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000001.00000002.1896632509.00007FFDFAF8E000.00000004.00000001.01000000.0000001E.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_1_2_7ffdfae20000_NEVER OPEN!.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: 00007A4519
                                                                                                                                                                                                                                              • String ID: 0123456789ABCDEF0123456789abcdef$Inf$NaN$VUUU$gfff
                                                                                                                                                                                                                                              • API String ID: 817585512-2941899328
                                                                                                                                                                                                                                              • Opcode ID: 2b0addb491e6975ac2a53d4f538047f880c2c519e838c2ff8de1762d9b1a5211
                                                                                                                                                                                                                                              • Instruction ID: f593452b514a4f230d1c8644da16438c047c93dda02947504effe9fb39c62e9d
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 2b0addb491e6975ac2a53d4f538047f880c2c519e838c2ff8de1762d9b1a5211
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 95127922F0CAC685E72AAA359560B7A6BE0FF55380F0543B1DE9F576D9DF2EE4418300
                                                                                                                                                                                                                                              Function 00007FF619BC6740 Relevance: 12.4, APIs: 3, Strings: 4, Instructions: 139COMMON
                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                              • GetTempPathW.KERNEL32(?,00000000,?,00007FF619BC670D), ref: 00007FF619BC67DA
                                                                                                                                                                                                                                                • Part of subcall function 00007FF619BC6950: GetEnvironmentVariableW.KERNEL32(00007FF619BC36C7), ref: 00007FF619BC698A
                                                                                                                                                                                                                                                • Part of subcall function 00007FF619BC6950: ExpandEnvironmentStringsW.KERNEL32 ref: 00007FF619BC69A7
                                                                                                                                                                                                                                                • Part of subcall function 00007FF619BD6444: _invalid_parameter_noinfo.LIBCMT ref: 00007FF619BD645D
                                                                                                                                                                                                                                              • SetEnvironmentVariableW.KERNEL32(?,TokenIntegrityLevel), ref: 00007FF619BC6891
                                                                                                                                                                                                                                                • Part of subcall function 00007FF619BC2770: MessageBoxW.USER32 ref: 00007FF619BC2841
                                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 00000001.00000002.1895497148.00007FF619BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF619BC0000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 00000001.00000002.1895473888.00007FF619BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000001.00000002.1895544098.00007FF619BEA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000001.00000002.1895573832.00007FF619BFD000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000001.00000002.1895573832.00007FF619C00000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000001.00000002.1895573832.00007FF619C0C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000001.00000002.1895651091.00007FF619C0E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_1_2_7ff619bc0000_NEVER OPEN!.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: Environment$Variable$ExpandMessagePathStringsTemp_invalid_parameter_noinfo
                                                                                                                                                                                                                                              • String ID: LOADER: Failed to set the TMP environment variable.$TMP$TMP$_MEI%d
                                                                                                                                                                                                                                              • API String ID: 3752271684-1116378104
                                                                                                                                                                                                                                              • Opcode ID: ef977d3fc8ee735caa87217b28a2b5c2727deca2376dfc0d8c2f934af152f63b
                                                                                                                                                                                                                                              • Instruction ID: bc627f719fb61486ee14bd7a8e09b7e88febf44acefa7001768dfca45e61184a
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: ef977d3fc8ee735caa87217b28a2b5c2727deca2376dfc0d8c2f934af152f63b
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: F6518D11B19E4B91FA74EF22A9596BB52859F8BFECF440035ED0EC7797ED2CE4018600
                                                                                                                                                                                                                                              Function 00007FFDFB0C3229 Relevance: 12.3, APIs: 8, Instructions: 251fileCOMMON
                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 00000001.00000002.1897592652.00007FFDFB0C1000.00000040.00000001.01000000.00000018.sdmp, Offset: 00007FFDFB0C0000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 00000001.00000002.1897529155.00007FFDFB0C0000.00000002.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000001.00000002.1897592652.00007FFDFB0CD000.00000040.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000001.00000002.1897592652.00007FFDFB125000.00000040.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000001.00000002.1897592652.00007FFDFB139000.00000040.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000001.00000002.1897592652.00007FFDFB149000.00000040.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000001.00000002.1897592652.00007FFDFB15D000.00000040.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000001.00000002.1897592652.00007FFDFB30C000.00000040.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000001.00000002.1897592652.00007FFDFB30E000.00000040.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000001.00000002.1897592652.00007FFDFB339000.00000040.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000001.00000002.1897592652.00007FFDFB36A000.00000040.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000001.00000002.1897592652.00007FFDFB390000.00000040.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000001.00000002.1897592652.00007FFDFB3DE000.00000040.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000001.00000002.1897592652.00007FFDFB3E4000.00000040.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000001.00000002.1897592652.00007FFDFB3E6000.00000040.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000001.00000002.1897592652.00007FFDFB402000.00000040.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000001.00000002.1897592652.00007FFDFB40F000.00000040.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000001.00000002.1898476615.00007FFDFB413000.00000080.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000001.00000002.1898503424.00007FFDFB414000.00000004.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_1_2_7ffdfb0c0000_NEVER OPEN!.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: ByteCharMultiWide$FileFind$00007ErrorF020FirstLastNext
                                                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                                                              • API String ID: 1171239525-0
                                                                                                                                                                                                                                              • Opcode ID: b84a2f744cee5a13916b1079a4c81b9897484e08d179ab741295abe408a7cb8c
                                                                                                                                                                                                                                              • Instruction ID: af6b11d83ed5c022018b7dc72375ddca3dbe63484b552f889b2742244120df3c
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: b84a2f744cee5a13916b1079a4c81b9897484e08d179ab741295abe408a7cb8c
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: AAB1B522B06A8389EB109F65D464A7967A1FF49BA4F544335DABD837F8EF3CD0458300
                                                                                                                                                                                                                                              Function 00007FF619BCB5CC Relevance: 10.6, APIs: 7, Instructions: 72COMMON
                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 00000001.00000002.1895497148.00007FF619BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF619BC0000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 00000001.00000002.1895473888.00007FF619BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000001.00000002.1895544098.00007FF619BEA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000001.00000002.1895573832.00007FF619BFD000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000001.00000002.1895573832.00007FF619C00000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000001.00000002.1895573832.00007FF619C0C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000001.00000002.1895651091.00007FF619C0E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_1_2_7ff619bc0000_NEVER OPEN!.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: ExceptionFilterPresentUnhandled$CaptureContextDebuggerEntryFeatureFunctionLookupProcessorUnwindVirtual
                                                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                                                              • API String ID: 3140674995-0
                                                                                                                                                                                                                                              • Opcode ID: 6b6968d94bce6e9e5fed0559e23dc5a31b9e8664b1d3bb7900027832e5426e22
                                                                                                                                                                                                                                              • Instruction ID: 956cddf57e913ed4d2ede28bce3e746f0ac4787523eaf0f2847890d8d260f178
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 6b6968d94bce6e9e5fed0559e23dc5a31b9e8664b1d3bb7900027832e5426e22
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: C4315E72608E858AEB708F61E8903EE7365FB85B58F44443ADA4E87B98DF3CD548C710
                                                                                                                                                                                                                                              Function 00007FF619BE4D48 Relevance: 9.3, APIs: 6, Instructions: 334timeCOMMON
                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                              • _get_daylight.LIBCMT ref: 00007FF619BE4D8D
                                                                                                                                                                                                                                                • Part of subcall function 00007FF619BE46E8: _invalid_parameter_noinfo.LIBCMT ref: 00007FF619BE46FC
                                                                                                                                                                                                                                                • Part of subcall function 00007FF619BDA168: RtlFreeHeap.NTDLL(?,?,?,00007FF619BE214A,?,?,?,00007FF619BE2187,?,?,00000000,00007FF619BE2658,?,?,?,00007FF619BE258B), ref: 00007FF619BDA17E
                                                                                                                                                                                                                                                • Part of subcall function 00007FF619BDA168: GetLastError.KERNEL32(?,?,?,00007FF619BE214A,?,?,?,00007FF619BE2187,?,?,00000000,00007FF619BE2658,?,?,?,00007FF619BE258B), ref: 00007FF619BDA188
                                                                                                                                                                                                                                                • Part of subcall function 00007FF619BDA120: IsProcessorFeaturePresent.KERNEL32(?,?,?,?,00007FF619BDA0FE,?,?,?,?,?,00007FF619BD201E), ref: 00007FF619BDA129
                                                                                                                                                                                                                                                • Part of subcall function 00007FF619BDA120: GetCurrentProcess.KERNEL32(?,?,?,?,00007FF619BDA0FE,?,?,?,?,?,00007FF619BD201E), ref: 00007FF619BDA14E
                                                                                                                                                                                                                                              • _get_daylight.LIBCMT ref: 00007FF619BE4D7C
                                                                                                                                                                                                                                                • Part of subcall function 00007FF619BE4748: _invalid_parameter_noinfo.LIBCMT ref: 00007FF619BE475C
                                                                                                                                                                                                                                              • _get_daylight.LIBCMT ref: 00007FF619BE4FF2
                                                                                                                                                                                                                                              • _get_daylight.LIBCMT ref: 00007FF619BE5003
                                                                                                                                                                                                                                              • _get_daylight.LIBCMT ref: 00007FF619BE5014
                                                                                                                                                                                                                                              • GetTimeZoneInformation.KERNEL32(?,?,?,?,?,?,?,?,?,00000000,?,00007FF619BE5254), ref: 00007FF619BE503B
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 00000001.00000002.1895497148.00007FF619BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF619BC0000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 00000001.00000002.1895473888.00007FF619BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000001.00000002.1895544098.00007FF619BEA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000001.00000002.1895573832.00007FF619BFD000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000001.00000002.1895573832.00007FF619C00000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000001.00000002.1895573832.00007FF619C0C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000001.00000002.1895651091.00007FF619C0E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_1_2_7ff619bc0000_NEVER OPEN!.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: _get_daylight$_invalid_parameter_noinfo$CurrentErrorFeatureFreeHeapInformationLastPresentProcessProcessorTimeZone
                                                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                                                              • API String ID: 4070488512-0
                                                                                                                                                                                                                                              • Opcode ID: a10900aad7a96b38c43e1e9b9be175578771bd1b5fdf0ff21874bdd1c8ca868d
                                                                                                                                                                                                                                              • Instruction ID: f697bbadb7834df348fb2637d0f95d20f36ca06bf216d9d14a01495711f33e25
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: a10900aad7a96b38c43e1e9b9be175578771bd1b5fdf0ff21874bdd1c8ca868d
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 2FD1B226E08A4646EB30DF27D4501BA77A6EF86FACF444175EA4DC7685DF3CE8418740
                                                                                                                                                                                                                                              Function 00007FF619BD9E30 Relevance: 9.1, APIs: 6, Instructions: 83COMMONLIBRARYCODE
                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 00000001.00000002.1895497148.00007FF619BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF619BC0000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 00000001.00000002.1895473888.00007FF619BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000001.00000002.1895544098.00007FF619BEA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000001.00000002.1895573832.00007FF619BFD000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000001.00000002.1895573832.00007FF619C00000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000001.00000002.1895573832.00007FF619C0C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000001.00000002.1895651091.00007FF619C0E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_1_2_7ff619bc0000_NEVER OPEN!.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: ExceptionFilterUnhandled$CaptureContextDebuggerEntryFunctionLookupPresentUnwindVirtual
                                                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                                                              • API String ID: 1239891234-0
                                                                                                                                                                                                                                              • Opcode ID: 2a5c43df35e99ae67e4cea9ce9060e2489f8be8a1fb54d96256a74953a59f3d3
                                                                                                                                                                                                                                              • Instruction ID: 6e128ac320acbcb63795b66fc8bcb50e2be856c1ffad75328f5f93452a0e98b2
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 2a5c43df35e99ae67e4cea9ce9060e2489f8be8a1fb54d96256a74953a59f3d3
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 1A314F36618F8586DB70CF25E8402AE73A8FB8AB68F540535EA9D83B95DF3CD145CB00
                                                                                                                                                                                                                                              Function 00007FF619BE0CE4 Relevance: 7.8, APIs: 5, Instructions: 282COMMON
                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 00000001.00000002.1895497148.00007FF619BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF619BC0000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 00000001.00000002.1895473888.00007FF619BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000001.00000002.1895544098.00007FF619BEA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000001.00000002.1895573832.00007FF619BFD000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000001.00000002.1895573832.00007FF619C00000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000001.00000002.1895573832.00007FF619C0C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000001.00000002.1895651091.00007FF619C0E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_1_2_7ff619bc0000_NEVER OPEN!.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: FileFindFirst_invalid_parameter_noinfo
                                                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                                                              • API String ID: 2227656907-0
                                                                                                                                                                                                                                              • Opcode ID: c5040cd7ae27f50339136dd8ff71af33038c12289704f345e5cbcc3f2d99bc96
                                                                                                                                                                                                                                              • Instruction ID: 52e0d8e0c873aa7c11c53c77856ef1a7400ecea9afef975d03bf51a04f8758c2
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: c5040cd7ae27f50339136dd8ff71af33038c12289704f345e5cbcc3f2d99bc96
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 7EB19222B1CA9A81EA709F2294106BB6395FB46FFCF544171EE5E87B85DE3CE441C300
                                                                                                                                                                                                                                              Function 00007FF619BE2CC0 Relevance: 7.3, APIs: 3, Strings: 1, Instructions: 329COMMON
                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 00000001.00000002.1895497148.00007FF619BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF619BC0000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 00000001.00000002.1895473888.00007FF619BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000001.00000002.1895544098.00007FF619BEA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000001.00000002.1895573832.00007FF619BFD000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000001.00000002.1895573832.00007FF619C00000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000001.00000002.1895573832.00007FF619C0C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000001.00000002.1895651091.00007FF619C0E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_1_2_7ff619bc0000_NEVER OPEN!.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: memcpy_s
                                                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                                                              • API String ID: 1502251526-3916222277
                                                                                                                                                                                                                                              • Opcode ID: cde1b8b2f6d1160984fe15dbaba42dea7d5925037cfa26e03551a8a86da9f649
                                                                                                                                                                                                                                              • Instruction ID: 27c3592d0e4a8c1d0ebeca0fff7d2a97e990050aef33461fcfd299e76d2ce0e7
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: cde1b8b2f6d1160984fe15dbaba42dea7d5925037cfa26e03551a8a86da9f649
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: EAC1E872B19A8A8BD734CF16E044A6EB795F785B98F458139DB4A83B44DF3CE805CB40
                                                                                                                                                                                                                                              Function 00007FF619BE4FC4 Relevance: 6.1, APIs: 4, Instructions: 143timeCOMMON
                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                              • _get_daylight.LIBCMT ref: 00007FF619BE4FF2
                                                                                                                                                                                                                                                • Part of subcall function 00007FF619BE4748: _invalid_parameter_noinfo.LIBCMT ref: 00007FF619BE475C
                                                                                                                                                                                                                                              • _get_daylight.LIBCMT ref: 00007FF619BE5003
                                                                                                                                                                                                                                                • Part of subcall function 00007FF619BE46E8: _invalid_parameter_noinfo.LIBCMT ref: 00007FF619BE46FC
                                                                                                                                                                                                                                              • _get_daylight.LIBCMT ref: 00007FF619BE5014
                                                                                                                                                                                                                                                • Part of subcall function 00007FF619BE4718: _invalid_parameter_noinfo.LIBCMT ref: 00007FF619BE472C
                                                                                                                                                                                                                                                • Part of subcall function 00007FF619BDA168: RtlFreeHeap.NTDLL(?,?,?,00007FF619BE214A,?,?,?,00007FF619BE2187,?,?,00000000,00007FF619BE2658,?,?,?,00007FF619BE258B), ref: 00007FF619BDA17E
                                                                                                                                                                                                                                                • Part of subcall function 00007FF619BDA168: GetLastError.KERNEL32(?,?,?,00007FF619BE214A,?,?,?,00007FF619BE2187,?,?,00000000,00007FF619BE2658,?,?,?,00007FF619BE258B), ref: 00007FF619BDA188
                                                                                                                                                                                                                                              • GetTimeZoneInformation.KERNEL32(?,?,?,?,?,?,?,?,?,00000000,?,00007FF619BE5254), ref: 00007FF619BE503B
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 00000001.00000002.1895497148.00007FF619BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF619BC0000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 00000001.00000002.1895473888.00007FF619BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000001.00000002.1895544098.00007FF619BEA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000001.00000002.1895573832.00007FF619BFD000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000001.00000002.1895573832.00007FF619C00000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000001.00000002.1895573832.00007FF619C0C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000001.00000002.1895651091.00007FF619C0E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_1_2_7ff619bc0000_NEVER OPEN!.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: _get_daylight_invalid_parameter_noinfo$ErrorFreeHeapInformationLastTimeZone
                                                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                                                              • API String ID: 3458911817-0
                                                                                                                                                                                                                                              • Opcode ID: bd0d0fc37b9d07779e90ae88043e28c1bcb3e15d2b7f76286a9c504742db3b63
                                                                                                                                                                                                                                              • Instruction ID: 8d5359132c255d671d28050544184ce2dd591aa59bd9cead0e30a92fb6e013fa
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: bd0d0fc37b9d07779e90ae88043e28c1bcb3e15d2b7f76286a9c504742db3b63
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: F8517036E08B4686E720DF26E8815BA7765FB8AF6CF444175EA4DC3696DF3CE4408740
                                                                                                                                                                                                                                              Function 00007FF619BC3DD0 Relevance: 291.0, APIs: 55, Strings: 111, Instructions: 457libraryloaderCOMMON
                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 00000001.00000002.1895497148.00007FF619BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF619BC0000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 00000001.00000002.1895473888.00007FF619BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000001.00000002.1895544098.00007FF619BEA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000001.00000002.1895573832.00007FF619BFD000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000001.00000002.1895573832.00007FF619C00000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000001.00000002.1895573832.00007FF619C0C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000001.00000002.1895651091.00007FF619C0E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_1_2_7ff619bc0000_NEVER OPEN!.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: AddressProc
                                                                                                                                                                                                                                              • String ID: Failed to get address for PyDict_GetItemString$Failed to get address for PyErr_Clear$Failed to get address for PyErr_Fetch$Failed to get address for PyErr_NormalizeException$Failed to get address for PyErr_Occurred$Failed to get address for PyErr_Print$Failed to get address for PyErr_Restore$Failed to get address for PyEval_EvalCode$Failed to get address for PyImport_AddModule$Failed to get address for PyImport_ExecCodeModule$Failed to get address for PyImport_ImportModule$Failed to get address for PyList_Append$Failed to get address for PyList_New$Failed to get address for PyLong_AsLong$Failed to get address for PyMarshal_ReadObjectFromString$Failed to get address for PyMem_RawFree$Failed to get address for PyModule_GetDict$Failed to get address for PyObject_CallFunction$Failed to get address for PyObject_CallFunctionObjArgs$Failed to get address for PyObject_GetAttrString$Failed to get address for PyObject_SetAttrString$Failed to get address for PyObject_Str$Failed to get address for PyRun_SimpleStringFlags$Failed to get address for PySys_AddWarnOption$Failed to get address for PySys_GetObject$Failed to get address for PySys_SetArgvEx$Failed to get address for PySys_SetObject$Failed to get address for PySys_SetPath$Failed to get address for PyUnicode_AsUTF8$Failed to get address for PyUnicode_Decode$Failed to get address for PyUnicode_DecodeFSDefault$Failed to get address for PyUnicode_FromFormat$Failed to get address for PyUnicode_FromString$Failed to get address for PyUnicode_Join$Failed to get address for PyUnicode_Replace$Failed to get address for Py_BuildValue$Failed to get address for Py_DecRef$Failed to get address for Py_DecodeLocale$Failed to get address for Py_DontWriteBytecodeFlag$Failed to get address for Py_FileSystemDefaultEncoding$Failed to get address for Py_Finalize$Failed to get address for Py_FrozenFlag$Failed to get address for Py_GetPath$Failed to get address for Py_IgnoreEnvironmentFlag$Failed to get address for Py_IncRef$Failed to get address for Py_Initialize$Failed to get address for Py_NoSiteFlag$Failed to get address for Py_NoUserSiteDirectory$Failed to get address for Py_OptimizeFlag$Failed to get address for Py_SetPath$Failed to get address for Py_SetProgramName$Failed to get address for Py_SetPythonHome$Failed to get address for Py_UTF8Mode$Failed to get address for Py_UnbufferedStdioFlag$Failed to get address for Py_VerboseFlag$GetProcAddress$PyDict_GetItemString$PyErr_Clear$PyErr_Fetch$PyErr_NormalizeException$PyErr_Occurred$PyErr_Print$PyErr_Restore$PyEval_EvalCode$PyImport_AddModule$PyImport_ExecCodeModule$PyImport_ImportModule$PyList_Append$PyList_New$PyLong_AsLong$PyMarshal_ReadObjectFromString$PyMem_RawFree$PyModule_GetDict$PyObject_CallFunction$PyObject_CallFunctionObjArgs$PyObject_GetAttrString$PyObject_SetAttrString$PyObject_Str$PyRun_SimpleStringFlags$PySys_AddWarnOption$PySys_GetObject$PySys_SetArgvEx$PySys_SetObject$PySys_SetPath$PyUnicode_AsUTF8$PyUnicode_Decode$PyUnicode_DecodeFSDefault$PyUnicode_FromFormat$PyUnicode_FromString$PyUnicode_Join$PyUnicode_Replace$Py_BuildValue$Py_DecRef$Py_DecodeLocale$Py_DontWriteBytecodeFlag$Py_FileSystemDefaultEncoding$Py_Finalize$Py_FrozenFlag$Py_GetPath$Py_IgnoreEnvironmentFlag$Py_IncRef$Py_Initialize$Py_NoSiteFlag$Py_NoUserSiteDirectory$Py_OptimizeFlag$Py_SetPath$Py_SetProgramName$Py_SetPythonHome$Py_UTF8Mode$Py_UnbufferedStdioFlag$Py_VerboseFlag
                                                                                                                                                                                                                                              • API String ID: 190572456-3109299426
                                                                                                                                                                                                                                              • Opcode ID: 7d3d92c3fb4b4818ef88af2979818605c477eb2c491dbc0430b532d63662b789
                                                                                                                                                                                                                                              • Instruction ID: 2d85f2adfc47572b6307bf6d64679233a8973931b3eee965231d49ae1e94e59c
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 7d3d92c3fb4b4818ef88af2979818605c477eb2c491dbc0430b532d63662b789
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: D1429864A0EF1F91FA35DF06A85017623A9AF4AFBCB945075C81EC63A4EF7CB644D210
                                                                                                                                                                                                                                              Function 00007FF619BC55B0 Relevance: 166.5, APIs: 31, Strings: 64, Instructions: 287libraryloaderCOMMON
                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 00000001.00000002.1895497148.00007FF619BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF619BC0000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 00000001.00000002.1895473888.00007FF619BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000001.00000002.1895544098.00007FF619BEA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000001.00000002.1895573832.00007FF619BFD000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000001.00000002.1895573832.00007FF619C00000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000001.00000002.1895573832.00007FF619C0C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000001.00000002.1895651091.00007FF619C0E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_1_2_7ff619bc0000_NEVER OPEN!.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: AddressProc$LibraryLoad
                                                                                                                                                                                                                                              • String ID: Failed to get address for Tcl_Alloc$Failed to get address for Tcl_ConditionFinalize$Failed to get address for Tcl_ConditionNotify$Failed to get address for Tcl_ConditionWait$Failed to get address for Tcl_CreateInterp$Failed to get address for Tcl_CreateObjCommand$Failed to get address for Tcl_CreateThread$Failed to get address for Tcl_DeleteInterp$Failed to get address for Tcl_DoOneEvent$Failed to get address for Tcl_EvalEx$Failed to get address for Tcl_EvalFile$Failed to get address for Tcl_EvalObjv$Failed to get address for Tcl_Finalize$Failed to get address for Tcl_FinalizeThread$Failed to get address for Tcl_FindExecutable$Failed to get address for Tcl_Free$Failed to get address for Tcl_GetCurrentThread$Failed to get address for Tcl_GetObjResult$Failed to get address for Tcl_GetString$Failed to get address for Tcl_GetVar2$Failed to get address for Tcl_Init$Failed to get address for Tcl_MutexLock$Failed to get address for Tcl_MutexUnlock$Failed to get address for Tcl_NewByteArrayObj$Failed to get address for Tcl_NewStringObj$Failed to get address for Tcl_SetVar2$Failed to get address for Tcl_SetVar2Ex$Failed to get address for Tcl_ThreadAlert$Failed to get address for Tcl_ThreadQueueEvent$Failed to get address for Tk_GetNumMainWindows$Failed to get address for Tk_Init$GetProcAddress$LOADER: Failed to load tcl/tk libraries$Tcl_Alloc$Tcl_ConditionFinalize$Tcl_ConditionNotify$Tcl_ConditionWait$Tcl_CreateInterp$Tcl_CreateObjCommand$Tcl_CreateThread$Tcl_DeleteInterp$Tcl_DoOneEvent$Tcl_EvalEx$Tcl_EvalFile$Tcl_EvalObjv$Tcl_Finalize$Tcl_FinalizeThread$Tcl_FindExecutable$Tcl_Free$Tcl_GetCurrentThread$Tcl_GetObjResult$Tcl_GetString$Tcl_GetVar2$Tcl_Init$Tcl_MutexLock$Tcl_MutexUnlock$Tcl_NewByteArrayObj$Tcl_NewStringObj$Tcl_SetVar2$Tcl_SetVar2Ex$Tcl_ThreadAlert$Tcl_ThreadQueueEvent$Tk_GetNumMainWindows$Tk_Init
                                                                                                                                                                                                                                              • API String ID: 2238633743-1453502826
                                                                                                                                                                                                                                              • Opcode ID: 45e68652b3cd2763e61bf8c7b4b9299d96d60ba340caa4760d9ec6d98f32a26d
                                                                                                                                                                                                                                              • Instruction ID: 7dade8275fa92090aafe1193fd658dfaeaf3b1f2d767258a86b34f9a80d001b6
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 45e68652b3cd2763e61bf8c7b4b9299d96d60ba340caa4760d9ec6d98f32a26d
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 89E1ABA4E0DF0B90FA39CF1AA85417623B9AF06FA8F985175D85DC6794EFBCB544C200
                                                                                                                                                                                                                                              Function 00007FFDFB273F10 Relevance: 58.0, APIs: 19, Strings: 14, Instructions: 223COMMON
                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                              • 00007FFE1FFB5630.API-MS-WIN-CRT-STRING-L1-1-0(00000000,00007FFDFB274B53,?,?,?,?,?,?,?,?,00007FFDFB272B8B), ref: 00007FFDFB273F61
                                                                                                                                                                                                                                              • 00007FFE1FFB5630.API-MS-WIN-CRT-STRING-L1-1-0(00000000,00007FFDFB274B53,?,?,?,?,?,?,?,?,00007FFDFB272B8B), ref: 00007FFDFB273F78
                                                                                                                                                                                                                                              • 00007FFE1FFB5630.API-MS-WIN-CRT-STRING-L1-1-0(00000000,00007FFDFB274B53,?,?,?,?,?,?,?,?,00007FFDFB272B8B), ref: 00007FFDFB273F8F
                                                                                                                                                                                                                                              • 00007FFE1FFB5630.API-MS-WIN-CRT-STRING-L1-1-0(00000000,00007FFDFB274B53,?,?,?,?,?,?,?,?,00007FFDFB272B8B), ref: 00007FFDFB273FC2
                                                                                                                                                                                                                                              • 00007FFE1FFB5630.API-MS-WIN-CRT-STRING-L1-1-0(00000000,00007FFDFB274B53,?,?,?,?,?,?,?,?,00007FFDFB272B8B), ref: 00007FFDFB27400B
                                                                                                                                                                                                                                              • 00007FFE1FFB5630.API-MS-WIN-CRT-STRING-L1-1-0(00000000,00007FFDFB274B53,?,?,?,?,?,?,?,?,00007FFDFB272B8B), ref: 00007FFDFB27403F
                                                                                                                                                                                                                                              • 00007FFE1FFB5630.API-MS-WIN-CRT-STRING-L1-1-0(00000000,00007FFDFB274B53,?,?,?,?,?,?,?,?,00007FFDFB272B8B), ref: 00007FFDFB274091
                                                                                                                                                                                                                                              • 00007FFE1FFB5630.API-MS-WIN-CRT-STRING-L1-1-0(00000000,00007FFDFB274B53,?,?,?,?,?,?,?,?,00007FFDFB272B8B), ref: 00007FFDFB2740A4
                                                                                                                                                                                                                                              • 00007FFE1FFB5630.API-MS-WIN-CRT-STRING-L1-1-0(00000000,00007FFDFB274B53,?,?,?,?,?,?,?,?,00007FFDFB272B8B), ref: 00007FFDFB2740BB
                                                                                                                                                                                                                                              • 00007FFE1FFB5630.API-MS-WIN-CRT-STRING-L1-1-0(00000000,00007FFDFB274B53,?,?,?,?,?,?,?,?,00007FFDFB272B8B), ref: 00007FFDFB2740CE
                                                                                                                                                                                                                                              • 00007FFE1FFB5630.API-MS-WIN-CRT-STRING-L1-1-0(00000000,00007FFDFB274B53,?,?,?,?,?,?,?,?,00007FFDFB272B8B), ref: 00007FFDFB2740E5
                                                                                                                                                                                                                                              • 00007FFE1FFB5630.API-MS-WIN-CRT-STRING-L1-1-0(00000000,00007FFDFB274B53,?,?,?,?,?,?,?,?,00007FFDFB272B8B), ref: 00007FFDFB2740F8
                                                                                                                                                                                                                                              • 00007FFE1FFB5630.API-MS-WIN-CRT-STRING-L1-1-0(00000000,00007FFDFB274B53,?,?,?,?,?,?,?,?,00007FFDFB272B8B), ref: 00007FFDFB27410F
                                                                                                                                                                                                                                              • 00007FFE1FFB5630.API-MS-WIN-CRT-STRING-L1-1-0(00000000,00007FFDFB274B53,?,?,?,?,?,?,?,?,00007FFDFB272B8B), ref: 00007FFDFB274122
                                                                                                                                                                                                                                              • 00007FFE1FFB5630.API-MS-WIN-CRT-STRING-L1-1-0(00000000,00007FFDFB274B53,?,?,?,?,?,?,?,?,00007FFDFB272B8B), ref: 00007FFDFB274135
                                                                                                                                                                                                                                              • 00007FFE1FFB5630.API-MS-WIN-CRT-STRING-L1-1-0(00000000,00007FFDFB274B53,?,?,?,?,?,?,?,?,00007FFDFB272B8B), ref: 00007FFDFB274148
                                                                                                                                                                                                                                              • 00007FFE1FFB5630.API-MS-WIN-CRT-STRING-L1-1-0(00000000,00007FFDFB274B53,?,?,?,?,?,?,?,?,00007FFDFB272B8B), ref: 00007FFDFB27415B
                                                                                                                                                                                                                                              • 00007FFE1FFB5630.API-MS-WIN-CRT-STRING-L1-1-0(00000000,00007FFDFB274B53,?,?,?,?,?,?,?,?,00007FFDFB272B8B), ref: 00007FFDFB2741A7
                                                                                                                                                                                                                                              • 00007FFE1FFB5630.API-MS-WIN-CRT-STRING-L1-1-0(00000000,00007FFDFB274B53,?,?,?,?,?,?,?,?,00007FFDFB272B8B), ref: 00007FFDFB2741D2
                                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 00000001.00000002.1897592652.00007FFDFB15D000.00000040.00000001.01000000.00000018.sdmp, Offset: 00007FFDFB0C0000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 00000001.00000002.1897529155.00007FFDFB0C0000.00000002.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000001.00000002.1897592652.00007FFDFB0C1000.00000040.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000001.00000002.1897592652.00007FFDFB0CD000.00000040.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000001.00000002.1897592652.00007FFDFB125000.00000040.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000001.00000002.1897592652.00007FFDFB139000.00000040.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000001.00000002.1897592652.00007FFDFB149000.00000040.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000001.00000002.1897592652.00007FFDFB30C000.00000040.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000001.00000002.1897592652.00007FFDFB30E000.00000040.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000001.00000002.1897592652.00007FFDFB339000.00000040.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000001.00000002.1897592652.00007FFDFB36A000.00000040.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000001.00000002.1897592652.00007FFDFB390000.00000040.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000001.00000002.1897592652.00007FFDFB3DE000.00000040.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000001.00000002.1897592652.00007FFDFB3E4000.00000040.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000001.00000002.1897592652.00007FFDFB3E6000.00000040.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000001.00000002.1897592652.00007FFDFB402000.00000040.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000001.00000002.1897592652.00007FFDFB40F000.00000040.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000001.00000002.1898476615.00007FFDFB413000.00000080.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000001.00000002.1898503424.00007FFDFB414000.00000004.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_1_2_7ffdfb0c0000_NEVER OPEN!.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: 00007B5630
                                                                                                                                                                                                                                              • String ID: ANY PRIVATE KEY$CERTIFICATE$CERTIFICATE REQUEST$CMS$DH PARAMETERS$ENCRYPTED PRIVATE KEY$NEW CERTIFICATE REQUEST$PARAMETERS$PKCS #7 SIGNED DATA$PKCS7$PRIVATE KEY$TRUSTED CERTIFICATE$X509 CERTIFICATE$X9.42 DH PARAMETERS
                                                                                                                                                                                                                                              • API String ID: 2248877218-1119032718
                                                                                                                                                                                                                                              • Opcode ID: 53791607f956101f911f03bce5df1fcc48f1ca8588c3d50ca4fb3c9ab6ede07a
                                                                                                                                                                                                                                              • Instruction ID: 28b7de9c39eb919dd072d08f0239557a20dfdd7f222d59207967c111bf77a32c
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 53791607f956101f911f03bce5df1fcc48f1ca8588c3d50ca4fb3c9ab6ede07a
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 6B91DE10B8E65392FF50AB25A972A7827D1DF567E4F682130DC7EC22FDEE2CE4418204
                                                                                                                                                                                                                                              Function 00007FF619BC1440 Relevance: 21.1, APIs: 1, Strings: 11, Instructions: 133COMMON
                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 00000001.00000002.1895497148.00007FF619BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF619BC0000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 00000001.00000002.1895473888.00007FF619BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000001.00000002.1895544098.00007FF619BEA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000001.00000002.1895573832.00007FF619BFD000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000001.00000002.1895573832.00007FF619C00000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000001.00000002.1895573832.00007FF619C0C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000001.00000002.1895651091.00007FF619C0E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_1_2_7ff619bc0000_NEVER OPEN!.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID:
                                                                                                                                                                                                                                              • String ID: Failed to extract %s: failed to allocate temporary buffer!$Failed to extract %s: failed to open archive file!$Failed to extract %s: failed to open target file!$Failed to extract %s: failed to read data chunk!$Failed to extract %s: failed to seek to the entry's data!$Failed to extract %s: failed to write data chunk!$fopen$fread$fseek$fwrite$malloc
                                                                                                                                                                                                                                              • API String ID: 0-666925554
                                                                                                                                                                                                                                              • Opcode ID: 170cb52023df456c44bda0a70705577985198cda3e1c9506cf54fa61a39d526b
                                                                                                                                                                                                                                              • Instruction ID: 687723bf93e0500b03d79112e5f53b9622437929502537de11c8aff22248a1d6
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 170cb52023df456c44bda0a70705577985198cda3e1c9506cf54fa61a39d526b
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 88518861B08E4A91EA30DF12E4446BB63A8BF47FBCF844535EE1D97696EE3CE5458300
                                                                                                                                                                                                                                              Function 00007FF619BC7800 Relevance: 21.1, APIs: 10, Strings: 2, Instructions: 91COMMON
                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 00000001.00000002.1895497148.00007FF619BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF619BC0000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 00000001.00000002.1895473888.00007FF619BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000001.00000002.1895544098.00007FF619BEA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000001.00000002.1895573832.00007FF619BFD000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000001.00000002.1895573832.00007FF619C00000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000001.00000002.1895573832.00007FF619C0C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000001.00000002.1895651091.00007FF619C0E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_1_2_7ff619bc0000_NEVER OPEN!.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: Token$ConvertDescriptorInformationProcessSecurityString$CloseCreateCurrentDirectoryErrorFreeHandleLastLocalOpen
                                                                                                                                                                                                                                              • String ID: D:(A;;FA;;;%s)$S-1-3-4
                                                                                                                                                                                                                                              • API String ID: 4998090-2855260032
                                                                                                                                                                                                                                              • Opcode ID: 6591b1212da81ebedb1b6999a7ad6cd934ab4383e2d97f6c3f94acd8b2e06d7e
                                                                                                                                                                                                                                              • Instruction ID: fcae61e60a318dc9f66ab40b006f0cf64e8ce66a5f0bbea6566f34b5ec5c56f7
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 6591b1212da81ebedb1b6999a7ad6cd934ab4383e2d97f6c3f94acd8b2e06d7e
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: DB415331A1CE4A82EB609F15E4946AB7365FF86FA8F440231EA5E876D5DF7CD448C700
                                                                                                                                                                                                                                              Function 00007FFDFAE98320 Relevance: 17.9, APIs: 1, Strings: 9, Instructions: 382COMMON
                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 00000001.00000002.1896332214.00007FFDFAE21000.00000040.00000001.01000000.0000001E.sdmp, Offset: 00007FFDFAE20000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 00000001.00000002.1896301415.00007FFDFAE20000.00000002.00000001.01000000.0000001E.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000001.00000002.1896332214.00007FFDFAF73000.00000040.00000001.01000000.0000001E.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000001.00000002.1896332214.00007FFDFAF75000.00000040.00000001.01000000.0000001E.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000001.00000002.1896332214.00007FFDFAF8A000.00000040.00000001.01000000.0000001E.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000001.00000002.1896536596.00007FFDFAF8C000.00000080.00000001.01000000.0000001E.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000001.00000002.1896632509.00007FFDFAF8E000.00000004.00000001.01000000.0000001E.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_1_2_7ffdfae20000_NEVER OPEN!.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID:
                                                                                                                                                                                                                                              • String ID: %s.%s$_init$error during initialization: %s$lib$no entry point [%s] in shared library [%s]$not authorized$sqlite3_$sqlite3_extension_init$unable to open shared library [%.*s]
                                                                                                                                                                                                                                              • API String ID: 0-3733955532
                                                                                                                                                                                                                                              • Opcode ID: 14e72df4e1fb573e2e53d0402c04a82d85459793cd7fb74fe859ebaa4dc29cd4
                                                                                                                                                                                                                                              • Instruction ID: d2c8c57ba7357589cd05d0b90b71d3eb6b95c3d4820f1222ff8a59a88a2d0104
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 14e72df4e1fb573e2e53d0402c04a82d85459793cd7fb74fe859ebaa4dc29cd4
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 89028321B09B8285EB5CAB11A874BB923A4EF49B98F4446B5DD7F467E8DF2DF444C300
                                                                                                                                                                                                                                              Function 00007FF619BC2030 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 120COMMON
                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 00000001.00000002.1895497148.00007FF619BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF619BC0000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 00000001.00000002.1895473888.00007FF619BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000001.00000002.1895544098.00007FF619BEA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000001.00000002.1895573832.00007FF619BFD000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000001.00000002.1895573832.00007FF619C00000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000001.00000002.1895573832.00007FF619C0C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000001.00000002.1895651091.00007FF619C0E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_1_2_7ff619bc0000_NEVER OPEN!.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: MoveWindow$ObjectSelect$DrawReleaseText
                                                                                                                                                                                                                                              • String ID: P%
                                                                                                                                                                                                                                              • API String ID: 2147705588-2959514604
                                                                                                                                                                                                                                              • Opcode ID: 6cf46cb85abbdff361c8f4f8800dc6b6c327d34febef624f12cf28668e06a053
                                                                                                                                                                                                                                              • Instruction ID: a531cc044e1811028c34cc6b56f45bc2fb7d1f3e62d752cd3a53c95b5f3a966e
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 6cf46cb85abbdff361c8f4f8800dc6b6c327d34febef624f12cf28668e06a053
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 6651F326608BA187D6349F26E4181BBB7A1FB99F69F004125EBCF83685DF3CD045DB10
                                                                                                                                                                                                                                              Function 00007FFDFAFA2720 Relevance: 16.7, APIs: 11, Instructions: 230COMMON
                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 00000001.00000002.1896873012.00007FFDFAFA1000.00000040.00000001.01000000.0000001C.sdmp, Offset: 00007FFDFAFA0000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 00000001.00000002.1896736549.00007FFDFAFA0000.00000002.00000001.01000000.0000001C.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000001.00000002.1896873012.00007FFDFB004000.00000040.00000001.01000000.0000001C.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000001.00000002.1896873012.00007FFDFB053000.00000040.00000001.01000000.0000001C.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000001.00000002.1896873012.00007FFDFB0AC000.00000040.00000001.01000000.0000001C.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000001.00000002.1896873012.00007FFDFB0B1000.00000040.00000001.01000000.0000001C.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000001.00000002.1896873012.00007FFDFB0B4000.00000040.00000001.01000000.0000001C.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000001.00000002.1897409098.00007FFDFB0B5000.00000080.00000001.01000000.0000001C.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000001.00000002.1897449895.00007FFDFB0B7000.00000004.00000001.01000000.0000001C.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_1_2_7ffdfafa0000_NEVER OPEN!.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: Initialize__scrt_acquire_startup_lock__scrt_dllmain_after_initialize_c__scrt_dllmain_crt_thread_attach__scrt_initialize_crt__scrt_release_startup_lock
                                                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                                                              • API String ID: 349153199-0
                                                                                                                                                                                                                                              • Opcode ID: 2c919d68a485a940d5d0ad5c103bd88b2e133b3e89e7b4880588334ffb64ee24
                                                                                                                                                                                                                                              • Instruction ID: b8e5a426af274a3c758c327e28a41c747d6908a9d25e7ae8c438569fd16983e0
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 2c919d68a485a940d5d0ad5c103bd88b2e133b3e89e7b4880588334ffb64ee24
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 17818E20F1824346F75C9B259461AF96290AFC5BA0F1482B5F96D8F2FEDE3CE541A600
                                                                                                                                                                                                                                              Function 00007FFDFAE5F160 Relevance: 16.2, APIs: 1, Strings: 8, Instructions: 487COMMON
                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 00000001.00000002.1896332214.00007FFDFAE21000.00000040.00000001.01000000.0000001E.sdmp, Offset: 00007FFDFAE20000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 00000001.00000002.1896301415.00007FFDFAE20000.00000002.00000001.01000000.0000001E.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000001.00000002.1896332214.00007FFDFAF73000.00000040.00000001.01000000.0000001E.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000001.00000002.1896332214.00007FFDFAF75000.00000040.00000001.01000000.0000001E.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000001.00000002.1896332214.00007FFDFAF8A000.00000040.00000001.01000000.0000001E.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000001.00000002.1896536596.00007FFDFAF8C000.00000080.00000001.01000000.0000001E.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000001.00000002.1896632509.00007FFDFAF8E000.00000004.00000001.01000000.0000001E.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_1_2_7ffdfae20000_NEVER OPEN!.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: 00007A4519
                                                                                                                                                                                                                                              • String ID: cannot open %s column for writing$cannot open table without rowid: %s$cannot open view: %s$cannot open virtual table: %s$foreign key$indexed$no such column: "%s"$out of memory
                                                                                                                                                                                                                                              • API String ID: 817585512-554953066
                                                                                                                                                                                                                                              • Opcode ID: 32bcda7bad469e0d6470e2593a17960b319e70540a0d8b0fa06d935ab4d1dd13
                                                                                                                                                                                                                                              • Instruction ID: 7a4767fc4414d38dcfb0ae41fe6b2287512f948862acd6c8a8cbe988421bdedf
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 32bcda7bad469e0d6470e2593a17960b319e70540a0d8b0fa06d935ab4d1dd13
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 0232BF72B087818AEB58EF25E460ABD37A4FB44B84F404275DE6E87799DF3AE450C710
                                                                                                                                                                                                                                              Function 00007FF619BC7410 Relevance: 15.8, APIs: 3, Strings: 6, Instructions: 52windowCOMMON
                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                              • GetLastError.KERNEL32(00000000,00007FF619BC26A0), ref: 00007FF619BC7437
                                                                                                                                                                                                                                              • FormatMessageW.KERNEL32(00000000,00007FF619BC26A0), ref: 00007FF619BC7466
                                                                                                                                                                                                                                              • WideCharToMultiByte.KERNEL32 ref: 00007FF619BC74BC
                                                                                                                                                                                                                                                • Part of subcall function 00007FF619BC2620: GetLastError.KERNEL32(00000000,00000000,00000000,00007FF619BC76A4,?,?,?,?,?,?,?,?,?,?,?,00007FF619BC101D), ref: 00007FF619BC2654
                                                                                                                                                                                                                                                • Part of subcall function 00007FF619BC2620: MessageBoxW.USER32 ref: 00007FF619BC272C
                                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 00000001.00000002.1895497148.00007FF619BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF619BC0000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 00000001.00000002.1895473888.00007FF619BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000001.00000002.1895544098.00007FF619BEA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000001.00000002.1895573832.00007FF619BFD000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000001.00000002.1895573832.00007FF619C00000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000001.00000002.1895573832.00007FF619C0C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000001.00000002.1895651091.00007FF619C0E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_1_2_7ff619bc0000_NEVER OPEN!.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: ErrorLastMessage$ByteCharFormatMultiWide
                                                                                                                                                                                                                                              • String ID: Failed to encode wchar_t as UTF-8.$FormatMessageW$No error messages generated.$PyInstaller: FormatMessageW failed.$PyInstaller: pyi_win32_utils_to_utf8 failed.$WideCharToMultiByte
                                                                                                                                                                                                                                              • API String ID: 2920928814-2573406579
                                                                                                                                                                                                                                              • Opcode ID: 904cea7669a0d8d992d4f9b78dda1624a08753575e193a6c14212660532e3fc7
                                                                                                                                                                                                                                              • Instruction ID: 4203c6b86ca57d1cd2a048bbb91d93802a0b8fdc2de7b3c0943654f04e058c99
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 904cea7669a0d8d992d4f9b78dda1624a08753575e193a6c14212660532e3fc7
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: C1218031A08E4A92E7709F15EC8426B6769BF8ABACF844135E58DC26A4EF3CE145C700
                                                                                                                                                                                                                                              Function 00007FFDFAE2F070 Relevance: 14.1, APIs: 1, Strings: 7, Instructions: 135COMMON
                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 00000001.00000002.1896332214.00007FFDFAE21000.00000040.00000001.01000000.0000001E.sdmp, Offset: 00007FFDFAE20000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 00000001.00000002.1896301415.00007FFDFAE20000.00000002.00000001.01000000.0000001E.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000001.00000002.1896332214.00007FFDFAF73000.00000040.00000001.01000000.0000001E.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000001.00000002.1896332214.00007FFDFAF75000.00000040.00000001.01000000.0000001E.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000001.00000002.1896332214.00007FFDFAF8A000.00000040.00000001.01000000.0000001E.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000001.00000002.1896536596.00007FFDFAF8C000.00000080.00000001.01000000.0000001E.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000001.00000002.1896632509.00007FFDFAF8E000.00000004.00000001.01000000.0000001E.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_1_2_7ffdfae20000_NEVER OPEN!.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: new[]
                                                                                                                                                                                                                                              • String ID: %s%c%s$:$:$?$\$winFullPathname1$winFullPathname2
                                                                                                                                                                                                                                              • API String ID: 4059295235-3840279414
                                                                                                                                                                                                                                              • Opcode ID: b101e88f1affa16b041cfc1e2f1eca4e78ffadcba296a8941160182071edcd3a
                                                                                                                                                                                                                                              • Instruction ID: 750d4fa3059cac15ef7b91f108e52dc1f96fdb32b6d2e6ef1957e1bc3df852e1
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: b101e88f1affa16b041cfc1e2f1eca4e78ffadcba296a8941160182071edcd3a
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 1A51D022F0C28245FB1DBB61A431EBA66D1AF44B94F4840B6ED6F472DECE3EE4418311
                                                                                                                                                                                                                                              Function 00007FF619BD95C4 Relevance: 12.7, APIs: 3, Strings: 4, Instructions: 489COMMON
                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 00000001.00000002.1895497148.00007FF619BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF619BC0000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 00000001.00000002.1895473888.00007FF619BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000001.00000002.1895544098.00007FF619BEA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000001.00000002.1895573832.00007FF619BFD000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000001.00000002.1895573832.00007FF619C00000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000001.00000002.1895573832.00007FF619C0C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000001.00000002.1895651091.00007FF619C0E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_1_2_7ff619bc0000_NEVER OPEN!.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: _invalid_parameter_noinfo
                                                                                                                                                                                                                                              • String ID: 0$f$p$p
                                                                                                                                                                                                                                              • API String ID: 3215553584-1202675169
                                                                                                                                                                                                                                              • Opcode ID: 216f111ad4c5b66b884b0df32855d232c2f88c8bc1f49e6a12dd5780390dcc5b
                                                                                                                                                                                                                                              • Instruction ID: 46fada16bb23b05e52e6d5072648a8f0e9c46fd62afaf33fd684c88ef37bc0df
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 216f111ad4c5b66b884b0df32855d232c2f88c8bc1f49e6a12dd5780390dcc5b
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 17128E72A0E94B86FB346E1590446BB76D3EB42F6CF884135E69A877C4DF3DE5808B04
                                                                                                                                                                                                                                              Function 00007FF619BCDB60 Relevance: 12.6, APIs: 4, Strings: 3, Instructions: 317COMMON
                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 00000001.00000002.1895497148.00007FF619BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF619BC0000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 00000001.00000002.1895473888.00007FF619BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000001.00000002.1895544098.00007FF619BEA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000001.00000002.1895573832.00007FF619BFD000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000001.00000002.1895573832.00007FF619C00000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000001.00000002.1895573832.00007FF619C0C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000001.00000002.1895651091.00007FF619C0E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_1_2_7ff619bc0000_NEVER OPEN!.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: BlockFrameHandler3::Unwind$CatchExecutionHandlerIs_bad_exception_allowedSearchStatestd::bad_alloc::bad_alloc
                                                                                                                                                                                                                                              • String ID: csm$csm$csm
                                                                                                                                                                                                                                              • API String ID: 849930591-393685449
                                                                                                                                                                                                                                              • Opcode ID: 7137a45c87a1c42c9297b97288d1de501ad69753d3396f0e1b378e006ad8aaa6
                                                                                                                                                                                                                                              • Instruction ID: b8d5c1c1e9e3f3aba019b935acacb75fa33117699fd67146e9f52b42f1350d96
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 7137a45c87a1c42c9297b97288d1de501ad69753d3396f0e1b378e006ad8aaa6
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 1AE15D76A08B4A8AEB309F6594412AF77A0FB96FACF100535EE4D97B55CF38E481C740
                                                                                                                                                                                                                                              Function 00007FF619BDE158 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 117libraryloaderCOMMONLIBRARYCODE
                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                              • FreeLibrary.KERNEL32(?,00000000,?,00007FF619BDE4F6,?,?,-00000018,00007FF619BDA572,?,?,?,00007FF619BDA46A,?,?,?,00007FF619BD5222), ref: 00007FF619BDE2D7
                                                                                                                                                                                                                                              • GetProcAddress.KERNEL32(?,00000000,?,00007FF619BDE4F6,?,?,-00000018,00007FF619BDA572,?,?,?,00007FF619BDA46A,?,?,?,00007FF619BD5222), ref: 00007FF619BDE2E3
                                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 00000001.00000002.1895497148.00007FF619BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF619BC0000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 00000001.00000002.1895473888.00007FF619BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000001.00000002.1895544098.00007FF619BEA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000001.00000002.1895573832.00007FF619BFD000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000001.00000002.1895573832.00007FF619C00000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000001.00000002.1895573832.00007FF619C0C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000001.00000002.1895651091.00007FF619C0E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_1_2_7ff619bc0000_NEVER OPEN!.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: AddressFreeLibraryProc
                                                                                                                                                                                                                                              • String ID: api-ms-$ext-ms-
                                                                                                                                                                                                                                              • API String ID: 3013587201-537541572
                                                                                                                                                                                                                                              • Opcode ID: a2ae2c3a07d48552731a8859b03eb7dfad6cfb60df2b5b495a033224e1b0bc41
                                                                                                                                                                                                                                              • Instruction ID: 07dbb5e25e906787717d6be66f1009551eea7e823806dbe2da8bf113e8d8d1b9
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: a2ae2c3a07d48552731a8859b03eb7dfad6cfb60df2b5b495a033224e1b0bc41
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 7641AD62B19E0A41FA219F5698146A722D6BF4BFFCF084535DD1DCBB88DE3CE4458300
                                                                                                                                                                                                                                              Function 00007FF619BC7560 Relevance: 12.4, APIs: 2, Strings: 5, Instructions: 104COMMON
                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                              • WideCharToMultiByte.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00007FF619BC101D), ref: 00007FF619BC75FF
                                                                                                                                                                                                                                              • WideCharToMultiByte.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00007FF619BC101D), ref: 00007FF619BC764F
                                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 00000001.00000002.1895497148.00007FF619BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF619BC0000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 00000001.00000002.1895473888.00007FF619BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000001.00000002.1895544098.00007FF619BEA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000001.00000002.1895573832.00007FF619BFD000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000001.00000002.1895573832.00007FF619C00000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000001.00000002.1895573832.00007FF619C0C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000001.00000002.1895651091.00007FF619C0E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_1_2_7ff619bc0000_NEVER OPEN!.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: ByteCharMultiWide
                                                                                                                                                                                                                                              • String ID: Failed to encode wchar_t as UTF-8.$Failed to get UTF-8 buffer size.$Out of memory.$WideCharToMultiByte$win32_utils_to_utf8
                                                                                                                                                                                                                                              • API String ID: 626452242-27947307
                                                                                                                                                                                                                                              • Opcode ID: 44bd59f9cbd0c1bab7727675d44fbf1c519c8e5a350bb71af5096b05f54b9704
                                                                                                                                                                                                                                              • Instruction ID: f2edc32fec6c31ce993698a15385ea92125d7e84fc57fbed0d783c4efe3c4f1d
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 44bd59f9cbd0c1bab7727675d44fbf1c519c8e5a350bb71af5096b05f54b9704
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: F8418232A09F8682D6309F16B48016BB7A5FB86FA8F544135EA9DC7B95DF3CE451C700
                                                                                                                                                                                                                                              Function 00007FF619BC6F30 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 93processsynchronizationCOMMON
                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                                • Part of subcall function 00007FF619BC7990: MultiByteToWideChar.KERNEL32 ref: 00007FF619BC79CA
                                                                                                                                                                                                                                                • Part of subcall function 00007FF619BD70F8: SetConsoleCtrlHandler.KERNEL32(?,?,?,?,?,?,?,?,?,?,00000000,00000000,00000000,00007FF619BD9584), ref: 00007FF619BD7165
                                                                                                                                                                                                                                                • Part of subcall function 00007FF619BD70F8: GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,00000000,00000000,00000000,00007FF619BD9584), ref: 00007FF619BD7178
                                                                                                                                                                                                                                              • GetStartupInfoW.KERNEL32 ref: 00007FF619BC6FB7
                                                                                                                                                                                                                                                • Part of subcall function 00007FF619BD94E4: _invalid_parameter_noinfo.LIBCMT ref: 00007FF619BD94F8
                                                                                                                                                                                                                                                • Part of subcall function 00007FF619BD6C88: _invalid_parameter_noinfo.LIBCMT ref: 00007FF619BD6CEF
                                                                                                                                                                                                                                              • GetCommandLineW.KERNEL32 ref: 00007FF619BC703F
                                                                                                                                                                                                                                              • CreateProcessW.KERNEL32 ref: 00007FF619BC7081
                                                                                                                                                                                                                                              • WaitForSingleObject.KERNEL32 ref: 00007FF619BC7095
                                                                                                                                                                                                                                              • GetExitCodeProcess.KERNEL32 ref: 00007FF619BC70A5
                                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 00000001.00000002.1895497148.00007FF619BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF619BC0000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 00000001.00000002.1895473888.00007FF619BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000001.00000002.1895544098.00007FF619BEA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000001.00000002.1895573832.00007FF619BFD000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000001.00000002.1895573832.00007FF619C00000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000001.00000002.1895573832.00007FF619C0C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000001.00000002.1895651091.00007FF619C0E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_1_2_7ff619bc0000_NEVER OPEN!.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: Process_invalid_parameter_noinfo$ByteCharCodeCommandConsoleCreateCtrlErrorExitHandlerInfoLastLineMultiObjectSingleStartupWaitWide
                                                                                                                                                                                                                                              • String ID: CreateProcessW$Error creating child process!
                                                                                                                                                                                                                                              • API String ID: 1742298069-3524285272
                                                                                                                                                                                                                                              • Opcode ID: 1cd61e54566385a94fb47874bd0fcb1c582be0e90f0846e9646c3e9263d15197
                                                                                                                                                                                                                                              • Instruction ID: 58d41b7295ce28464cfe163412b855a86aaf19c28df09c8580679a61382bae16
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 1cd61e54566385a94fb47874bd0fcb1c582be0e90f0846e9646c3e9263d15197
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: A2414331A08A8582D730DF64E4952EBB3A4FB96B68F404139E69D83796DF7CD454CB40
                                                                                                                                                                                                                                              Function 00007FF619BC7AA0 Relevance: 12.3, APIs: 2, Strings: 5, Instructions: 63COMMON
                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                              • WideCharToMultiByte.KERNEL32(?,00007FF619BC3679), ref: 00007FF619BC7AE1
                                                                                                                                                                                                                                                • Part of subcall function 00007FF619BC2620: GetLastError.KERNEL32(00000000,00000000,00000000,00007FF619BC76A4,?,?,?,?,?,?,?,?,?,?,?,00007FF619BC101D), ref: 00007FF619BC2654
                                                                                                                                                                                                                                                • Part of subcall function 00007FF619BC2620: MessageBoxW.USER32 ref: 00007FF619BC272C
                                                                                                                                                                                                                                              • WideCharToMultiByte.KERNEL32(?,00007FF619BC3679), ref: 00007FF619BC7B55
                                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 00000001.00000002.1895497148.00007FF619BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF619BC0000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 00000001.00000002.1895473888.00007FF619BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000001.00000002.1895544098.00007FF619BEA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000001.00000002.1895573832.00007FF619BFD000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000001.00000002.1895573832.00007FF619C00000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000001.00000002.1895573832.00007FF619C0C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000001.00000002.1895651091.00007FF619C0E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_1_2_7ff619bc0000_NEVER OPEN!.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: ByteCharMultiWide$ErrorLastMessage
                                                                                                                                                                                                                                              • String ID: Failed to encode wchar_t as UTF-8.$Failed to get UTF-8 buffer size.$Out of memory.$WideCharToMultiByte$win32_utils_to_utf8
                                                                                                                                                                                                                                              • API String ID: 3723044601-27947307
                                                                                                                                                                                                                                              • Opcode ID: b11e43d7c6d1527cb9d332ac96d423ab1dd5107057e4ee7710d1ce1ad2b4adc8
                                                                                                                                                                                                                                              • Instruction ID: 8c20605ce0b4de4eb702c3aa9be6338f1954107c1a5562abc3ee78a78732f849
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: b11e43d7c6d1527cb9d332ac96d423ab1dd5107057e4ee7710d1ce1ad2b4adc8
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 74216D21A08F4B85EA209F16E89007A77A5AB86FA8F544175DA4DC37A5EF7CE551C300
                                                                                                                                                                                                                                              Function 00007FF619BD010C Relevance: 11.0, APIs: 3, Strings: 3, Instructions: 475COMMON
                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 00000001.00000002.1895497148.00007FF619BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF619BC0000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 00000001.00000002.1895473888.00007FF619BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000001.00000002.1895544098.00007FF619BEA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000001.00000002.1895573832.00007FF619BFD000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000001.00000002.1895573832.00007FF619C00000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000001.00000002.1895573832.00007FF619C0C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000001.00000002.1895651091.00007FF619C0E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_1_2_7ff619bc0000_NEVER OPEN!.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: _invalid_parameter_noinfo
                                                                                                                                                                                                                                              • String ID: f$p$p
                                                                                                                                                                                                                                              • API String ID: 3215553584-1995029353
                                                                                                                                                                                                                                              • Opcode ID: e564e9ffa487f496332ad79a12679e83e89e7590c537cca4c07bc5f1831f7133
                                                                                                                                                                                                                                              • Instruction ID: 2e563d62bcdf8c00dea7d849d9a547cea662337245aaea81fb2367b0163d7990
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: e564e9ffa487f496332ad79a12679e83e89e7590c537cca4c07bc5f1831f7133
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 2012B121E0D94B86FB349E15E0446BB76E2FB52FACF844035E6C9867C4DE3CE9808B51
                                                                                                                                                                                                                                              Function 00007FF619BC7B90 Relevance: 10.6, APIs: 2, Strings: 5, Instructions: 99COMMON
                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 00000001.00000002.1895497148.00007FF619BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF619BC0000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 00000001.00000002.1895473888.00007FF619BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000001.00000002.1895544098.00007FF619BEA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000001.00000002.1895573832.00007FF619BFD000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000001.00000002.1895573832.00007FF619C00000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000001.00000002.1895573832.00007FF619C0C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000001.00000002.1895651091.00007FF619C0E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_1_2_7ff619bc0000_NEVER OPEN!.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: ByteCharMultiWide
                                                                                                                                                                                                                                              • String ID: Failed to decode wchar_t from UTF-8$Failed to get wchar_t buffer size.$MultiByteToWideChar$Out of memory.$win32_utils_from_utf8
                                                                                                                                                                                                                                              • API String ID: 626452242-876015163
                                                                                                                                                                                                                                              • Opcode ID: a181c4653b270c240a20b71774802f78ed29fd61c7b1d57222845c1f55e9839c
                                                                                                                                                                                                                                              • Instruction ID: f4b637a3c3fd1c01599e1f6317e814c9e263bd991277699c19cce6afdace7ceb
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: a181c4653b270c240a20b71774802f78ed29fd61c7b1d57222845c1f55e9839c
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 5A417F32A09F4B82E630DF16A48056B67A5FB46FA8F144135EE9D87BA5DF3CE452C700
                                                                                                                                                                                                                                              Function 00007FF619BC6440 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 88COMMON
                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                                • Part of subcall function 00007FF619BC7990: MultiByteToWideChar.KERNEL32 ref: 00007FF619BC79CA
                                                                                                                                                                                                                                              • ExpandEnvironmentStringsW.KERNEL32(00000000,00007FF619BC678F,?,00000000,?,TokenIntegrityLevel), ref: 00007FF619BC649F
                                                                                                                                                                                                                                                • Part of subcall function 00007FF619BC2770: MessageBoxW.USER32 ref: 00007FF619BC2841
                                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                                              • LOADER: Failed to convert runtime-tmpdir to a wide string., xrefs: 00007FF619BC6476
                                                                                                                                                                                                                                              • LOADER: Failed to expand environment variables in the runtime-tmpdir., xrefs: 00007FF619BC64B3
                                                                                                                                                                                                                                              • LOADER: Failed to obtain the absolute path of the runtime-tmpdir., xrefs: 00007FF619BC64FA
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 00000001.00000002.1895497148.00007FF619BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF619BC0000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 00000001.00000002.1895473888.00007FF619BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000001.00000002.1895544098.00007FF619BEA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000001.00000002.1895573832.00007FF619BFD000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000001.00000002.1895573832.00007FF619C00000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000001.00000002.1895573832.00007FF619C0C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000001.00000002.1895651091.00007FF619C0E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_1_2_7ff619bc0000_NEVER OPEN!.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: ByteCharEnvironmentExpandMessageMultiStringsWide
                                                                                                                                                                                                                                              • String ID: LOADER: Failed to convert runtime-tmpdir to a wide string.$LOADER: Failed to expand environment variables in the runtime-tmpdir.$LOADER: Failed to obtain the absolute path of the runtime-tmpdir.
                                                                                                                                                                                                                                              • API String ID: 1662231829-3498232454
                                                                                                                                                                                                                                              • Opcode ID: 1a78d63db9e5c5418a60acc91ec9d4210b790a3baa2768e8ac1cd5e3290d3fb6
                                                                                                                                                                                                                                              • Instruction ID: b0f4d426383709a71d95db9b2d42d29af51c1f38a70f07444048cb22dd1eb5a6
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 1a78d63db9e5c5418a60acc91ec9d4210b790a3baa2768e8ac1cd5e3290d3fb6
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 7A31B711F1CE8B81FA309F25D9552BB5295AF9AFACF444436DA4EC279AEE2CF5048700
                                                                                                                                                                                                                                              Function 00007FF619BCCE18 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 88libraryloaderCOMMONLIBRARYCODE
                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                              • LoadLibraryExW.KERNEL32(?,?,?,00007FF619BCD0CA,?,?,?,00007FF619BCCDBC,?,?,00000001,00007FF619BCC9D9), ref: 00007FF619BCCE9D
                                                                                                                                                                                                                                              • GetLastError.KERNEL32(?,?,?,00007FF619BCD0CA,?,?,?,00007FF619BCCDBC,?,?,00000001,00007FF619BCC9D9), ref: 00007FF619BCCEAB
                                                                                                                                                                                                                                              • LoadLibraryExW.KERNEL32(?,?,?,00007FF619BCD0CA,?,?,?,00007FF619BCCDBC,?,?,00000001,00007FF619BCC9D9), ref: 00007FF619BCCED5
                                                                                                                                                                                                                                              • FreeLibrary.KERNEL32(?,?,?,00007FF619BCD0CA,?,?,?,00007FF619BCCDBC,?,?,00000001,00007FF619BCC9D9), ref: 00007FF619BCCF1B
                                                                                                                                                                                                                                              • GetProcAddress.KERNEL32(?,?,?,00007FF619BCD0CA,?,?,?,00007FF619BCCDBC,?,?,00000001,00007FF619BCC9D9), ref: 00007FF619BCCF27
                                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 00000001.00000002.1895497148.00007FF619BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF619BC0000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 00000001.00000002.1895473888.00007FF619BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000001.00000002.1895544098.00007FF619BEA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000001.00000002.1895573832.00007FF619BFD000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000001.00000002.1895573832.00007FF619C00000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000001.00000002.1895573832.00007FF619C0C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000001.00000002.1895651091.00007FF619C0E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_1_2_7ff619bc0000_NEVER OPEN!.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: Library$Load$AddressErrorFreeLastProc
                                                                                                                                                                                                                                              • String ID: api-ms-
                                                                                                                                                                                                                                              • API String ID: 2559590344-2084034818
                                                                                                                                                                                                                                              • Opcode ID: 498a46deb9e57335d1de5ef4a955cc682f3fb4b8c547d247cdb2efba5821273f
                                                                                                                                                                                                                                              • Instruction ID: 0452f0a6bc95feb73ec9d7c530df79555f56691bffe4acca3e0defd3443ad74f
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 498a46deb9e57335d1de5ef4a955cc682f3fb4b8c547d247cdb2efba5821273f
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 4C319C21F1AE4A91EE71DF06A8005B62298BF5BFB8F5A4935DD2DCA780DF3CE4458704
                                                                                                                                                                                                                                              Function 00007FF619BC7990 Relevance: 10.6, APIs: 2, Strings: 5, Instructions: 68COMMON
                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                              • MultiByteToWideChar.KERNEL32 ref: 00007FF619BC79CA
                                                                                                                                                                                                                                                • Part of subcall function 00007FF619BC2620: GetLastError.KERNEL32(00000000,00000000,00000000,00007FF619BC76A4,?,?,?,?,?,?,?,?,?,?,?,00007FF619BC101D), ref: 00007FF619BC2654
                                                                                                                                                                                                                                                • Part of subcall function 00007FF619BC2620: MessageBoxW.USER32 ref: 00007FF619BC272C
                                                                                                                                                                                                                                              • MultiByteToWideChar.KERNEL32 ref: 00007FF619BC7A50
                                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 00000001.00000002.1895497148.00007FF619BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF619BC0000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 00000001.00000002.1895473888.00007FF619BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000001.00000002.1895544098.00007FF619BEA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000001.00000002.1895573832.00007FF619BFD000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000001.00000002.1895573832.00007FF619C00000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000001.00000002.1895573832.00007FF619C0C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000001.00000002.1895651091.00007FF619C0E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_1_2_7ff619bc0000_NEVER OPEN!.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: ByteCharMultiWide$ErrorLastMessage
                                                                                                                                                                                                                                              • String ID: Failed to decode wchar_t from UTF-8$Failed to get wchar_t buffer size.$MultiByteToWideChar$Out of memory.$win32_utils_from_utf8
                                                                                                                                                                                                                                              • API String ID: 3723044601-876015163
                                                                                                                                                                                                                                              • Opcode ID: e4b57f199998f7b1657d81dc8f37c951294af66f0894a5466f77556df0e946e9
                                                                                                                                                                                                                                              • Instruction ID: fe5c932ae4092ed0267dabd7907c5ff862ea2840bd21a6c2fd7ea2f9bf78642f
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: e4b57f199998f7b1657d81dc8f37c951294af66f0894a5466f77556df0e946e9
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: F6212322B08E4681EB60DF26F440177A365AB9ABE8F584175EB5CC3B69EE6CE5418700
                                                                                                                                                                                                                                              Function 00007FF619BDA960 Relevance: 10.6, APIs: 7, Instructions: 62COMMONLIBRARYCODE
                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                              • GetLastError.KERNEL32(?,?,?,00007FF619BE2747,?,?,?,00007FF619BDCF10,?,?,00000000,00007FF619BD380F,?,?,?,00007FF619BD9674), ref: 00007FF619BDA96F
                                                                                                                                                                                                                                              • FlsGetValue.KERNEL32(?,?,?,00007FF619BE2747,?,?,?,00007FF619BDCF10,?,?,00000000,00007FF619BD380F,?,?,?,00007FF619BD9674), ref: 00007FF619BDA984
                                                                                                                                                                                                                                              • FlsSetValue.KERNEL32(?,?,?,00007FF619BE2747,?,?,?,00007FF619BDCF10,?,?,00000000,00007FF619BD380F,?,?,?,00007FF619BD9674), ref: 00007FF619BDA9A5
                                                                                                                                                                                                                                              • FlsSetValue.KERNEL32(?,?,?,00007FF619BE2747,?,?,?,00007FF619BDCF10,?,?,00000000,00007FF619BD380F,?,?,?,00007FF619BD9674), ref: 00007FF619BDA9D2
                                                                                                                                                                                                                                              • FlsSetValue.KERNEL32(?,?,?,00007FF619BE2747,?,?,?,00007FF619BDCF10,?,?,00000000,00007FF619BD380F,?,?,?,00007FF619BD9674), ref: 00007FF619BDA9E3
                                                                                                                                                                                                                                              • FlsSetValue.KERNEL32(?,?,?,00007FF619BE2747,?,?,?,00007FF619BDCF10,?,?,00000000,00007FF619BD380F,?,?,?,00007FF619BD9674), ref: 00007FF619BDA9F4
                                                                                                                                                                                                                                              • SetLastError.KERNEL32(?,?,?,00007FF619BE2747,?,?,?,00007FF619BDCF10,?,?,00000000,00007FF619BD380F,?,?,?,00007FF619BD9674), ref: 00007FF619BDAA0F
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 00000001.00000002.1895497148.00007FF619BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF619BC0000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 00000001.00000002.1895473888.00007FF619BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000001.00000002.1895544098.00007FF619BEA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000001.00000002.1895573832.00007FF619BFD000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000001.00000002.1895573832.00007FF619C00000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000001.00000002.1895573832.00007FF619C0C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000001.00000002.1895651091.00007FF619C0E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_1_2_7ff619bc0000_NEVER OPEN!.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: Value$ErrorLast
                                                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                                                              • API String ID: 2506987500-0
                                                                                                                                                                                                                                              • Opcode ID: 482d7d92c2d907ed806f35f4d18b743102c37a9935fa87ba0305a05624cfcd27
                                                                                                                                                                                                                                              • Instruction ID: b033b690eff72c581becb72339f94efa873a585b7f06cc8c89dc60a1710ea913
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 482d7d92c2d907ed806f35f4d18b743102c37a9935fa87ba0305a05624cfcd27
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 14215E21A0DE4E41FA746F21565523F62C24F8AFBCF145738E93EC6BC6DE2CB4418600
                                                                                                                                                                                                                                              Function 00007FF619BE6F7C Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 48fileCOMMON
                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 00000001.00000002.1895497148.00007FF619BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF619BC0000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 00000001.00000002.1895473888.00007FF619BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000001.00000002.1895544098.00007FF619BEA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000001.00000002.1895573832.00007FF619BFD000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000001.00000002.1895573832.00007FF619C00000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000001.00000002.1895573832.00007FF619C0C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000001.00000002.1895651091.00007FF619C0E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_1_2_7ff619bc0000_NEVER OPEN!.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: ConsoleWrite$CloseCreateErrorFileHandleLast
                                                                                                                                                                                                                                              • String ID: CONOUT$
                                                                                                                                                                                                                                              • API String ID: 3230265001-3130406586
                                                                                                                                                                                                                                              • Opcode ID: 9b0c467059450527019a7bcd7e40657f3b8ea03f40c84b5b8d47b747d07757bb
                                                                                                                                                                                                                                              • Instruction ID: 1344662cfaf5570444aa80b92e96ecb969c506955c8aad71dee52dde2d543c16
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 9b0c467059450527019a7bcd7e40657f3b8ea03f40c84b5b8d47b747d07757bb
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: A2115E21A18E4586E7608F57E85432AB6A8FB8AFFCF044274EA5DC7795CF7CD8448740
                                                                                                                                                                                                                                              Function 00007FFDFAE45150 Relevance: 9.1, APIs: 2, Strings: 3, Instructions: 311COMMON
                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 00000001.00000002.1896332214.00007FFDFAE21000.00000040.00000001.01000000.0000001E.sdmp, Offset: 00007FFDFAE20000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 00000001.00000002.1896301415.00007FFDFAE20000.00000002.00000001.01000000.0000001E.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000001.00000002.1896332214.00007FFDFAF73000.00000040.00000001.01000000.0000001E.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000001.00000002.1896332214.00007FFDFAF75000.00000040.00000001.01000000.0000001E.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000001.00000002.1896332214.00007FFDFAF8A000.00000040.00000001.01000000.0000001E.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000001.00000002.1896536596.00007FFDFAF8C000.00000080.00000001.01000000.0000001E.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000001.00000002.1896632509.00007FFDFAF8E000.00000004.00000001.01000000.0000001E.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_1_2_7ffdfae20000_NEVER OPEN!.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: 00007A4519
                                                                                                                                                                                                                                              • String ID: %s at line %d of [%.10s]$a29f9949895322123f7c38fbe94c649a9d6e6c9cd0c3b41c96d694552f26b309$database corruption
                                                                                                                                                                                                                                              • API String ID: 817585512-481979681
                                                                                                                                                                                                                                              • Opcode ID: 883751af2dac174ee55169bed689386d8118835035adee25f9951f6694d9ba23
                                                                                                                                                                                                                                              • Instruction ID: a0e33715bb39e006f836c527bd931e62cf60de7d1d70177f60a8f3cf970459d2
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 883751af2dac174ee55169bed689386d8118835035adee25f9951f6694d9ba23
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 96D1D27770878286D768EF25D424AA977A9FB88B88F054036CF5E47798DF3AD841C700
                                                                                                                                                                                                                                              Function 00007FF619BDAAD8 Relevance: 9.1, APIs: 6, Instructions: 57COMMONLIBRARYCODE
                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                              • GetLastError.KERNEL32(?,?,?,00007FF619BD41FD,?,?,?,?,00007FF619BDE147,?,?,00000000,00007FF619BDABF6,?,?,?), ref: 00007FF619BDAAE7
                                                                                                                                                                                                                                              • FlsSetValue.KERNEL32(?,?,?,00007FF619BD41FD,?,?,?,?,00007FF619BDE147,?,?,00000000,00007FF619BDABF6,?,?,?), ref: 00007FF619BDAB1D
                                                                                                                                                                                                                                              • FlsSetValue.KERNEL32(?,?,?,00007FF619BD41FD,?,?,?,?,00007FF619BDE147,?,?,00000000,00007FF619BDABF6,?,?,?), ref: 00007FF619BDAB4A
                                                                                                                                                                                                                                              • FlsSetValue.KERNEL32(?,?,?,00007FF619BD41FD,?,?,?,?,00007FF619BDE147,?,?,00000000,00007FF619BDABF6,?,?,?), ref: 00007FF619BDAB5B
                                                                                                                                                                                                                                              • FlsSetValue.KERNEL32(?,?,?,00007FF619BD41FD,?,?,?,?,00007FF619BDE147,?,?,00000000,00007FF619BDABF6,?,?,?), ref: 00007FF619BDAB6C
                                                                                                                                                                                                                                              • SetLastError.KERNEL32(?,?,?,00007FF619BD41FD,?,?,?,?,00007FF619BDE147,?,?,00000000,00007FF619BDABF6,?,?,?), ref: 00007FF619BDAB87
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 00000001.00000002.1895497148.00007FF619BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF619BC0000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 00000001.00000002.1895473888.00007FF619BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000001.00000002.1895544098.00007FF619BEA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000001.00000002.1895573832.00007FF619BFD000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000001.00000002.1895573832.00007FF619C00000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000001.00000002.1895573832.00007FF619C0C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000001.00000002.1895651091.00007FF619C0E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_1_2_7ff619bc0000_NEVER OPEN!.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: Value$ErrorLast
                                                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                                                              • API String ID: 2506987500-0
                                                                                                                                                                                                                                              • Opcode ID: 4f821a155bd5c9b2d20841a68983f7300b2ce8254fb32a46fd6bab17ddae95b8
                                                                                                                                                                                                                                              • Instruction ID: a38a73f17675b55dc74d5639610eac0e074dd2d7a423ae9e66c5f182b064467d
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 4f821a155bd5c9b2d20841a68983f7300b2ce8254fb32a46fd6bab17ddae95b8
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 46114D20A08E4A42FA746F21565513F62C25F8AFBCF545738D93EC67D6DE2CB4028700
                                                                                                                                                                                                                                              Function 00007FF619BCE394 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 162COMMON
                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 00000001.00000002.1895497148.00007FF619BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF619BC0000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 00000001.00000002.1895473888.00007FF619BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000001.00000002.1895544098.00007FF619BEA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000001.00000002.1895573832.00007FF619BFD000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000001.00000002.1895573832.00007FF619C00000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000001.00000002.1895573832.00007FF619C0C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000001.00000002.1895651091.00007FF619C0E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_1_2_7ff619bc0000_NEVER OPEN!.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: Frame$EmptyHandler3::StateUnwind__except_validate_context_record__std_exception_copy
                                                                                                                                                                                                                                              • String ID: csm$csm
                                                                                                                                                                                                                                              • API String ID: 851805269-3733052814
                                                                                                                                                                                                                                              • Opcode ID: 299de1fc68536281d3fe39e191cf3aad2c95231a45bdf52044d673f3605024c1
                                                                                                                                                                                                                                              • Instruction ID: 7c56104a58930782c969e9d8bdc81a1f07ba1f59e2fd19054c48fd757bebff1d
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 299de1fc68536281d3fe39e191cf3aad2c95231a45bdf52044d673f3605024c1
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 77617F32A08A4AC6EB748F15944427A77A0FB56FACF144136DA9C87B95DF3CF890C700
                                                                                                                                                                                                                                              Function 00007FF619BCC7D8 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 144COMMON
                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 00000001.00000002.1895497148.00007FF619BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF619BC0000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 00000001.00000002.1895473888.00007FF619BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000001.00000002.1895544098.00007FF619BEA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000001.00000002.1895573832.00007FF619BFD000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000001.00000002.1895573832.00007FF619C00000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000001.00000002.1895573832.00007FF619C0C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000001.00000002.1895651091.00007FF619C0E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_1_2_7ff619bc0000_NEVER OPEN!.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: CurrentImageNonwritableUnwind__except_validate_context_record
                                                                                                                                                                                                                                              • String ID: csm$f
                                                                                                                                                                                                                                              • API String ID: 2395640692-629598281
                                                                                                                                                                                                                                              • Opcode ID: 2a60e48d34e2d081a64a19c3087b12e76bb296e8dfc97340c1001bb2fa126da7
                                                                                                                                                                                                                                              • Instruction ID: b15b32efa89a7fbe440e84abedab9936f7222f09d095605ef9812cb0ed930158
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 2a60e48d34e2d081a64a19c3087b12e76bb296e8dfc97340c1001bb2fa126da7
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: BB51B132F19A0686D765CF15E408A3A37A5FB66FACF508930DA4E97788DF78E8418704
                                                                                                                                                                                                                                              Function 00007FF619BC2240 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 81windowCOMMON
                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 00000001.00000002.1895497148.00007FF619BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF619BC0000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 00000001.00000002.1895473888.00007FF619BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000001.00000002.1895544098.00007FF619BEA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000001.00000002.1895573832.00007FF619BFD000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000001.00000002.1895573832.00007FF619C00000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000001.00000002.1895573832.00007FF619C0C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000001.00000002.1895651091.00007FF619C0E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_1_2_7ff619bc0000_NEVER OPEN!.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: DeleteDestroyDialogHandleIconIndirectModuleObjectParam
                                                                                                                                                                                                                                              • String ID: Unhandled exception in script
                                                                                                                                                                                                                                              • API String ID: 3081866767-2699770090
                                                                                                                                                                                                                                              • Opcode ID: d06fa68a38a4eb8fcc30f5dbe48dceb4872e6e84d86a46026ce11bd39583f372
                                                                                                                                                                                                                                              • Instruction ID: 137fae4a072a5b533dae4a1aa04f16d1076e0d0d425e725cb4f38368dc94bed5
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: d06fa68a38a4eb8fcc30f5dbe48dceb4872e6e84d86a46026ce11bd39583f372
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: A9316272A09A8689EB30DF21E8551EA6364FF89FACF440135EA4D8BB59DF3CD145C700
                                                                                                                                                                                                                                              Function 00007FF619BC2620 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 67windowCOMMON
                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                              • GetLastError.KERNEL32(00000000,00000000,00000000,00007FF619BC76A4,?,?,?,?,?,?,?,?,?,?,?,00007FF619BC101D), ref: 00007FF619BC2654
                                                                                                                                                                                                                                                • Part of subcall function 00007FF619BC7410: GetLastError.KERNEL32(00000000,00007FF619BC26A0), ref: 00007FF619BC7437
                                                                                                                                                                                                                                                • Part of subcall function 00007FF619BC7410: FormatMessageW.KERNEL32(00000000,00007FF619BC26A0), ref: 00007FF619BC7466
                                                                                                                                                                                                                                                • Part of subcall function 00007FF619BC7990: MultiByteToWideChar.KERNEL32 ref: 00007FF619BC79CA
                                                                                                                                                                                                                                              • MessageBoxW.USER32 ref: 00007FF619BC272C
                                                                                                                                                                                                                                              • MessageBoxA.USER32 ref: 00007FF619BC2748
                                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 00000001.00000002.1895497148.00007FF619BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF619BC0000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 00000001.00000002.1895473888.00007FF619BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000001.00000002.1895544098.00007FF619BEA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000001.00000002.1895573832.00007FF619BFD000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000001.00000002.1895573832.00007FF619C00000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000001.00000002.1895573832.00007FF619C0C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000001.00000002.1895651091.00007FF619C0E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_1_2_7ff619bc0000_NEVER OPEN!.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: Message$ErrorLast$ByteCharFormatMultiWide
                                                                                                                                                                                                                                              • String ID: %s%s: %s$Fatal error detected
                                                                                                                                                                                                                                              • API String ID: 2806210788-2410924014
                                                                                                                                                                                                                                              • Opcode ID: 06cd5466942112b508e396ea70b9586e8f0482aad08493747faa49d6edf4eebc
                                                                                                                                                                                                                                              • Instruction ID: 4bf1df803be2759ccf129fdf1bfe7d9b8730e688868027cd7c0979b6638fc7cd
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 06cd5466942112b508e396ea70b9586e8f0482aad08493747faa49d6edf4eebc
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 52316F72628E8692E7309F11E4517EB7368FB85B9CF404036EA8D83A99DF3CD205CB40
                                                                                                                                                                                                                                              Function 00007FF619BD8C44 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 27libraryloaderCOMMON
                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 00000001.00000002.1895497148.00007FF619BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF619BC0000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 00000001.00000002.1895473888.00007FF619BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000001.00000002.1895544098.00007FF619BEA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000001.00000002.1895573832.00007FF619BFD000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000001.00000002.1895573832.00007FF619C00000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000001.00000002.1895573832.00007FF619C0C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000001.00000002.1895651091.00007FF619C0E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_1_2_7ff619bc0000_NEVER OPEN!.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: AddressFreeHandleLibraryModuleProc
                                                                                                                                                                                                                                              • String ID: CorExitProcess$mscoree.dll
                                                                                                                                                                                                                                              • API String ID: 4061214504-1276376045
                                                                                                                                                                                                                                              • Opcode ID: ff0f43bb8c2651fc19042a00c2a68c9718d43f98581b66faf951866b22fbabd4
                                                                                                                                                                                                                                              • Instruction ID: 163be6dd3dc43b2ed40e65287badb4157c03ec46bce1b60eb9425c9b8f92a8bc
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: ff0f43bb8c2651fc19042a00c2a68c9718d43f98581b66faf951866b22fbabd4
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: BBF04461619E0A81EB208F15E8543365364BF47F7DF544639C66E852E4CF2CD545C300
                                                                                                                                                                                                                                              Function 00007FF619BE86CC Relevance: 7.6, APIs: 5, Instructions: 56COMMONLIBRARYCODE
                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 00000001.00000002.1895497148.00007FF619BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF619BC0000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 00000001.00000002.1895473888.00007FF619BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000001.00000002.1895544098.00007FF619BEA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000001.00000002.1895573832.00007FF619BFD000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000001.00000002.1895573832.00007FF619C00000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000001.00000002.1895573832.00007FF619C0C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000001.00000002.1895651091.00007FF619C0E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_1_2_7ff619bc0000_NEVER OPEN!.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: _set_statfp
                                                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                                                              • API String ID: 1156100317-0
                                                                                                                                                                                                                                              • Opcode ID: 69d38c35bd33e64192705e47d806ebaffe6519085bb8d16871af39b095092657
                                                                                                                                                                                                                                              • Instruction ID: 552bac61620391b285c89e85d10c26daca9362b7a6184203f9602c0683921781
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 69d38c35bd33e64192705e47d806ebaffe6519085bb8d16871af39b095092657
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: EE11C122E28F0B09F7745E6AD54237700496F57B7CF480AB0EA7E866DADE1CA841510A
                                                                                                                                                                                                                                              Function 00007FF619BDABA0 Relevance: 7.6, APIs: 5, Instructions: 54COMMONLIBRARYCODE
                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                              • FlsGetValue.KERNEL32(?,?,?,00007FF619BD9DBF,?,?,00000000,00007FF619BDA05A,?,?,?,?,?,00007FF619BD201E), ref: 00007FF619BDABBF
                                                                                                                                                                                                                                              • FlsSetValue.KERNEL32(?,?,?,00007FF619BD9DBF,?,?,00000000,00007FF619BDA05A,?,?,?,?,?,00007FF619BD201E), ref: 00007FF619BDABDE
                                                                                                                                                                                                                                              • FlsSetValue.KERNEL32(?,?,?,00007FF619BD9DBF,?,?,00000000,00007FF619BDA05A,?,?,?,?,?,00007FF619BD201E), ref: 00007FF619BDAC06
                                                                                                                                                                                                                                              • FlsSetValue.KERNEL32(?,?,?,00007FF619BD9DBF,?,?,00000000,00007FF619BDA05A,?,?,?,?,?,00007FF619BD201E), ref: 00007FF619BDAC17
                                                                                                                                                                                                                                              • FlsSetValue.KERNEL32(?,?,?,00007FF619BD9DBF,?,?,00000000,00007FF619BDA05A,?,?,?,?,?,00007FF619BD201E), ref: 00007FF619BDAC28
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 00000001.00000002.1895497148.00007FF619BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF619BC0000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 00000001.00000002.1895473888.00007FF619BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000001.00000002.1895544098.00007FF619BEA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000001.00000002.1895573832.00007FF619BFD000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000001.00000002.1895573832.00007FF619C00000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000001.00000002.1895573832.00007FF619C0C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000001.00000002.1895651091.00007FF619C0E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_1_2_7ff619bc0000_NEVER OPEN!.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: Value
                                                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                                                              • API String ID: 3702945584-0
                                                                                                                                                                                                                                              • Opcode ID: 425e55ebfe83270ca80538721167acbfa9d0f1668f7257529dc0cfb1d1d3f7ac
                                                                                                                                                                                                                                              • Instruction ID: a3bc2a5d85f8423020d23c3b1660a62e2b1ec1af8741ac1d0806080800538bba
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 425e55ebfe83270ca80538721167acbfa9d0f1668f7257529dc0cfb1d1d3f7ac
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 78114C20A08E0A42FA786F255A5127B22C55F96FBCF485738E83EC67D6DE2CB5428600
                                                                                                                                                                                                                                              Function 00007FF619BDAA34 Relevance: 7.6, APIs: 5, Instructions: 50COMMON
                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                              • FlsGetValue.KERNEL32(?,?,?,?,?,?,?,00007FF619BE2747,?,?,?,00007FF619BDCF10,?,?,00000000,00007FF619BD380F), ref: 00007FF619BDAA45
                                                                                                                                                                                                                                              • FlsSetValue.KERNEL32(?,?,?,?,?,?,?,00007FF619BE2747,?,?,?,00007FF619BDCF10,?,?,00000000,00007FF619BD380F), ref: 00007FF619BDAA64
                                                                                                                                                                                                                                              • FlsSetValue.KERNEL32(?,?,?,?,?,?,?,00007FF619BE2747,?,?,?,00007FF619BDCF10,?,?,00000000,00007FF619BD380F), ref: 00007FF619BDAA8C
                                                                                                                                                                                                                                              • FlsSetValue.KERNEL32(?,?,?,?,?,?,?,00007FF619BE2747,?,?,?,00007FF619BDCF10,?,?,00000000,00007FF619BD380F), ref: 00007FF619BDAA9D
                                                                                                                                                                                                                                              • FlsSetValue.KERNEL32(?,?,?,?,?,?,?,00007FF619BE2747,?,?,?,00007FF619BDCF10,?,?,00000000,00007FF619BD380F), ref: 00007FF619BDAAAE
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 00000001.00000002.1895497148.00007FF619BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF619BC0000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 00000001.00000002.1895473888.00007FF619BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000001.00000002.1895544098.00007FF619BEA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000001.00000002.1895573832.00007FF619BFD000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000001.00000002.1895573832.00007FF619C00000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000001.00000002.1895573832.00007FF619C0C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000001.00000002.1895651091.00007FF619C0E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_1_2_7ff619bc0000_NEVER OPEN!.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: Value
                                                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                                                              • API String ID: 3702945584-0
                                                                                                                                                                                                                                              • Opcode ID: 80d1ee65bb25e4897b2356b851298d62b7fec3b923ee3d7560206d96ecb2c711
                                                                                                                                                                                                                                              • Instruction ID: 3036cab4d37a476bf73562d257a444498c66f2ff416c5233c642c27931d2ec21
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 80d1ee65bb25e4897b2356b851298d62b7fec3b923ee3d7560206d96ecb2c711
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: C1110924E09E0F41F9B96E21555617B12C24F87F7CF585B38D93ECA3D2EE2CB8419650
                                                                                                                                                                                                                                              Function 00007FFDFAE81850 Relevance: 7.3, APIs: 1, Strings: 3, Instructions: 329COMMON
                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                                              • number of columns in foreign key does not match the number of columns in the referenced table, xrefs: 00007FFDFAE818FE
                                                                                                                                                                                                                                              • foreign key on %s should reference only one column of table %T, xrefs: 00007FFDFAE818D5
                                                                                                                                                                                                                                              • unknown column "%s" in foreign key definition, xrefs: 00007FFDFAE81BEC
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 00000001.00000002.1896332214.00007FFDFAE21000.00000040.00000001.01000000.0000001E.sdmp, Offset: 00007FFDFAE20000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 00000001.00000002.1896301415.00007FFDFAE20000.00000002.00000001.01000000.0000001E.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000001.00000002.1896332214.00007FFDFAF73000.00000040.00000001.01000000.0000001E.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000001.00000002.1896332214.00007FFDFAF75000.00000040.00000001.01000000.0000001E.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000001.00000002.1896332214.00007FFDFAF8A000.00000040.00000001.01000000.0000001E.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000001.00000002.1896536596.00007FFDFAF8C000.00000080.00000001.01000000.0000001E.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000001.00000002.1896632509.00007FFDFAF8E000.00000004.00000001.01000000.0000001E.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_1_2_7ffdfae20000_NEVER OPEN!.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: 00007A4519
                                                                                                                                                                                                                                              • String ID: foreign key on %s should reference only one column of table %T$number of columns in foreign key does not match the number of columns in the referenced table$unknown column "%s" in foreign key definition
                                                                                                                                                                                                                                              • API String ID: 817585512-272990098
                                                                                                                                                                                                                                              • Opcode ID: 610992c9f53a0dba273ee57656dd78e9e570a160d9cd720afc0d2f152aeea753
                                                                                                                                                                                                                                              • Instruction ID: 5c349290755523ff185498c6ec2a081ef57b9a82949fa09f3cf9e04dee890b66
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 610992c9f53a0dba273ee57656dd78e9e570a160d9cd720afc0d2f152aeea753
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 41D1D162B08B8282EB68AB159164BB967A1FF45BD4F4481B5DE7F0B7C9DE3ED441C300
                                                                                                                                                                                                                                              Function 00007FFDFAE74450 Relevance: 7.3, APIs: 2, Strings: 2, Instructions: 302COMMON
                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 00000001.00000002.1896332214.00007FFDFAE21000.00000040.00000001.01000000.0000001E.sdmp, Offset: 00007FFDFAE20000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 00000001.00000002.1896301415.00007FFDFAE20000.00000002.00000001.01000000.0000001E.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000001.00000002.1896332214.00007FFDFAF73000.00000040.00000001.01000000.0000001E.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000001.00000002.1896332214.00007FFDFAF75000.00000040.00000001.01000000.0000001E.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000001.00000002.1896332214.00007FFDFAF8A000.00000040.00000001.01000000.0000001E.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000001.00000002.1896536596.00007FFDFAF8C000.00000080.00000001.01000000.0000001E.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000001.00000002.1896632509.00007FFDFAF8E000.00000004.00000001.01000000.0000001E.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_1_2_7ffdfae20000_NEVER OPEN!.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: 00007A4519
                                                                                                                                                                                                                                              • String ID: "%w" $%Q%s
                                                                                                                                                                                                                                              • API String ID: 817585512-1987291987
                                                                                                                                                                                                                                              • Opcode ID: d74e96d9daaaf6edc50f0ddd88788a21065b0404f7c44c8394027c8ab7042f74
                                                                                                                                                                                                                                              • Instruction ID: 7cea2b9934d07c5679b4d9a6021f7cd1b59e9fe6f4937b6866db72f21d62abb6
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: d74e96d9daaaf6edc50f0ddd88788a21065b0404f7c44c8394027c8ab7042f74
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 77C1CE62B08A8286EB18EF15B460A7967A0FF45BA4F544275EE7E0B7D8DF3DE444C700
                                                                                                                                                                                                                                              Function 00007FFDFAEA35C0 Relevance: 7.3, APIs: 1, Strings: 3, Instructions: 273COMMON
                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 00000001.00000002.1896332214.00007FFDFAE21000.00000040.00000001.01000000.0000001E.sdmp, Offset: 00007FFDFAE20000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 00000001.00000002.1896301415.00007FFDFAE20000.00000002.00000001.01000000.0000001E.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000001.00000002.1896332214.00007FFDFAF73000.00000040.00000001.01000000.0000001E.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000001.00000002.1896332214.00007FFDFAF75000.00000040.00000001.01000000.0000001E.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000001.00000002.1896332214.00007FFDFAF8A000.00000040.00000001.01000000.0000001E.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000001.00000002.1896536596.00007FFDFAF8C000.00000080.00000001.01000000.0000001E.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000001.00000002.1896632509.00007FFDFAF8E000.00000004.00000001.01000000.0000001E.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_1_2_7ffdfae20000_NEVER OPEN!.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: 00007A4519
                                                                                                                                                                                                                                              • String ID: %.*z:%u$column%d$rowid
                                                                                                                                                                                                                                              • API String ID: 817585512-2903559916
                                                                                                                                                                                                                                              • Opcode ID: 3651f9753455dc6091babac7499040f5ace20c46c7b4a84ac92bdb96b826ea75
                                                                                                                                                                                                                                              • Instruction ID: fe69698f504cf7378a6717513f94eaa30a0ffe6a9289a3ae210e562ef48f3d71
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 3651f9753455dc6091babac7499040f5ace20c46c7b4a84ac92bdb96b826ea75
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: E2B1B3AAF0968341EB2DAB159420A7A6791BF51B94F4981B5DE6F0B7CDDF3EE401C300
                                                                                                                                                                                                                                              Function 00007FFDFAE3ECC0 Relevance: 7.3, APIs: 1, Strings: 3, Instructions: 270COMMON
                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 00000001.00000002.1896332214.00007FFDFAE21000.00000040.00000001.01000000.0000001E.sdmp, Offset: 00007FFDFAE20000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 00000001.00000002.1896301415.00007FFDFAE20000.00000002.00000001.01000000.0000001E.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000001.00000002.1896332214.00007FFDFAF73000.00000040.00000001.01000000.0000001E.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000001.00000002.1896332214.00007FFDFAF75000.00000040.00000001.01000000.0000001E.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000001.00000002.1896332214.00007FFDFAF8A000.00000040.00000001.01000000.0000001E.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000001.00000002.1896536596.00007FFDFAF8C000.00000080.00000001.01000000.0000001E.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000001.00000002.1896632509.00007FFDFAF8E000.00000004.00000001.01000000.0000001E.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_1_2_7ffdfae20000_NEVER OPEN!.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID:
                                                                                                                                                                                                                                              • String ID: %s at line %d of [%.10s]$a29f9949895322123f7c38fbe94c649a9d6e6c9cd0c3b41c96d694552f26b309$database corruption
                                                                                                                                                                                                                                              • API String ID: 0-481979681
                                                                                                                                                                                                                                              • Opcode ID: 782611c81ddf8bf212e515f4a750447ce47c21e2b716e242f0c6ec6302aff568
                                                                                                                                                                                                                                              • Instruction ID: 0087739746fb2405c8d72a67441085328a4d7c3fef624733b48ef030131075a3
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 782611c81ddf8bf212e515f4a750447ce47c21e2b716e242f0c6ec6302aff568
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 5CB1E622B0C3D186D7289B1994A0ABE7FA1FB80785F044175DADB4B7C9CE3DE985D710
                                                                                                                                                                                                                                              Function 00007FFDFAE43270 Relevance: 7.3, APIs: 1, Strings: 3, Instructions: 260COMMON
                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 00000001.00000002.1896332214.00007FFDFAE21000.00000040.00000001.01000000.0000001E.sdmp, Offset: 00007FFDFAE20000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 00000001.00000002.1896301415.00007FFDFAE20000.00000002.00000001.01000000.0000001E.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000001.00000002.1896332214.00007FFDFAF73000.00000040.00000001.01000000.0000001E.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000001.00000002.1896332214.00007FFDFAF75000.00000040.00000001.01000000.0000001E.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000001.00000002.1896332214.00007FFDFAF8A000.00000040.00000001.01000000.0000001E.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000001.00000002.1896536596.00007FFDFAF8C000.00000080.00000001.01000000.0000001E.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000001.00000002.1896632509.00007FFDFAF8E000.00000004.00000001.01000000.0000001E.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_1_2_7ffdfae20000_NEVER OPEN!.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: 00007A4519
                                                                                                                                                                                                                                              • String ID: %s at line %d of [%.10s]$a29f9949895322123f7c38fbe94c649a9d6e6c9cd0c3b41c96d694552f26b309$database corruption
                                                                                                                                                                                                                                              • API String ID: 817585512-481979681
                                                                                                                                                                                                                                              • Opcode ID: 069fffe95d4fc24e2ab5e0d4fadc81e916aad1032b61017090729a1139b25d08
                                                                                                                                                                                                                                              • Instruction ID: 59ed7c5352c88f2e58aea009fdb46808257f27906a650bb705216610d57b91c6
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 069fffe95d4fc24e2ab5e0d4fadc81e916aad1032b61017090729a1139b25d08
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 40B10236B0868386E768EB65A064EBA77A8FB54784F014175DE6E47B89DF3EE500C700
                                                                                                                                                                                                                                              Function 00007FFDFAE2D250 Relevance: 7.3, APIs: 1, Strings: 3, Instructions: 256COMMON
                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 00000001.00000002.1896332214.00007FFDFAE21000.00000040.00000001.01000000.0000001E.sdmp, Offset: 00007FFDFAE20000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 00000001.00000002.1896301415.00007FFDFAE20000.00000002.00000001.01000000.0000001E.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000001.00000002.1896332214.00007FFDFAF73000.00000040.00000001.01000000.0000001E.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000001.00000002.1896332214.00007FFDFAF75000.00000040.00000001.01000000.0000001E.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000001.00000002.1896332214.00007FFDFAF8A000.00000040.00000001.01000000.0000001E.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000001.00000002.1896536596.00007FFDFAF8C000.00000080.00000001.01000000.0000001E.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000001.00000002.1896632509.00007FFDFAF8E000.00000004.00000001.01000000.0000001E.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_1_2_7ffdfae20000_NEVER OPEN!.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: 00007A4519
                                                                                                                                                                                                                                              • String ID: %s-shm$readonly_shm$winOpenShm
                                                                                                                                                                                                                                              • API String ID: 817585512-2815843928
                                                                                                                                                                                                                                              • Opcode ID: cdf73e23d87f90d3407f504cc2dea8bbaae9057ccea986a57c12c194f9775175
                                                                                                                                                                                                                                              • Instruction ID: c93649bbffa6e5a0423c7b82939bca6817d99228619f142241f25db6f4889c5e
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: cdf73e23d87f90d3407f504cc2dea8bbaae9057ccea986a57c12c194f9775175
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 41C14E25F09A4382EBACAB61E4A0E7933A4BF44B54F4442B5DE6F466D8DF3DE445C310
                                                                                                                                                                                                                                              Function 00007FFDFAE465D0 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 244COMMON
                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 00000001.00000002.1896332214.00007FFDFAE21000.00000040.00000001.01000000.0000001E.sdmp, Offset: 00007FFDFAE20000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 00000001.00000002.1896301415.00007FFDFAE20000.00000002.00000001.01000000.0000001E.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000001.00000002.1896332214.00007FFDFAF73000.00000040.00000001.01000000.0000001E.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000001.00000002.1896332214.00007FFDFAF75000.00000040.00000001.01000000.0000001E.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000001.00000002.1896332214.00007FFDFAF8A000.00000040.00000001.01000000.0000001E.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000001.00000002.1896536596.00007FFDFAF8C000.00000080.00000001.01000000.0000001E.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000001.00000002.1896632509.00007FFDFAF8E000.00000004.00000001.01000000.0000001E.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_1_2_7ffdfae20000_NEVER OPEN!.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID:
                                                                                                                                                                                                                                              • String ID: %s at line %d of [%.10s]$a29f9949895322123f7c38fbe94c649a9d6e6c9cd0c3b41c96d694552f26b309$database corruption
                                                                                                                                                                                                                                              • API String ID: 0-481979681
                                                                                                                                                                                                                                              • Opcode ID: 15e0f3433fb5b3e08eddd5557e9703fcd33e106e159bed805e8690dbf31db93a
                                                                                                                                                                                                                                              • Instruction ID: 51240090cdf4502704236e5d799b4cea0c3b7db240808695f4c54469895cea9a
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 15e0f3433fb5b3e08eddd5557e9703fcd33e106e159bed805e8690dbf31db93a
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 0591332AB0C2E346E328AB269060CBD7F95E750344F0442B6DEEB437C9DA2EE655D710
                                                                                                                                                                                                                                              Function 00007FF619BDF4D4 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 219COMMON
                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 00000001.00000002.1895497148.00007FF619BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF619BC0000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 00000001.00000002.1895473888.00007FF619BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000001.00000002.1895544098.00007FF619BEA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000001.00000002.1895573832.00007FF619BFD000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000001.00000002.1895573832.00007FF619C00000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000001.00000002.1895573832.00007FF619C0C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000001.00000002.1895651091.00007FF619C0E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_1_2_7ff619bc0000_NEVER OPEN!.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: _invalid_parameter_noinfo
                                                                                                                                                                                                                                              • String ID: UTF-16LEUNICODE$UTF-8$ccs
                                                                                                                                                                                                                                              • API String ID: 3215553584-1196891531
                                                                                                                                                                                                                                              • Opcode ID: 0616ab0422fa9c9da61e7b81d7bd0815e3234bc6ac49e26cf25c718118b1d5e3
                                                                                                                                                                                                                                              • Instruction ID: 9168cd15db66a78936460b14b32eb9605a21c591f11b8f2b4be3b7cb610c9b1c
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 0616ab0422fa9c9da61e7b81d7bd0815e3234bc6ac49e26cf25c718118b1d5e3
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 79817276E2DA0A85FB754E2581502BA36E0EB13F6CF558035CA0ED7BA4DF2DE901D701
                                                                                                                                                                                                                                              Function 00007FFDFAE734F0 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 215COMMON
                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 00000001.00000002.1896332214.00007FFDFAE21000.00000040.00000001.01000000.0000001E.sdmp, Offset: 00007FFDFAE20000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 00000001.00000002.1896301415.00007FFDFAE20000.00000002.00000001.01000000.0000001E.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000001.00000002.1896332214.00007FFDFAF73000.00000040.00000001.01000000.0000001E.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000001.00000002.1896332214.00007FFDFAF75000.00000040.00000001.01000000.0000001E.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000001.00000002.1896332214.00007FFDFAF8A000.00000040.00000001.01000000.0000001E.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000001.00000002.1896536596.00007FFDFAF8C000.00000080.00000001.01000000.0000001E.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000001.00000002.1896632509.00007FFDFAF8E000.00000004.00000001.01000000.0000001E.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_1_2_7ffdfae20000_NEVER OPEN!.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: 00007A4519
                                                                                                                                                                                                                                              • String ID: Cannot add a column to a view$sqlite_altertab_%s$virtual tables may not be altered
                                                                                                                                                                                                                                              • API String ID: 817585512-2063813899
                                                                                                                                                                                                                                              • Opcode ID: bf3c420ba3eb1e8dac2626fe2b30a04452add74b9c073f61ca8a1748f0f63000
                                                                                                                                                                                                                                              • Instruction ID: 13db573f7d8e2d61cf0d92f33c71cdf9520591b6ceb39d9378b3628bc6e62538
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: bf3c420ba3eb1e8dac2626fe2b30a04452add74b9c073f61ca8a1748f0f63000
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 1C91D366B08B8286EB58DF15A020ABA77A5FB54B84F459275DEAE077C9DF3DE040C700
                                                                                                                                                                                                                                              Function 00007FFDFAE3F220 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 187COMMON
                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 00000001.00000002.1896332214.00007FFDFAE21000.00000040.00000001.01000000.0000001E.sdmp, Offset: 00007FFDFAE20000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 00000001.00000002.1896301415.00007FFDFAE20000.00000002.00000001.01000000.0000001E.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000001.00000002.1896332214.00007FFDFAF73000.00000040.00000001.01000000.0000001E.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000001.00000002.1896332214.00007FFDFAF75000.00000040.00000001.01000000.0000001E.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000001.00000002.1896332214.00007FFDFAF8A000.00000040.00000001.01000000.0000001E.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000001.00000002.1896536596.00007FFDFAF8C000.00000080.00000001.01000000.0000001E.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000001.00000002.1896632509.00007FFDFAF8E000.00000004.00000001.01000000.0000001E.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_1_2_7ffdfae20000_NEVER OPEN!.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: 00007A4519
                                                                                                                                                                                                                                              • String ID: %s at line %d of [%.10s]$a29f9949895322123f7c38fbe94c649a9d6e6c9cd0c3b41c96d694552f26b309$database corruption
                                                                                                                                                                                                                                              • API String ID: 817585512-481979681
                                                                                                                                                                                                                                              • Opcode ID: bb331690382cd9aba51fbf9192c4a8343009a09fab82c0642137ec25885589cc
                                                                                                                                                                                                                                              • Instruction ID: b8faad406214cd5f28e0ea76352a129d273d0544d6c68628fb03c3ffa21535b8
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: bb331690382cd9aba51fbf9192c4a8343009a09fab82c0642137ec25885589cc
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 68716922B0C3E256D32DB62590B08FDBED1D751345B0482B2EEE74B7C9C92EE585D720
                                                                                                                                                                                                                                              Function 00007FFDFAFA1FC0 Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 173COMMON
                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 00000001.00000002.1896873012.00007FFDFAFA1000.00000040.00000001.01000000.0000001C.sdmp, Offset: 00007FFDFAFA0000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 00000001.00000002.1896736549.00007FFDFAFA0000.00000002.00000001.01000000.0000001C.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000001.00000002.1896873012.00007FFDFB004000.00000040.00000001.01000000.0000001C.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000001.00000002.1896873012.00007FFDFB053000.00000040.00000001.01000000.0000001C.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000001.00000002.1896873012.00007FFDFB0AC000.00000040.00000001.01000000.0000001C.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000001.00000002.1896873012.00007FFDFB0B1000.00000040.00000001.01000000.0000001C.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000001.00000002.1896873012.00007FFDFB0B4000.00000040.00000001.01000000.0000001C.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000001.00000002.1897409098.00007FFDFB0B5000.00000080.00000001.01000000.0000001C.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000001.00000002.1897449895.00007FFDFB0B7000.00000004.00000001.01000000.0000001C.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_1_2_7ffdfafa0000_NEVER OPEN!.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: 00007B6570
                                                                                                                                                                                                                                              • String ID: CJK UNIFIED IDEOGRAPH-$HANGUL SYLLABLE
                                                                                                                                                                                                                                              • API String ID: 4069847057-87138338
                                                                                                                                                                                                                                              • Opcode ID: dd12be397e2784a3b9b42d5ec1b23b2ed281038ba6f510f7d5b8d27382faff68
                                                                                                                                                                                                                                              • Instruction ID: 111cb5155d5bf92d4da5bee1ab5730900c6457af7c1f89f9fed2490212c7d8a6
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: dd12be397e2784a3b9b42d5ec1b23b2ed281038ba6f510f7d5b8d27382faff68
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: A861CA72B1C64146E7688A15A420AFA6692FFC0BA0F448375F97A8FADDEF3CD5059700
                                                                                                                                                                                                                                              Function 00007FF619BCE038 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 147COMMON
                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 00000001.00000002.1895497148.00007FF619BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF619BC0000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 00000001.00000002.1895473888.00007FF619BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000001.00000002.1895544098.00007FF619BEA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000001.00000002.1895573832.00007FF619BFD000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000001.00000002.1895573832.00007FF619C00000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000001.00000002.1895573832.00007FF619C0C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000001.00000002.1895651091.00007FF619C0E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_1_2_7ff619bc0000_NEVER OPEN!.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: CallEncodePointerTranslator
                                                                                                                                                                                                                                              • String ID: MOC$RCC
                                                                                                                                                                                                                                              • API String ID: 3544855599-2084237596
                                                                                                                                                                                                                                              • Opcode ID: 7879004664854e12467c2bd0163f26a934bd251a603f79bfcf6fe9940e12b56f
                                                                                                                                                                                                                                              • Instruction ID: a0c7055e5009d4726f391945de74c39ce30c41ebdc9f9488d2210fb0975dac74
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 7879004664854e12467c2bd0163f26a934bd251a603f79bfcf6fe9940e12b56f
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 7A613936A08B49CAE7208F65D4803AE77A0FB45BACF144225EE4D97B95CF38E555C740
                                                                                                                                                                                                                                              Function 00007FFDFAE388F0 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 138COMMON
                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 00000001.00000002.1896332214.00007FFDFAE21000.00000040.00000001.01000000.0000001E.sdmp, Offset: 00007FFDFAE20000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 00000001.00000002.1896301415.00007FFDFAE20000.00000002.00000001.01000000.0000001E.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000001.00000002.1896332214.00007FFDFAF73000.00000040.00000001.01000000.0000001E.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000001.00000002.1896332214.00007FFDFAF75000.00000040.00000001.01000000.0000001E.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000001.00000002.1896332214.00007FFDFAF8A000.00000040.00000001.01000000.0000001E.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000001.00000002.1896536596.00007FFDFAF8C000.00000080.00000001.01000000.0000001E.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000001.00000002.1896632509.00007FFDFAF8E000.00000004.00000001.01000000.0000001E.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_1_2_7ffdfae20000_NEVER OPEN!.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: 00007A4519
                                                                                                                                                                                                                                              • String ID: %s at line %d of [%.10s]$a29f9949895322123f7c38fbe94c649a9d6e6c9cd0c3b41c96d694552f26b309$database corruption
                                                                                                                                                                                                                                              • API String ID: 817585512-481979681
                                                                                                                                                                                                                                              • Opcode ID: a4e19dbb18c4c1cab3d71e28f48932c07223361a6718f948e66dda8fe4a4ee05
                                                                                                                                                                                                                                              • Instruction ID: 639eb0ecfbbd432a02a08c5f2d96d1d809d4937a673fc377ee69e65b500479d2
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: a4e19dbb18c4c1cab3d71e28f48932c07223361a6718f948e66dda8fe4a4ee05
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 3051B432708B8196EB98DF26D550AA97BA4FB48B84F144072DF6E43798DF3EE495C340
                                                                                                                                                                                                                                              Function 00007FFDFAE3A600 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 113COMMON
                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 00000001.00000002.1896332214.00007FFDFAE21000.00000040.00000001.01000000.0000001E.sdmp, Offset: 00007FFDFAE20000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 00000001.00000002.1896301415.00007FFDFAE20000.00000002.00000001.01000000.0000001E.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000001.00000002.1896332214.00007FFDFAF73000.00000040.00000001.01000000.0000001E.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000001.00000002.1896332214.00007FFDFAF75000.00000040.00000001.01000000.0000001E.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000001.00000002.1896332214.00007FFDFAF8A000.00000040.00000001.01000000.0000001E.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000001.00000002.1896536596.00007FFDFAF8C000.00000080.00000001.01000000.0000001E.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000001.00000002.1896632509.00007FFDFAF8E000.00000004.00000001.01000000.0000001E.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_1_2_7ffdfae20000_NEVER OPEN!.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: 00007A4519
                                                                                                                                                                                                                                              • String ID: %s at line %d of [%.10s]$a29f9949895322123f7c38fbe94c649a9d6e6c9cd0c3b41c96d694552f26b309$database corruption
                                                                                                                                                                                                                                              • API String ID: 817585512-481979681
                                                                                                                                                                                                                                              • Opcode ID: b2bd962ca4d533c51114e8662621ced1fd23e52fad8a1fcbe5e1e3e5f6701a96
                                                                                                                                                                                                                                              • Instruction ID: 0b799eb2c77a3f7d3d5325c114693cc4ec729dc74447dba741654806903894c7
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: b2bd962ca4d533c51114e8662621ced1fd23e52fad8a1fcbe5e1e3e5f6701a96
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: FF41E232B2874582E764AF15E460AB977A4FB84B90F540135EE5E077D8DF3ED8818740
                                                                                                                                                                                                                                              Function 00007FF619BC24D0 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 67windowCOMMON
                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 00000001.00000002.1895497148.00007FF619BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF619BC0000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 00000001.00000002.1895473888.00007FF619BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000001.00000002.1895544098.00007FF619BEA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000001.00000002.1895573832.00007FF619BFD000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000001.00000002.1895573832.00007FF619C00000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000001.00000002.1895573832.00007FF619C0C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000001.00000002.1895651091.00007FF619C0E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_1_2_7ff619bc0000_NEVER OPEN!.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: Message$ByteCharMultiWide
                                                                                                                                                                                                                                              • String ID: %s%s: %s$Fatal error detected
                                                                                                                                                                                                                                              • API String ID: 1878133881-2410924014
                                                                                                                                                                                                                                              • Opcode ID: 3c570bcd5f93380f8cf11f8fb0abc6b872d4b8d8cf7d568423a648373884b94f
                                                                                                                                                                                                                                              • Instruction ID: 2d90a4e482f336642382222d2fae01b88e6fe8c5821446e3045a2682264cdb99
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 3c570bcd5f93380f8cf11f8fb0abc6b872d4b8d8cf7d568423a648373884b94f
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 44314172628E8691E630DB11E4517EB63A8FB85F9CF404135EA8D87699DF3CD205CB40
                                                                                                                                                                                                                                              Function 00007FF619BC3B80 Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 36COMMON
                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                              • GetModuleFileNameW.KERNEL32(?,00007FF619BC3679), ref: 00007FF619BC3BB1
                                                                                                                                                                                                                                                • Part of subcall function 00007FF619BC2620: GetLastError.KERNEL32(00000000,00000000,00000000,00007FF619BC76A4,?,?,?,?,?,?,?,?,?,?,?,00007FF619BC101D), ref: 00007FF619BC2654
                                                                                                                                                                                                                                                • Part of subcall function 00007FF619BC2620: MessageBoxW.USER32 ref: 00007FF619BC272C
                                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 00000001.00000002.1895497148.00007FF619BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF619BC0000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 00000001.00000002.1895473888.00007FF619BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000001.00000002.1895544098.00007FF619BEA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000001.00000002.1895573832.00007FF619BFD000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000001.00000002.1895573832.00007FF619C00000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000001.00000002.1895573832.00007FF619C0C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000001.00000002.1895651091.00007FF619C0E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_1_2_7ff619bc0000_NEVER OPEN!.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: ErrorFileLastMessageModuleName
                                                                                                                                                                                                                                              • String ID: Failed to convert executable path to UTF-8.$Failed to get executable path.$GetModuleFileNameW
                                                                                                                                                                                                                                              • API String ID: 2581892565-1977442011
                                                                                                                                                                                                                                              • Opcode ID: f8ba9f07eefac00cb7b5b0959671e8cba28b74ac583d28598444145a4f5a2d24
                                                                                                                                                                                                                                              • Instruction ID: a31bcd8ce8856a64d081c40b954d7b7d5bd7c50aaff030531b37154b86fedb60
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: f8ba9f07eefac00cb7b5b0959671e8cba28b74ac583d28598444145a4f5a2d24
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 6501A721B1DE4A81FA719F25D8563B72359AF4EFACF801031F84EC6696EE5DE2448700
                                                                                                                                                                                                                                              Function 00007FF619BDBDE0 Relevance: 6.3, APIs: 4, Instructions: 305fileCOMMON
                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 00000001.00000002.1895497148.00007FF619BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF619BC0000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 00000001.00000002.1895473888.00007FF619BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000001.00000002.1895544098.00007FF619BEA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000001.00000002.1895573832.00007FF619BFD000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000001.00000002.1895573832.00007FF619C00000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000001.00000002.1895573832.00007FF619C0C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000001.00000002.1895651091.00007FF619C0E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_1_2_7ff619bc0000_NEVER OPEN!.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: FileWrite$ConsoleErrorLastOutput
                                                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                                                              • API String ID: 2718003287-0
                                                                                                                                                                                                                                              • Opcode ID: 1b79c134a33bd4231d66c587d2526c3880ce128d08015e7c63db30693dd1efe9
                                                                                                                                                                                                                                              • Instruction ID: fa262bfa06b117c700a7056b6eba9aeb8a2d5e36f3ff7b1780bd3171a45561c5
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 1b79c134a33bd4231d66c587d2526c3880ce128d08015e7c63db30693dd1efe9
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 80D10432B08E898AE720CFB9D4401AE37B5F756BACB104236DE5D97B99CE38D446C740
                                                                                                                                                                                                                                              Function 00007FF619BDC7BC Relevance: 6.2, APIs: 4, Instructions: 218COMMON
                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                              • GetConsoleMode.KERNEL32(?,?,?,?,?,?,?,?,?,?,00000000,00000000,00007FF619BDC75C), ref: 00007FF619BDC8DF
                                                                                                                                                                                                                                              • GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,00000000,00000000,00007FF619BDC75C), ref: 00007FF619BDC969
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 00000001.00000002.1895497148.00007FF619BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF619BC0000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 00000001.00000002.1895473888.00007FF619BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000001.00000002.1895544098.00007FF619BEA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000001.00000002.1895573832.00007FF619BFD000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000001.00000002.1895573832.00007FF619C00000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000001.00000002.1895573832.00007FF619C0C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000001.00000002.1895651091.00007FF619C0E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_1_2_7ff619bc0000_NEVER OPEN!.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: ConsoleErrorLastMode
                                                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                                                              • API String ID: 953036326-0
                                                                                                                                                                                                                                              • Opcode ID: fd137403e6e97c1a5ba82b3419691a9ebc8bf035f7c52069c471a636664b9908
                                                                                                                                                                                                                                              • Instruction ID: be6f3a06a823aac3d51a3273ad796ac6a915bdfe65e614057aa53dc8d0f54c67
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: fd137403e6e97c1a5ba82b3419691a9ebc8bf035f7c52069c471a636664b9908
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 2291CE62E18E5A89FB61CF6594446BE2BE0BB06FACF445136DE0E93788CF3CD4418300
                                                                                                                                                                                                                                              Function 00007FF619BDEC40 Relevance: 6.2, APIs: 4, Instructions: 161COMMON
                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 00000001.00000002.1895497148.00007FF619BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF619BC0000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 00000001.00000002.1895473888.00007FF619BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000001.00000002.1895544098.00007FF619BEA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000001.00000002.1895573832.00007FF619BFD000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000001.00000002.1895573832.00007FF619C00000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000001.00000002.1895573832.00007FF619C0C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000001.00000002.1895651091.00007FF619C0E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_1_2_7ff619bc0000_NEVER OPEN!.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: _get_daylight$_isindst
                                                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                                                              • API String ID: 4170891091-0
                                                                                                                                                                                                                                              • Opcode ID: 9a335e65895d815b06806fcf897e1ccafa5e2f7da5d283a57fe6a61041334353
                                                                                                                                                                                                                                              • Instruction ID: 8dbd0abd57a069956092aacc21f5137f47bc6686ffc85028c075c63a086db277
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 9a335e65895d815b06806fcf897e1ccafa5e2f7da5d283a57fe6a61041334353
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: A851F472F04A1A4AFB78CF6499815BE27E5AB06B6CF500135EE1E96BD5DF38B402C700
                                                                                                                                                                                                                                              Function 00007FF619BE59B8 Relevance: 6.2, APIs: 4, Instructions: 159COMMON
                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 00000001.00000002.1895497148.00007FF619BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF619BC0000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 00000001.00000002.1895473888.00007FF619BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000001.00000002.1895544098.00007FF619BEA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000001.00000002.1895573832.00007FF619BFD000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000001.00000002.1895573832.00007FF619C00000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000001.00000002.1895573832.00007FF619C0C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000001.00000002.1895651091.00007FF619C0E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_1_2_7ff619bc0000_NEVER OPEN!.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: _invalid_parameter_noinfo$_get_daylight
                                                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                                                              • API String ID: 72036449-0
                                                                                                                                                                                                                                              • Opcode ID: 142d09892d70a128fabe7da41fc771e354b7d6daf49b9f9834e29c658f9ef022
                                                                                                                                                                                                                                              • Instruction ID: 99491eb5a51c5ac9cff583131d14628610d8528fc807dc48c5577c6724adfd7f
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 142d09892d70a128fabe7da41fc771e354b7d6daf49b9f9834e29c658f9ef022
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: DC51D236D0CA4E86FB784D2A958537F6689AF42F3CF195075CA0DC72C6EEACE8408641
                                                                                                                                                                                                                                              Function 00007FF619BD4584 Relevance: 6.1, APIs: 4, Instructions: 119pipeCOMMON
                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 00000001.00000002.1895497148.00007FF619BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF619BC0000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 00000001.00000002.1895473888.00007FF619BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000001.00000002.1895544098.00007FF619BEA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000001.00000002.1895573832.00007FF619BFD000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000001.00000002.1895573832.00007FF619C00000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000001.00000002.1895573832.00007FF619C0C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000001.00000002.1895651091.00007FF619C0E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_1_2_7ff619bc0000_NEVER OPEN!.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: File$ErrorHandleInformationLastNamedPeekPipeType
                                                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                                                              • API String ID: 2780335769-0
                                                                                                                                                                                                                                              • Opcode ID: f08af1c1a1b606dce196c74d6fc6f8963a34cf033d17d6b560bcf375e956dfcc
                                                                                                                                                                                                                                              • Instruction ID: 28892d7ef669e73e5d53084280a4a7ad0571d05ba86268eb55e684f399a80da2
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: f08af1c1a1b606dce196c74d6fc6f8963a34cf033d17d6b560bcf375e956dfcc
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 08518A22A08A458AFB20CFB1D4513BE33E6AB4AFACF154135DE4997788DF3CD4458700
                                                                                                                                                                                                                                              Function 00007FF619BC1F70 Relevance: 6.1, APIs: 4, Instructions: 52COMMON
                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 00000001.00000002.1895497148.00007FF619BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF619BC0000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 00000001.00000002.1895473888.00007FF619BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000001.00000002.1895544098.00007FF619BEA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000001.00000002.1895573832.00007FF619BFD000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000001.00000002.1895573832.00007FF619C00000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000001.00000002.1895573832.00007FF619C0C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000001.00000002.1895651091.00007FF619C0E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_1_2_7ff619bc0000_NEVER OPEN!.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: LongWindow$DialogInvalidateRect
                                                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                                                              • API String ID: 1956198572-0
                                                                                                                                                                                                                                              • Opcode ID: 162ef6909b0da24e61350fefbcaa0130b5f771c4d53ef42d88aea1c24daf7f6c
                                                                                                                                                                                                                                              • Instruction ID: 8fc364818019999867b0e8afc994f1b2af56a86abafa3a2e1197bc33824ac566
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 162ef6909b0da24e61350fefbcaa0130b5f771c4d53ef42d88aea1c24daf7f6c
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 2E11CC21F1894A42F6759F6AE5442BB5296FF8AFA4F448031E94987BDDCE3CE4C58600
                                                                                                                                                                                                                                              Function 00007FFDFAE55EC0 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 157COMMON
                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 00000001.00000002.1896332214.00007FFDFAE21000.00000040.00000001.01000000.0000001E.sdmp, Offset: 00007FFDFAE20000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 00000001.00000002.1896301415.00007FFDFAE20000.00000002.00000001.01000000.0000001E.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000001.00000002.1896332214.00007FFDFAF73000.00000040.00000001.01000000.0000001E.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000001.00000002.1896332214.00007FFDFAF75000.00000040.00000001.01000000.0000001E.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000001.00000002.1896332214.00007FFDFAF8A000.00000040.00000001.01000000.0000001E.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000001.00000002.1896536596.00007FFDFAF8C000.00000080.00000001.01000000.0000001E.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000001.00000002.1896632509.00007FFDFAF8E000.00000004.00000001.01000000.0000001E.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_1_2_7ffdfae20000_NEVER OPEN!.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: 00007B5630
                                                                                                                                                                                                                                              • String ID: ValueList$p
                                                                                                                                                                                                                                              • API String ID: 2248877218-635946892
                                                                                                                                                                                                                                              • Opcode ID: ec54ab2dcaf1dbcc276f08fffb0a91cf1cefc7b65af78ff2562e2f8050cd1ace
                                                                                                                                                                                                                                              • Instruction ID: 05f2e8369ab5383867fc97eafd2c8cb7b03c53d1dcec99b371d80fe0734b3b9d
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: ec54ab2dcaf1dbcc276f08fffb0a91cf1cefc7b65af78ff2562e2f8050cd1ace
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: C061E722B0C78289EB78EB25A16057D63A5FB54780F084175EF9E876DADF3EE851C310
                                                                                                                                                                                                                                              Function 00007FF619BE4C64 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 121COMMON
                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 00000001.00000002.1895497148.00007FF619BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF619BC0000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 00000001.00000002.1895473888.00007FF619BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000001.00000002.1895544098.00007FF619BEA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000001.00000002.1895573832.00007FF619BFD000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000001.00000002.1895573832.00007FF619C00000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000001.00000002.1895573832.00007FF619C0C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000001.00000002.1895651091.00007FF619C0E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_1_2_7ff619bc0000_NEVER OPEN!.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: _get_daylight$_invalid_parameter_noinfo
                                                                                                                                                                                                                                              • String ID: ?
                                                                                                                                                                                                                                              • API String ID: 1286766494-1684325040
                                                                                                                                                                                                                                              • Opcode ID: b8d6a34db39086a1bc09037acb0fb6ecb033c7e054d1beef66f59ff13dd07971
                                                                                                                                                                                                                                              • Instruction ID: 03828a301baadf5510d9b0555910a434e70cef00c9dd957da0be43526b6b4673
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: b8d6a34db39086a1bc09037acb0fb6ecb033c7e054d1beef66f59ff13dd07971
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 5141D522A18A8A46FB349F26950137B76A6EB82FBCF144275EF5C87BD5DE3CD4418700
                                                                                                                                                                                                                                              Function 00007FF619BD81C4 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 111COMMON
                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                              • _invalid_parameter_noinfo.LIBCMT ref: 00007FF619BD81F6
                                                                                                                                                                                                                                                • Part of subcall function 00007FF619BDA168: RtlFreeHeap.NTDLL(?,?,?,00007FF619BE214A,?,?,?,00007FF619BE2187,?,?,00000000,00007FF619BE2658,?,?,?,00007FF619BE258B), ref: 00007FF619BDA17E
                                                                                                                                                                                                                                                • Part of subcall function 00007FF619BDA168: GetLastError.KERNEL32(?,?,?,00007FF619BE214A,?,?,?,00007FF619BE2187,?,?,00000000,00007FF619BE2658,?,?,?,00007FF619BE258B), ref: 00007FF619BDA188
                                                                                                                                                                                                                                              • GetModuleFileNameW.KERNEL32(?,?,?,?,?,00007FF619BCAD95), ref: 00007FF619BD8214
                                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 00000001.00000002.1895497148.00007FF619BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF619BC0000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 00000001.00000002.1895473888.00007FF619BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000001.00000002.1895544098.00007FF619BEA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000001.00000002.1895573832.00007FF619BFD000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000001.00000002.1895573832.00007FF619C00000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000001.00000002.1895573832.00007FF619C0C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000001.00000002.1895651091.00007FF619C0E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_1_2_7ff619bc0000_NEVER OPEN!.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: ErrorFileFreeHeapLastModuleName_invalid_parameter_noinfo
                                                                                                                                                                                                                                              • String ID: C:\Users\user\Desktop\NEVER OPEN!.exe
                                                                                                                                                                                                                                              • API String ID: 3580290477-2776542587
                                                                                                                                                                                                                                              • Opcode ID: a569e0f71f981bad276fe3f434ff04fe9e086a79f036720f8d17ec2165486d27
                                                                                                                                                                                                                                              • Instruction ID: 0c9fb4a3757f411f50d4d6731a49b63bf1298d5475cfbd9ff44549e90e482651
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: a569e0f71f981bad276fe3f434ff04fe9e086a79f036720f8d17ec2165486d27
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 92415D76A08F5685EB249F2598500BA27E4EF46FACF584035E94DC7B95DF3CE4818301
                                                                                                                                                                                                                                              Function 00007FFDFAE7DBC0 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 102COMMON
                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 00000001.00000002.1896332214.00007FFDFAE21000.00000040.00000001.01000000.0000001E.sdmp, Offset: 00007FFDFAE20000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 00000001.00000002.1896301415.00007FFDFAE20000.00000002.00000001.01000000.0000001E.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000001.00000002.1896332214.00007FFDFAF73000.00000040.00000001.01000000.0000001E.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000001.00000002.1896332214.00007FFDFAF75000.00000040.00000001.01000000.0000001E.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000001.00000002.1896332214.00007FFDFAF8A000.00000040.00000001.01000000.0000001E.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000001.00000002.1896536596.00007FFDFAF8C000.00000080.00000001.01000000.0000001E.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000001.00000002.1896632509.00007FFDFAF8E000.00000004.00000001.01000000.0000001E.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_1_2_7ffdfae20000_NEVER OPEN!.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: 00007A4519
                                                                                                                                                                                                                                              • String ID: cannot use RETURNING in a trigger$sqlite_returning
                                                                                                                                                                                                                                              • API String ID: 817585512-753984552
                                                                                                                                                                                                                                              • Opcode ID: fdec11c7197a456548632f2fca8cf86b21427a6bb078024ab09983aebce74e3b
                                                                                                                                                                                                                                              • Instruction ID: 261e8e4f075ffe983d0dff3e7953bc62ea18416aeaed12b765240063da655705
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: fdec11c7197a456548632f2fca8cf86b21427a6bb078024ab09983aebce74e3b
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: AC416F31B09B4186E76DAB11E1A0BB973A0FB48B80F444271DBAE07799DF7DE461C701
                                                                                                                                                                                                                                              Function 00007FF619BDC48C Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 100fileCOMMON
                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 00000001.00000002.1895497148.00007FF619BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF619BC0000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 00000001.00000002.1895473888.00007FF619BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000001.00000002.1895544098.00007FF619BEA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000001.00000002.1895573832.00007FF619BFD000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000001.00000002.1895573832.00007FF619C00000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000001.00000002.1895573832.00007FF619C0C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000001.00000002.1895651091.00007FF619C0E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_1_2_7ff619bc0000_NEVER OPEN!.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: ErrorFileLastWrite
                                                                                                                                                                                                                                              • String ID: U
                                                                                                                                                                                                                                              • API String ID: 442123175-4171548499
                                                                                                                                                                                                                                              • Opcode ID: 67252725bafe0fa8bf31364f03df59fb9b2e68de5134f9a7070a1cd20fbc7f94
                                                                                                                                                                                                                                              • Instruction ID: 22321d87725aa2051f57942ca6d4aa9835da4d6a5ef03690e2191764b912766c
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 67252725bafe0fa8bf31364f03df59fb9b2e68de5134f9a7070a1cd20fbc7f94
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 4341A232A18A4582DB20CF65E8453AA77A5FB99BACF844035EE4EC7794DF3CD541C740
                                                                                                                                                                                                                                              Function 00007FF619BDE8A8 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 66COMMON
                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 00000001.00000002.1895497148.00007FF619BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF619BC0000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 00000001.00000002.1895473888.00007FF619BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000001.00000002.1895544098.00007FF619BEA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000001.00000002.1895573832.00007FF619BFD000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000001.00000002.1895573832.00007FF619C00000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000001.00000002.1895573832.00007FF619C0C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000001.00000002.1895651091.00007FF619C0E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_1_2_7ff619bc0000_NEVER OPEN!.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: CurrentDirectory
                                                                                                                                                                                                                                              • String ID: :
                                                                                                                                                                                                                                              • API String ID: 1611563598-336475711
                                                                                                                                                                                                                                              • Opcode ID: e4b12e381cc831d5ce4d339bd1df38500ebef789e24aff63a0be25ae4ea8331d
                                                                                                                                                                                                                                              • Instruction ID: 84aaca8b24a7f919da834f0f5949ac4c6f0c28dd199f11089bc90c8ea1bb6561
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: e4b12e381cc831d5ce4d339bd1df38500ebef789e24aff63a0be25ae4ea8331d
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: FE21B122A08A8A82EB709F15D44827F63E5FB86F9CF858035DA8D83385CF7CE945C750
                                                                                                                                                                                                                                              Function 00007FF619BC2880 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 55windowCOMMON
                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 00000001.00000002.1895497148.00007FF619BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF619BC0000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 00000001.00000002.1895473888.00007FF619BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000001.00000002.1895544098.00007FF619BEA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000001.00000002.1895573832.00007FF619BFD000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000001.00000002.1895573832.00007FF619C00000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000001.00000002.1895573832.00007FF619C0C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000001.00000002.1895651091.00007FF619C0E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_1_2_7ff619bc0000_NEVER OPEN!.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: Message$ByteCharMultiWide
                                                                                                                                                                                                                                              • String ID: Error detected
                                                                                                                                                                                                                                              • API String ID: 1878133881-3513342764
                                                                                                                                                                                                                                              • Opcode ID: 18eadb67fbb2c3cbef872a99c290c15a109ae082efd03a83ae2dadf328579188
                                                                                                                                                                                                                                              • Instruction ID: 98b1ed5e84292c9642fe6d84010e5ecb9c426467469c046eb453f9aeada07b42
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 18eadb67fbb2c3cbef872a99c290c15a109ae082efd03a83ae2dadf328579188
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 7B21B272628A8681E7309B11F4503EB6368FB85B9CF805035EA8D87A99CF3CD205C740
                                                                                                                                                                                                                                              Function 00007FF619BC2770 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 55windowCOMMON
                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 00000001.00000002.1895497148.00007FF619BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF619BC0000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 00000001.00000002.1895473888.00007FF619BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000001.00000002.1895544098.00007FF619BEA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000001.00000002.1895573832.00007FF619BFD000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000001.00000002.1895573832.00007FF619C00000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000001.00000002.1895573832.00007FF619C0C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000001.00000002.1895651091.00007FF619C0E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_1_2_7ff619bc0000_NEVER OPEN!.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: Message$ByteCharMultiWide
                                                                                                                                                                                                                                              • String ID: Fatal error detected
                                                                                                                                                                                                                                              • API String ID: 1878133881-4025702859
                                                                                                                                                                                                                                              • Opcode ID: ac47e685d134c055f7f1d81993406eeced8960994c7a98791e9bcb406dc1c58f
                                                                                                                                                                                                                                              • Instruction ID: b59531e00a11e5213de59feb1d7e7c42114e5ec6079ad4ec956f26c30c5a51e5
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: ac47e685d134c055f7f1d81993406eeced8960994c7a98791e9bcb406dc1c58f
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 9F216072628A8691EB309B11F4517EB6368FB85B9CF805135EA8D87A99DF3CD205CB40
                                                                                                                                                                                                                                              Function 00007FF619BCEED0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 42COMMON
                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 00000001.00000002.1895497148.00007FF619BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF619BC0000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 00000001.00000002.1895473888.00007FF619BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000001.00000002.1895544098.00007FF619BEA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000001.00000002.1895573832.00007FF619BFD000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000001.00000002.1895573832.00007FF619C00000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000001.00000002.1895573832.00007FF619C0C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000001.00000002.1895651091.00007FF619C0E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_1_2_7ff619bc0000_NEVER OPEN!.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: ExceptionFileHeaderRaise
                                                                                                                                                                                                                                              • String ID: csm
                                                                                                                                                                                                                                              • API String ID: 2573137834-1018135373
                                                                                                                                                                                                                                              • Opcode ID: f2f421f33013e271a98c8c3cf8ccb065ddc751b20d67eed513ec00e007a6c83c
                                                                                                                                                                                                                                              • Instruction ID: b0484badf860f67e3c887c05944cca03ebdd24dbccdfbe6adaeeaa3b415f3477
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: f2f421f33013e271a98c8c3cf8ccb065ddc751b20d67eed513ec00e007a6c83c
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: B8114F32618F4582EB218F15E54026A77A4FB89FA8F184234EE8C47764DF3CE951CB00
                                                                                                                                                                                                                                              Function 00007FF619BDF37C Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 34COMMON
                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 00000001.00000002.1895497148.00007FF619BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF619BC0000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 00000001.00000002.1895473888.00007FF619BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000001.00000002.1895544098.00007FF619BEA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000001.00000002.1895573832.00007FF619BFD000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000001.00000002.1895573832.00007FF619C00000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000001.00000002.1895573832.00007FF619C0C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000001.00000002.1895651091.00007FF619C0E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_1_2_7ff619bc0000_NEVER OPEN!.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: _invalid_parameter_noinfo
                                                                                                                                                                                                                                              • String ID: :
                                                                                                                                                                                                                                              • API String ID: 3215553584-336475711
                                                                                                                                                                                                                                              • Opcode ID: b117a36f57bb58375fdb7b4df102a580f1cf3bacb37996ca0fb675bd0c3d3589
                                                                                                                                                                                                                                              • Instruction ID: 12432e5533f731889c74c77a3fff5f7afe1d5de7c833e065cdffacb6d9ff7c39
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: b117a36f57bb58375fdb7b4df102a580f1cf3bacb37996ca0fb675bd0c3d3589
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 8F01AD6292CA4A82F730AF60A4622BF63A0EF5AF2CF810035D94DC6785DF2CE5048B14

                                                                                                                                                                                                                                              Execution Graph

                                                                                                                                                                                                                                              Execution Coverage:12.3%
                                                                                                                                                                                                                                              Dynamic/Decrypted Code Coverage:0%
                                                                                                                                                                                                                                              Signature Coverage:0%
                                                                                                                                                                                                                                              Total number of Nodes:2000
                                                                                                                                                                                                                                              Total number of Limit Nodes:64
                                                                                                                                                                                                                                              execution_graph 18473 7ff670a8a7e0 18474 7ff670a8a7fa 18473->18474 18475 7ff670a8a7e5 18473->18475 18479 7ff670a8a800 18475->18479 18480 7ff670a8a84a 18479->18480 18481 7ff670a8a842 18479->18481 18483 7ff670a8a168 __free_lconv_num 11 API calls 18480->18483 18482 7ff670a8a168 __free_lconv_num 11 API calls 18481->18482 18482->18480 18484 7ff670a8a857 18483->18484 18485 7ff670a8a168 __free_lconv_num 11 API calls 18484->18485 18486 7ff670a8a864 18485->18486 18487 7ff670a8a168 __free_lconv_num 11 API calls 18486->18487 18488 7ff670a8a871 18487->18488 18489 7ff670a8a168 __free_lconv_num 11 API calls 18488->18489 18490 7ff670a8a87e 18489->18490 18491 7ff670a8a168 __free_lconv_num 11 API calls 18490->18491 18492 7ff670a8a88b 18491->18492 18493 7ff670a8a168 __free_lconv_num 11 API calls 18492->18493 18494 7ff670a8a898 18493->18494 18495 7ff670a8a168 __free_lconv_num 11 API calls 18494->18495 18496 7ff670a8a8a5 18495->18496 18497 7ff670a8a168 __free_lconv_num 11 API calls 18496->18497 18498 7ff670a8a8b5 18497->18498 18499 7ff670a8a168 __free_lconv_num 11 API calls 18498->18499 18500 7ff670a8a8c5 18499->18500 18505 7ff670a8a6b0 18500->18505 18519 7ff670a8fac8 EnterCriticalSection 18505->18519 17784 7ff670a8fd48 17785 7ff670a8fd6c 17784->17785 17788 7ff670a8fd7c 17784->17788 17786 7ff670a841f4 _get_daylight 11 API calls 17785->17786 17787 7ff670a8fd71 17786->17787 17789 7ff670a9005c 17788->17789 17791 7ff670a8fd9e 17788->17791 17790 7ff670a841f4 _get_daylight 11 API calls 17789->17790 17792 7ff670a90061 17790->17792 17793 7ff670a8fdbf 17791->17793 17915 7ff670a90404 17791->17915 17794 7ff670a8a168 __free_lconv_num 11 API calls 17792->17794 17796 7ff670a8fe31 17793->17796 17797 7ff670a8fde5 17793->17797 17813 7ff670a8fe25 17793->17813 17794->17787 17799 7ff670a8e0e0 _get_daylight 11 API calls 17796->17799 17811 7ff670a8fdf4 17796->17811 17930 7ff670a88870 17797->17930 17801 7ff670a8fe47 17799->17801 17805 7ff670a8a168 __free_lconv_num 11 API calls 17801->17805 17803 7ff670a8fede 17808 7ff670a8fefb 17803->17808 17815 7ff670a8ff4d 17803->17815 17804 7ff670a8a168 __free_lconv_num 11 API calls 17804->17787 17809 7ff670a8fe55 17805->17809 17806 7ff670a8fdef 17810 7ff670a841f4 _get_daylight 11 API calls 17806->17810 17807 7ff670a8fe0d 17807->17813 17814 7ff670a90404 45 API calls 17807->17814 17812 7ff670a8a168 __free_lconv_num 11 API calls 17808->17812 17809->17811 17809->17813 17818 7ff670a8e0e0 _get_daylight 11 API calls 17809->17818 17810->17811 17811->17804 17816 7ff670a8ff04 17812->17816 17813->17803 17813->17811 17936 7ff670a963c8 17813->17936 17814->17813 17815->17811 17817 7ff670a92810 40 API calls 17815->17817 17825 7ff670a8ff09 17816->17825 17972 7ff670a92810 17816->17972 17819 7ff670a8ff8a 17817->17819 17821 7ff670a8fe77 17818->17821 17822 7ff670a8a168 __free_lconv_num 11 API calls 17819->17822 17827 7ff670a8a168 __free_lconv_num 11 API calls 17821->17827 17823 7ff670a8ff94 17822->17823 17823->17811 17823->17825 17824 7ff670a90050 17829 7ff670a8a168 __free_lconv_num 11 API calls 17824->17829 17825->17824 17830 7ff670a8e0e0 _get_daylight 11 API calls 17825->17830 17826 7ff670a8ff35 17828 7ff670a8a168 __free_lconv_num 11 API calls 17826->17828 17827->17813 17828->17825 17829->17787 17831 7ff670a8ffd8 17830->17831 17832 7ff670a8ffe0 17831->17832 17833 7ff670a8ffe9 17831->17833 17834 7ff670a8a168 __free_lconv_num 11 API calls 17832->17834 17835 7ff670a8950c __std_exception_copy 37 API calls 17833->17835 17836 7ff670a8ffe7 17834->17836 17837 7ff670a8fff8 17835->17837 17842 7ff670a8a168 __free_lconv_num 11 API calls 17836->17842 17838 7ff670a90000 17837->17838 17839 7ff670a9008b 17837->17839 17981 7ff670a964e0 17838->17981 17841 7ff670a8a120 _wfindfirst32i64 17 API calls 17839->17841 17844 7ff670a9009f 17841->17844 17842->17787 17847 7ff670a900c8 17844->17847 17853 7ff670a900d8 17844->17853 17845 7ff670a90027 17848 7ff670a841f4 _get_daylight 11 API calls 17845->17848 17846 7ff670a90048 17850 7ff670a8a168 __free_lconv_num 11 API calls 17846->17850 17849 7ff670a841f4 _get_daylight 11 API calls 17847->17849 17851 7ff670a9002c 17848->17851 17877 7ff670a900cd 17849->17877 17850->17824 17852 7ff670a8a168 __free_lconv_num 11 API calls 17851->17852 17852->17836 17854 7ff670a903ba 17853->17854 17856 7ff670a900fa 17853->17856 17855 7ff670a841f4 _get_daylight 11 API calls 17854->17855 17858 7ff670a903bf 17855->17858 17857 7ff670a90117 17856->17857 18000 7ff670a904ec 17856->18000 17861 7ff670a9018b 17857->17861 17863 7ff670a9013f 17857->17863 17867 7ff670a9017f 17857->17867 17860 7ff670a8a168 __free_lconv_num 11 API calls 17858->17860 17860->17877 17865 7ff670a901b3 17861->17865 17868 7ff670a8e0e0 _get_daylight 11 API calls 17861->17868 17884 7ff670a9014e 17861->17884 17862 7ff670a9023e 17876 7ff670a9025b 17862->17876 17885 7ff670a902ae 17862->17885 18015 7ff670a888ac 17863->18015 17865->17867 17870 7ff670a8e0e0 _get_daylight 11 API calls 17865->17870 17865->17884 17867->17862 17867->17884 18021 7ff670a96288 17867->18021 17872 7ff670a901a5 17868->17872 17875 7ff670a901d5 17870->17875 17871 7ff670a8a168 __free_lconv_num 11 API calls 17871->17877 17878 7ff670a8a168 __free_lconv_num 11 API calls 17872->17878 17873 7ff670a90167 17873->17867 17883 7ff670a904ec 45 API calls 17873->17883 17874 7ff670a90149 17879 7ff670a841f4 _get_daylight 11 API calls 17874->17879 17880 7ff670a8a168 __free_lconv_num 11 API calls 17875->17880 17881 7ff670a8a168 __free_lconv_num 11 API calls 17876->17881 17878->17865 17879->17884 17880->17867 17882 7ff670a90264 17881->17882 17889 7ff670a92810 40 API calls 17882->17889 17892 7ff670a9026a 17882->17892 17883->17867 17884->17871 17885->17884 17886 7ff670a92810 40 API calls 17885->17886 17887 7ff670a902ec 17886->17887 17888 7ff670a8a168 __free_lconv_num 11 API calls 17887->17888 17890 7ff670a902f6 17888->17890 17893 7ff670a90296 17889->17893 17890->17884 17890->17892 17891 7ff670a903ae 17895 7ff670a8a168 __free_lconv_num 11 API calls 17891->17895 17892->17891 17896 7ff670a8e0e0 _get_daylight 11 API calls 17892->17896 17894 7ff670a8a168 __free_lconv_num 11 API calls 17893->17894 17894->17892 17895->17877 17897 7ff670a9033b 17896->17897 17898 7ff670a90343 17897->17898 17899 7ff670a9034c 17897->17899 17900 7ff670a8a168 __free_lconv_num 11 API calls 17898->17900 17901 7ff670a8fc64 _wfindfirst32i64 37 API calls 17899->17901 17903 7ff670a9034a 17900->17903 17902 7ff670a9035a 17901->17902 17904 7ff670a903ee 17902->17904 17905 7ff670a90362 SetEnvironmentVariableW 17902->17905 17909 7ff670a8a168 __free_lconv_num 11 API calls 17903->17909 17908 7ff670a8a120 _wfindfirst32i64 17 API calls 17904->17908 17906 7ff670a90385 17905->17906 17907 7ff670a903a6 17905->17907 17910 7ff670a841f4 _get_daylight 11 API calls 17906->17910 17912 7ff670a8a168 __free_lconv_num 11 API calls 17907->17912 17911 7ff670a90402 17908->17911 17909->17877 17913 7ff670a9038a 17910->17913 17912->17891 17914 7ff670a8a168 __free_lconv_num 11 API calls 17913->17914 17914->17903 17916 7ff670a90439 17915->17916 17922 7ff670a90421 17915->17922 17917 7ff670a8e0e0 _get_daylight 11 API calls 17916->17917 17925 7ff670a9045d 17917->17925 17918 7ff670a904be 17921 7ff670a8a168 __free_lconv_num 11 API calls 17918->17921 17919 7ff670a8956c __FrameHandler3::FrameUnwindToEmptyState 45 API calls 17920 7ff670a904e8 17919->17920 17921->17922 17922->17793 17923 7ff670a8e0e0 _get_daylight 11 API calls 17923->17925 17924 7ff670a8a168 __free_lconv_num 11 API calls 17924->17925 17925->17918 17925->17923 17925->17924 17926 7ff670a8950c __std_exception_copy 37 API calls 17925->17926 17927 7ff670a904cd 17925->17927 17929 7ff670a904e2 17925->17929 17926->17925 17928 7ff670a8a120 _wfindfirst32i64 17 API calls 17927->17928 17928->17929 17929->17919 17931 7ff670a88880 17930->17931 17934 7ff670a88889 17930->17934 17931->17934 18045 7ff670a88348 17931->18045 17934->17806 17934->17807 17937 7ff670a963d5 17936->17937 17938 7ff670a9557c 17936->17938 17940 7ff670a847cc 45 API calls 17937->17940 17939 7ff670a95589 17938->17939 17945 7ff670a955bf 17938->17945 17942 7ff670a841f4 _get_daylight 11 API calls 17939->17942 17960 7ff670a95530 17939->17960 17941 7ff670a96409 17940->17941 17944 7ff670a9640e 17941->17944 17948 7ff670a9641f 17941->17948 17953 7ff670a96436 17941->17953 17946 7ff670a95593 17942->17946 17943 7ff670a955e9 17947 7ff670a841f4 _get_daylight 11 API calls 17943->17947 17944->17813 17945->17943 17949 7ff670a9560e 17945->17949 17950 7ff670a8a100 _invalid_parameter_noinfo 37 API calls 17946->17950 17951 7ff670a955ee 17947->17951 17954 7ff670a841f4 _get_daylight 11 API calls 17948->17954 17957 7ff670a847cc 45 API calls 17949->17957 17964 7ff670a955f9 17949->17964 17955 7ff670a9559e 17950->17955 17952 7ff670a8a100 _invalid_parameter_noinfo 37 API calls 17951->17952 17952->17964 17958 7ff670a96440 17953->17958 17959 7ff670a96452 17953->17959 17956 7ff670a96424 17954->17956 17955->17813 17963 7ff670a8a100 _invalid_parameter_noinfo 37 API calls 17956->17963 17957->17964 17965 7ff670a841f4 _get_daylight 11 API calls 17958->17965 17961 7ff670a96463 17959->17961 17962 7ff670a9647a 17959->17962 17960->17813 18280 7ff670a955cc 17961->18280 18289 7ff670a98288 17962->18289 17963->17944 17964->17813 17968 7ff670a96445 17965->17968 17970 7ff670a8a100 _invalid_parameter_noinfo 37 API calls 17968->17970 17970->17944 17971 7ff670a841f4 _get_daylight 11 API calls 17971->17944 17973 7ff670a9284f 17972->17973 17974 7ff670a92832 17972->17974 17975 7ff670a92859 17973->17975 18329 7ff670a96ec8 17973->18329 17974->17973 17976 7ff670a92840 17974->17976 18336 7ff670a8fccc 17975->18336 17977 7ff670a841f4 _get_daylight 11 API calls 17976->17977 17980 7ff670a92845 __scrt_get_show_window_mode 17977->17980 17980->17826 17982 7ff670a847cc 45 API calls 17981->17982 17983 7ff670a96546 17982->17983 17984 7ff670a96554 17983->17984 17985 7ff670a8e370 5 API calls 17983->17985 17986 7ff670a842b4 14 API calls 17984->17986 17985->17984 17987 7ff670a965b0 17986->17987 17988 7ff670a96640 17987->17988 17989 7ff670a847cc 45 API calls 17987->17989 17991 7ff670a96651 17988->17991 17992 7ff670a8a168 __free_lconv_num 11 API calls 17988->17992 17990 7ff670a965c3 17989->17990 17994 7ff670a8e370 5 API calls 17990->17994 17997 7ff670a965cc 17990->17997 17993 7ff670a90023 17991->17993 17995 7ff670a8a168 __free_lconv_num 11 API calls 17991->17995 17992->17991 17993->17845 17993->17846 17994->17997 17995->17993 17996 7ff670a842b4 14 API calls 17998 7ff670a96627 17996->17998 17997->17996 17998->17988 17999 7ff670a9662f SetEnvironmentVariableW 17998->17999 17999->17988 18001 7ff670a9050f 18000->18001 18002 7ff670a9052c 18000->18002 18001->17857 18003 7ff670a8e0e0 _get_daylight 11 API calls 18002->18003 18010 7ff670a90550 18003->18010 18004 7ff670a905d4 18005 7ff670a8956c __FrameHandler3::FrameUnwindToEmptyState 45 API calls 18004->18005 18007 7ff670a905da 18005->18007 18006 7ff670a905b1 18008 7ff670a8a168 __free_lconv_num 11 API calls 18006->18008 18008->18001 18009 7ff670a8e0e0 _get_daylight 11 API calls 18009->18010 18010->18004 18010->18006 18010->18009 18011 7ff670a8a168 __free_lconv_num 11 API calls 18010->18011 18012 7ff670a8fc64 _wfindfirst32i64 37 API calls 18010->18012 18013 7ff670a905c0 18010->18013 18011->18010 18012->18010 18014 7ff670a8a120 _wfindfirst32i64 17 API calls 18013->18014 18014->18004 18016 7ff670a888bc 18015->18016 18019 7ff670a888c5 18015->18019 18016->18019 18348 7ff670a883bc 18016->18348 18019->17873 18019->17874 18022 7ff670a96295 18021->18022 18025 7ff670a962c2 18021->18025 18023 7ff670a9629a 18022->18023 18022->18025 18024 7ff670a841f4 _get_daylight 11 API calls 18023->18024 18027 7ff670a9629f 18024->18027 18026 7ff670a96306 18025->18026 18029 7ff670a96325 18025->18029 18043 7ff670a962fa __crtLCMapStringW 18025->18043 18028 7ff670a841f4 _get_daylight 11 API calls 18026->18028 18030 7ff670a8a100 _invalid_parameter_noinfo 37 API calls 18027->18030 18031 7ff670a9630b 18028->18031 18032 7ff670a9632f 18029->18032 18033 7ff670a96341 18029->18033 18034 7ff670a962aa 18030->18034 18035 7ff670a8a100 _invalid_parameter_noinfo 37 API calls 18031->18035 18036 7ff670a841f4 _get_daylight 11 API calls 18032->18036 18037 7ff670a847cc 45 API calls 18033->18037 18034->17867 18035->18043 18038 7ff670a96334 18036->18038 18039 7ff670a9634e 18037->18039 18040 7ff670a8a100 _invalid_parameter_noinfo 37 API calls 18038->18040 18039->18043 18395 7ff670a97e48 18039->18395 18040->18043 18043->17867 18044 7ff670a841f4 _get_daylight 11 API calls 18044->18043 18046 7ff670a88361 18045->18046 18047 7ff670a8835d 18045->18047 18068 7ff670a91a60 18046->18068 18047->17934 18060 7ff670a8869c 18047->18060 18052 7ff670a8837f 18094 7ff670a8842c 18052->18094 18053 7ff670a88373 18055 7ff670a8a168 __free_lconv_num 11 API calls 18053->18055 18055->18047 18057 7ff670a8a168 __free_lconv_num 11 API calls 18058 7ff670a883a6 18057->18058 18059 7ff670a8a168 __free_lconv_num 11 API calls 18058->18059 18059->18047 18061 7ff670a886c5 18060->18061 18062 7ff670a886de 18060->18062 18061->17934 18062->18061 18063 7ff670a8e0e0 _get_daylight 11 API calls 18062->18063 18064 7ff670a8876e 18062->18064 18065 7ff670a8f424 WideCharToMultiByte 18062->18065 18067 7ff670a8a168 __free_lconv_num 11 API calls 18062->18067 18063->18062 18066 7ff670a8a168 __free_lconv_num 11 API calls 18064->18066 18065->18062 18066->18061 18067->18062 18069 7ff670a88366 18068->18069 18070 7ff670a91a6d 18068->18070 18074 7ff670a91d9c GetEnvironmentStringsW 18069->18074 18113 7ff670a8aa34 18070->18113 18075 7ff670a8836b 18074->18075 18076 7ff670a91dcc 18074->18076 18075->18052 18075->18053 18077 7ff670a8f424 WideCharToMultiByte 18076->18077 18078 7ff670a91e1d 18077->18078 18079 7ff670a91e24 FreeEnvironmentStringsW 18078->18079 18080 7ff670a8ce50 _fread_nolock 12 API calls 18078->18080 18079->18075 18081 7ff670a91e37 18080->18081 18082 7ff670a91e3f 18081->18082 18083 7ff670a91e48 18081->18083 18084 7ff670a8a168 __free_lconv_num 11 API calls 18082->18084 18085 7ff670a8f424 WideCharToMultiByte 18083->18085 18086 7ff670a91e46 18084->18086 18087 7ff670a91e6b 18085->18087 18086->18079 18088 7ff670a91e6f 18087->18088 18089 7ff670a91e79 18087->18089 18090 7ff670a8a168 __free_lconv_num 11 API calls 18088->18090 18091 7ff670a8a168 __free_lconv_num 11 API calls 18089->18091 18092 7ff670a91e77 FreeEnvironmentStringsW 18090->18092 18091->18092 18092->18075 18095 7ff670a88451 18094->18095 18096 7ff670a8e0e0 _get_daylight 11 API calls 18095->18096 18107 7ff670a88487 18096->18107 18097 7ff670a8848f 18098 7ff670a8a168 __free_lconv_num 11 API calls 18097->18098 18099 7ff670a88387 18098->18099 18099->18057 18100 7ff670a88502 18101 7ff670a8a168 __free_lconv_num 11 API calls 18100->18101 18101->18099 18102 7ff670a8e0e0 _get_daylight 11 API calls 18102->18107 18103 7ff670a884f1 18274 7ff670a88658 18103->18274 18104 7ff670a8950c __std_exception_copy 37 API calls 18104->18107 18107->18097 18107->18100 18107->18102 18107->18103 18107->18104 18108 7ff670a88527 18107->18108 18111 7ff670a8a168 __free_lconv_num 11 API calls 18107->18111 18110 7ff670a8a120 _wfindfirst32i64 17 API calls 18108->18110 18109 7ff670a8a168 __free_lconv_num 11 API calls 18109->18097 18112 7ff670a8853a 18110->18112 18111->18107 18114 7ff670a8aa60 FlsSetValue 18113->18114 18115 7ff670a8aa45 FlsGetValue 18113->18115 18116 7ff670a8aa52 18114->18116 18118 7ff670a8aa6d 18114->18118 18115->18116 18117 7ff670a8aa5a 18115->18117 18119 7ff670a8aa58 18116->18119 18120 7ff670a8956c __FrameHandler3::FrameUnwindToEmptyState 45 API calls 18116->18120 18117->18114 18121 7ff670a8e0e0 _get_daylight 11 API calls 18118->18121 18133 7ff670a91738 18119->18133 18122 7ff670a8aad5 18120->18122 18123 7ff670a8aa7c 18121->18123 18124 7ff670a8aa9a FlsSetValue 18123->18124 18125 7ff670a8aa8a FlsSetValue 18123->18125 18127 7ff670a8aaa6 FlsSetValue 18124->18127 18128 7ff670a8aab8 18124->18128 18126 7ff670a8aa93 18125->18126 18130 7ff670a8a168 __free_lconv_num 11 API calls 18126->18130 18127->18126 18129 7ff670a8a710 _get_daylight 11 API calls 18128->18129 18131 7ff670a8aac0 18129->18131 18130->18116 18132 7ff670a8a168 __free_lconv_num 11 API calls 18131->18132 18132->18119 18156 7ff670a919a8 18133->18156 18135 7ff670a9176d 18171 7ff670a91438 18135->18171 18138 7ff670a9178a 18138->18069 18139 7ff670a8ce50 _fread_nolock 12 API calls 18140 7ff670a9179b 18139->18140 18141 7ff670a917a3 18140->18141 18143 7ff670a917b2 18140->18143 18142 7ff670a8a168 __free_lconv_num 11 API calls 18141->18142 18142->18138 18143->18143 18178 7ff670a91adc 18143->18178 18146 7ff670a918ae 18147 7ff670a841f4 _get_daylight 11 API calls 18146->18147 18149 7ff670a918b3 18147->18149 18148 7ff670a91909 18151 7ff670a91970 18148->18151 18189 7ff670a91268 18148->18189 18152 7ff670a8a168 __free_lconv_num 11 API calls 18149->18152 18150 7ff670a918c8 18150->18148 18153 7ff670a8a168 __free_lconv_num 11 API calls 18150->18153 18155 7ff670a8a168 __free_lconv_num 11 API calls 18151->18155 18152->18138 18153->18148 18155->18138 18157 7ff670a919cb 18156->18157 18160 7ff670a919d5 18157->18160 18204 7ff670a8fac8 EnterCriticalSection 18157->18204 18159 7ff670a91a47 18159->18135 18160->18159 18161 7ff670a8956c __FrameHandler3::FrameUnwindToEmptyState 45 API calls 18160->18161 18165 7ff670a91a5f 18161->18165 18166 7ff670a91ab2 18165->18166 18168 7ff670a8aa34 50 API calls 18165->18168 18166->18135 18169 7ff670a91a9c 18168->18169 18170 7ff670a91738 65 API calls 18169->18170 18170->18166 18172 7ff670a847cc 45 API calls 18171->18172 18173 7ff670a9144c 18172->18173 18174 7ff670a91458 GetOEMCP 18173->18174 18175 7ff670a9146a 18173->18175 18176 7ff670a9147f 18174->18176 18175->18176 18177 7ff670a9146f GetACP 18175->18177 18176->18138 18176->18139 18177->18176 18179 7ff670a91438 47 API calls 18178->18179 18180 7ff670a91b09 18179->18180 18182 7ff670a91b46 IsValidCodePage 18180->18182 18186 7ff670a91b89 __scrt_get_show_window_mode 18180->18186 18181 7ff670a7acc0 _wfindfirst32i64 8 API calls 18183 7ff670a918a5 18181->18183 18184 7ff670a91b57 18182->18184 18182->18186 18183->18146 18183->18150 18185 7ff670a91b8e GetCPInfo 18184->18185 18188 7ff670a91b60 __scrt_get_show_window_mode 18184->18188 18185->18186 18185->18188 18186->18181 18205 7ff670a91550 18188->18205 18273 7ff670a8fac8 EnterCriticalSection 18189->18273 18206 7ff670a9158d GetCPInfo 18205->18206 18207 7ff670a91683 18205->18207 18206->18207 18213 7ff670a915a0 18206->18213 18208 7ff670a7acc0 _wfindfirst32i64 8 API calls 18207->18208 18210 7ff670a91722 18208->18210 18210->18186 18216 7ff670a92268 18213->18216 18215 7ff670a96e10 54 API calls 18215->18207 18217 7ff670a847cc 45 API calls 18216->18217 18218 7ff670a922aa 18217->18218 18219 7ff670a8eb84 _fread_nolock MultiByteToWideChar 18218->18219 18221 7ff670a922e0 18219->18221 18220 7ff670a922e7 18223 7ff670a7acc0 _wfindfirst32i64 8 API calls 18220->18223 18221->18220 18222 7ff670a8ce50 _fread_nolock 12 API calls 18221->18222 18224 7ff670a923ae 18221->18224 18227 7ff670a92310 __scrt_get_show_window_mode 18221->18227 18222->18227 18225 7ff670a91617 18223->18225 18224->18220 18226 7ff670a8a168 __free_lconv_num 11 API calls 18224->18226 18231 7ff670a96e10 18225->18231 18226->18220 18227->18224 18228 7ff670a8eb84 _fread_nolock MultiByteToWideChar 18227->18228 18229 7ff670a92389 18228->18229 18229->18224 18230 7ff670a92394 GetStringTypeW 18229->18230 18230->18224 18232 7ff670a847cc 45 API calls 18231->18232 18233 7ff670a96e35 18232->18233 18236 7ff670a96af0 18233->18236 18237 7ff670a96b32 18236->18237 18238 7ff670a8eb84 _fread_nolock MultiByteToWideChar 18237->18238 18241 7ff670a96b7c 18238->18241 18239 7ff670a96de7 18240 7ff670a7acc0 _wfindfirst32i64 8 API calls 18239->18240 18242 7ff670a9164a 18240->18242 18241->18239 18243 7ff670a8ce50 _fread_nolock 12 API calls 18241->18243 18245 7ff670a96bb2 18241->18245 18252 7ff670a96cb4 18241->18252 18242->18215 18243->18245 18244 7ff670a8a168 __free_lconv_num 11 API calls 18244->18239 18246 7ff670a8eb84 _fread_nolock MultiByteToWideChar 18245->18246 18245->18252 18247 7ff670a96c22 18246->18247 18247->18252 18264 7ff670a8e530 18247->18264 18250 7ff670a96c71 18250->18252 18253 7ff670a8e530 __crtLCMapStringW 6 API calls 18250->18253 18251 7ff670a96cc3 18251->18252 18254 7ff670a8ce50 _fread_nolock 12 API calls 18251->18254 18255 7ff670a96ce1 18251->18255 18252->18239 18252->18244 18253->18252 18254->18255 18255->18252 18256 7ff670a8e530 __crtLCMapStringW 6 API calls 18255->18256 18258 7ff670a96d5e 18256->18258 18257 7ff670a96d93 18257->18252 18259 7ff670a8a168 __free_lconv_num 11 API calls 18257->18259 18258->18257 18260 7ff670a8f424 WideCharToMultiByte 18258->18260 18259->18252 18261 7ff670a96d8d 18260->18261 18261->18257 18262 7ff670a96dba 18261->18262 18262->18252 18263 7ff670a8a168 __free_lconv_num 11 API calls 18262->18263 18263->18252 18265 7ff670a8e158 __crtLCMapStringW 5 API calls 18264->18265 18266 7ff670a8e56e 18265->18266 18269 7ff670a8e576 18266->18269 18270 7ff670a8e61c 18266->18270 18268 7ff670a8e5df LCMapStringW 18268->18269 18269->18250 18269->18251 18269->18252 18271 7ff670a8e158 __crtLCMapStringW 5 API calls 18270->18271 18272 7ff670a8e64a __crtLCMapStringW 18271->18272 18272->18268 18275 7ff670a884f9 18274->18275 18276 7ff670a8865d 18274->18276 18275->18109 18277 7ff670a88686 18276->18277 18278 7ff670a8a168 __free_lconv_num 11 API calls 18276->18278 18279 7ff670a8a168 __free_lconv_num 11 API calls 18277->18279 18278->18276 18279->18275 18281 7ff670a955e9 18280->18281 18282 7ff670a95600 18280->18282 18283 7ff670a841f4 _get_daylight 11 API calls 18281->18283 18282->18281 18284 7ff670a9560e 18282->18284 18285 7ff670a955ee 18283->18285 18287 7ff670a847cc 45 API calls 18284->18287 18288 7ff670a955f9 18284->18288 18286 7ff670a8a100 _invalid_parameter_noinfo 37 API calls 18285->18286 18286->18288 18287->18288 18288->17944 18290 7ff670a847cc 45 API calls 18289->18290 18291 7ff670a982ad 18290->18291 18294 7ff670a97f08 18291->18294 18296 7ff670a97f56 18294->18296 18295 7ff670a7acc0 _wfindfirst32i64 8 API calls 18297 7ff670a964a1 18295->18297 18298 7ff670a97fdd 18296->18298 18300 7ff670a97fc8 GetCPInfo 18296->18300 18302 7ff670a97fe1 18296->18302 18297->17944 18297->17971 18299 7ff670a8eb84 _fread_nolock MultiByteToWideChar 18298->18299 18298->18302 18301 7ff670a98077 18299->18301 18300->18298 18300->18302 18301->18302 18303 7ff670a8ce50 _fread_nolock 12 API calls 18301->18303 18304 7ff670a980ae 18301->18304 18302->18295 18303->18304 18304->18302 18305 7ff670a8eb84 _fread_nolock MultiByteToWideChar 18304->18305 18306 7ff670a98114 18305->18306 18307 7ff670a9813d 18306->18307 18308 7ff670a8eb84 _fread_nolock MultiByteToWideChar 18306->18308 18307->18302 18309 7ff670a8a168 __free_lconv_num 11 API calls 18307->18309 18310 7ff670a98136 18308->18310 18309->18302 18310->18307 18311 7ff670a8ce50 _fread_nolock 12 API calls 18310->18311 18312 7ff670a9818b 18310->18312 18311->18312 18312->18307 18313 7ff670a8eb84 _fread_nolock MultiByteToWideChar 18312->18313 18314 7ff670a981fe 18313->18314 18315 7ff670a98221 18314->18315 18316 7ff670a98204 18314->18316 18323 7ff670a8e3b4 18315->18323 18316->18307 18318 7ff670a8a168 __free_lconv_num 11 API calls 18316->18318 18318->18307 18320 7ff670a8a168 __free_lconv_num 11 API calls 18321 7ff670a98260 18320->18321 18321->18302 18322 7ff670a8a168 __free_lconv_num 11 API calls 18321->18322 18322->18302 18324 7ff670a8e158 __crtLCMapStringW 5 API calls 18323->18324 18325 7ff670a8e3f2 18324->18325 18326 7ff670a8e3fa 18325->18326 18327 7ff670a8e61c __crtLCMapStringW 5 API calls 18325->18327 18326->18320 18326->18321 18328 7ff670a8e463 CompareStringW 18327->18328 18328->18326 18330 7ff670a96ed1 18329->18330 18331 7ff670a96eea HeapSize 18329->18331 18332 7ff670a841f4 _get_daylight 11 API calls 18330->18332 18333 7ff670a96ed6 18332->18333 18334 7ff670a8a100 _invalid_parameter_noinfo 37 API calls 18333->18334 18335 7ff670a96ee1 18334->18335 18335->17975 18337 7ff670a8fce1 18336->18337 18338 7ff670a8fceb 18336->18338 18339 7ff670a8ce50 _fread_nolock 12 API calls 18337->18339 18340 7ff670a8fcf0 18338->18340 18346 7ff670a8fcf7 _get_daylight 18338->18346 18345 7ff670a8fce9 18339->18345 18343 7ff670a8a168 __free_lconv_num 11 API calls 18340->18343 18341 7ff670a8fd2a HeapReAlloc 18341->18345 18341->18346 18342 7ff670a8fcfd 18344 7ff670a841f4 _get_daylight 11 API calls 18342->18344 18343->18345 18344->18345 18345->17980 18346->18341 18346->18342 18347 7ff670a929c0 _get_daylight 2 API calls 18346->18347 18347->18346 18349 7ff670a883d5 18348->18349 18350 7ff670a883d1 18348->18350 18369 7ff670a91eac GetEnvironmentStringsW 18349->18369 18350->18019 18361 7ff670a8877c 18350->18361 18353 7ff670a883ee 18376 7ff670a8853c 18353->18376 18354 7ff670a883e2 18355 7ff670a8a168 __free_lconv_num 11 API calls 18354->18355 18355->18350 18358 7ff670a8a168 __free_lconv_num 11 API calls 18359 7ff670a88415 18358->18359 18360 7ff670a8a168 __free_lconv_num 11 API calls 18359->18360 18360->18350 18366 7ff670a887b6 18361->18366 18367 7ff670a8879f 18361->18367 18362 7ff670a8eb84 MultiByteToWideChar _fread_nolock 18362->18366 18363 7ff670a8e0e0 _get_daylight 11 API calls 18363->18366 18364 7ff670a8882a 18365 7ff670a8a168 __free_lconv_num 11 API calls 18364->18365 18365->18367 18366->18362 18366->18363 18366->18364 18366->18367 18368 7ff670a8a168 __free_lconv_num 11 API calls 18366->18368 18367->18019 18368->18366 18370 7ff670a91ed0 18369->18370 18371 7ff670a883da 18369->18371 18372 7ff670a8ce50 _fread_nolock 12 API calls 18370->18372 18371->18353 18371->18354 18373 7ff670a91f07 memcpy_s 18372->18373 18374 7ff670a8a168 __free_lconv_num 11 API calls 18373->18374 18375 7ff670a91f27 FreeEnvironmentStringsW 18374->18375 18375->18371 18377 7ff670a88564 18376->18377 18378 7ff670a8e0e0 _get_daylight 11 API calls 18377->18378 18390 7ff670a8859f 18378->18390 18379 7ff670a885a7 18380 7ff670a8a168 __free_lconv_num 11 API calls 18379->18380 18382 7ff670a883f6 18380->18382 18381 7ff670a88621 18383 7ff670a8a168 __free_lconv_num 11 API calls 18381->18383 18382->18358 18383->18382 18384 7ff670a8e0e0 _get_daylight 11 API calls 18384->18390 18385 7ff670a88610 18387 7ff670a88658 11 API calls 18385->18387 18386 7ff670a8fc64 _wfindfirst32i64 37 API calls 18386->18390 18388 7ff670a88618 18387->18388 18389 7ff670a8a168 __free_lconv_num 11 API calls 18388->18389 18389->18379 18390->18379 18390->18381 18390->18384 18390->18385 18390->18386 18391 7ff670a88644 18390->18391 18393 7ff670a8a168 __free_lconv_num 11 API calls 18390->18393 18392 7ff670a8a120 _wfindfirst32i64 17 API calls 18391->18392 18394 7ff670a88656 18392->18394 18393->18390 18397 7ff670a97e71 __crtLCMapStringW 18395->18397 18396 7ff670a9638a 18396->18043 18396->18044 18397->18396 18398 7ff670a8e3b4 6 API calls 18397->18398 18398->18396 18879 7ff670a86d50 18884 7ff670a8fac8 EnterCriticalSection 18879->18884 17620 7ff670a8ec40 17621 7ff670a8ee28 17620->17621 17625 7ff670a8ec83 _isindst 17620->17625 17622 7ff670a841f4 _get_daylight 11 API calls 17621->17622 17638 7ff670a8ee1a 17622->17638 17623 7ff670a7acc0 _wfindfirst32i64 8 API calls 17624 7ff670a8ee43 17623->17624 17625->17621 17626 7ff670a8ecff _isindst 17625->17626 17641 7ff670a952dc 17626->17641 17631 7ff670a8ee54 17632 7ff670a8a120 _wfindfirst32i64 17 API calls 17631->17632 17635 7ff670a8ee68 17632->17635 17638->17623 17639 7ff670a8ed5c 17639->17638 17665 7ff670a9531c 17639->17665 17642 7ff670a8ed1d 17641->17642 17643 7ff670a952ea 17641->17643 17647 7ff670a946e8 17642->17647 17672 7ff670a8fac8 EnterCriticalSection 17643->17672 17648 7ff670a946f1 17647->17648 17652 7ff670a8ed32 17647->17652 17649 7ff670a841f4 _get_daylight 11 API calls 17648->17649 17650 7ff670a946f6 17649->17650 17651 7ff670a8a100 _invalid_parameter_noinfo 37 API calls 17650->17651 17651->17652 17652->17631 17653 7ff670a94718 17652->17653 17654 7ff670a94721 17653->17654 17655 7ff670a8ed43 17653->17655 17656 7ff670a841f4 _get_daylight 11 API calls 17654->17656 17655->17631 17659 7ff670a94748 17655->17659 17657 7ff670a94726 17656->17657 17658 7ff670a8a100 _invalid_parameter_noinfo 37 API calls 17657->17658 17658->17655 17660 7ff670a94751 17659->17660 17664 7ff670a8ed54 17659->17664 17661 7ff670a841f4 _get_daylight 11 API calls 17660->17661 17662 7ff670a94756 17661->17662 17663 7ff670a8a100 _invalid_parameter_noinfo 37 API calls 17662->17663 17663->17664 17664->17631 17664->17639 17673 7ff670a8fac8 EnterCriticalSection 17665->17673 18644 7ff670a994c0 18645 7ff670a994cf 18644->18645 18646 7ff670a994d9 18644->18646 18648 7ff670a8fb28 LeaveCriticalSection 18645->18648 18885 7ff670a7ad40 18886 7ff670a7ad50 18885->18886 18902 7ff670a8554c 18886->18902 18888 7ff670a7ad5c 18908 7ff670a7b2e8 18888->18908 18890 7ff670a7b5cc 7 API calls 18891 7ff670a7adf5 18890->18891 18892 7ff670a7ad74 _RTC_Initialize 18900 7ff670a7adc9 18892->18900 18913 7ff670a7b498 18892->18913 18894 7ff670a7ad89 18916 7ff670a881c4 18894->18916 18900->18890 18901 7ff670a7ade5 18900->18901 18903 7ff670a8555d 18902->18903 18904 7ff670a841f4 _get_daylight 11 API calls 18903->18904 18905 7ff670a85565 18903->18905 18906 7ff670a85574 18904->18906 18905->18888 18907 7ff670a8a100 _invalid_parameter_noinfo 37 API calls 18906->18907 18907->18905 18909 7ff670a7b2f9 18908->18909 18912 7ff670a7b2fe __scrt_release_startup_lock 18908->18912 18910 7ff670a7b5cc 7 API calls 18909->18910 18909->18912 18911 7ff670a7b372 18910->18911 18912->18892 18941 7ff670a7b45c 18913->18941 18915 7ff670a7b4a1 18915->18894 18917 7ff670a881e4 18916->18917 18923 7ff670a7ad95 18916->18923 18918 7ff670a88202 GetModuleFileNameW 18917->18918 18919 7ff670a881ec 18917->18919 18924 7ff670a8822d 18918->18924 18920 7ff670a841f4 _get_daylight 11 API calls 18919->18920 18921 7ff670a881f1 18920->18921 18922 7ff670a8a100 _invalid_parameter_noinfo 37 API calls 18921->18922 18922->18923 18923->18900 18940 7ff670a7b56c InitializeSListHead 18923->18940 18925 7ff670a88164 11 API calls 18924->18925 18926 7ff670a8826d 18925->18926 18927 7ff670a88275 18926->18927 18931 7ff670a8828d 18926->18931 18928 7ff670a841f4 _get_daylight 11 API calls 18927->18928 18929 7ff670a8827a 18928->18929 18932 7ff670a8a168 __free_lconv_num 11 API calls 18929->18932 18930 7ff670a882af 18933 7ff670a8a168 __free_lconv_num 11 API calls 18930->18933 18931->18930 18934 7ff670a882f4 18931->18934 18935 7ff670a882db 18931->18935 18932->18923 18933->18923 18938 7ff670a8a168 __free_lconv_num 11 API calls 18934->18938 18936 7ff670a8a168 __free_lconv_num 11 API calls 18935->18936 18937 7ff670a882e4 18936->18937 18939 7ff670a8a168 __free_lconv_num 11 API calls 18937->18939 18938->18930 18939->18923 18942 7ff670a7b476 18941->18942 18944 7ff670a7b46f 18941->18944 18945 7ff670a8924c 18942->18945 18944->18915 18948 7ff670a88e88 18945->18948 18955 7ff670a8fac8 EnterCriticalSection 18948->18955 18956 7ff670a84040 18957 7ff670a8404b 18956->18957 18965 7ff670a8e6f4 18957->18965 18978 7ff670a8fac8 EnterCriticalSection 18965->18978 18711 7ff670a995bc 18714 7ff670a840a8 LeaveCriticalSection 18711->18714 14664 7ff670a7ae2c 14685 7ff670a7b29c 14664->14685 14667 7ff670a7af78 14787 7ff670a7b5cc IsProcessorFeaturePresent 14667->14787 14668 7ff670a7ae48 __scrt_acquire_startup_lock 14670 7ff670a7af82 14668->14670 14675 7ff670a7ae66 __scrt_release_startup_lock 14668->14675 14671 7ff670a7b5cc 7 API calls 14670->14671 14673 7ff670a7af8d __FrameHandler3::FrameUnwindToEmptyState 14671->14673 14672 7ff670a7ae8b 14674 7ff670a7af11 14691 7ff670a7b718 14674->14691 14675->14672 14675->14674 14776 7ff670a88ce8 14675->14776 14677 7ff670a7af16 14694 7ff670a71000 14677->14694 14682 7ff670a7af39 14682->14673 14783 7ff670a7b430 14682->14783 14794 7ff670a7b89c 14685->14794 14688 7ff670a7ae40 14688->14667 14688->14668 14689 7ff670a7b2cb __scrt_initialize_crt 14689->14688 14796 7ff670a7c9f8 14689->14796 14823 7ff670a7c140 14691->14823 14693 7ff670a7b72f GetStartupInfoW 14693->14677 14695 7ff670a7100b 14694->14695 14825 7ff670a77560 14695->14825 14697 7ff670a7101d 14832 7ff670a84cc8 14697->14832 14699 7ff670a7365b 14839 7ff670a71af0 14699->14839 14705 7ff670a73679 14768 7ff670a7377a 14705->14768 14855 7ff670a73b00 14705->14855 14707 7ff670a736ab 14707->14768 14858 7ff670a76950 14707->14858 14709 7ff670a736c7 14710 7ff670a73713 14709->14710 14712 7ff670a76950 61 API calls 14709->14712 14873 7ff670a76ef0 14710->14873 14717 7ff670a736e8 __vcrt_freefls 14712->14717 14713 7ff670a73728 14877 7ff670a719d0 14713->14877 14716 7ff670a7381d 14719 7ff670a73848 14716->14719 15019 7ff670a73260 14716->15019 14717->14710 14722 7ff670a76ef0 58 API calls 14717->14722 14718 7ff670a719d0 121 API calls 14721 7ff670a7375e 14718->14721 14727 7ff670a7388b 14719->14727 14888 7ff670a77990 14719->14888 14725 7ff670a73762 14721->14725 14726 7ff670a737a0 14721->14726 14722->14710 14724 7ff670a73868 14728 7ff670a7386d 14724->14728 14729 7ff670a7387e SetDllDirectoryW 14724->14729 14974 7ff670a72770 14725->14974 14726->14716 14996 7ff670a73c90 14726->14996 14902 7ff670a75e20 14727->14902 14732 7ff670a72770 59 API calls 14728->14732 14729->14727 14732->14768 14736 7ff670a737c2 14741 7ff670a72770 59 API calls 14736->14741 14737 7ff670a738e6 14744 7ff670a739a6 14737->14744 14750 7ff670a738f9 14737->14750 14740 7ff670a737f0 14740->14716 14743 7ff670a737f5 14740->14743 14741->14768 14742 7ff670a738a8 14742->14737 15033 7ff670a75620 14742->15033 15015 7ff670a7f1c8 14743->15015 14906 7ff670a730f0 14744->14906 14757 7ff670a73945 14750->14757 15127 7ff670a71b30 14750->15127 14751 7ff670a738dc 14756 7ff670a75870 FreeLibrary 14751->14756 14752 7ff670a738bd 15053 7ff670a755b0 14752->15053 14756->14737 14757->14768 15131 7ff670a73090 14757->15131 14758 7ff670a738c7 14758->14751 14760 7ff670a738cb 14758->14760 14759 7ff670a739db 14761 7ff670a76950 61 API calls 14759->14761 15121 7ff670a75c70 14760->15121 14766 7ff670a739e7 14761->14766 14764 7ff670a73981 14767 7ff670a75870 FreeLibrary 14764->14767 14766->14768 14923 7ff670a76f30 14766->14923 14767->14768 14987 7ff670a7acc0 14768->14987 14777 7ff670a88cff 14776->14777 14778 7ff670a88d20 14776->14778 14777->14674 17615 7ff670a89438 14778->17615 14781 7ff670a7b75c GetModuleHandleW 14782 7ff670a7b76d 14781->14782 14782->14682 14784 7ff670a7b441 14783->14784 14785 7ff670a7af50 14784->14785 14786 7ff670a7c9f8 __scrt_initialize_crt 7 API calls 14784->14786 14785->14672 14786->14785 14788 7ff670a7b5f2 _wfindfirst32i64 __scrt_get_show_window_mode 14787->14788 14789 7ff670a7b611 RtlCaptureContext RtlLookupFunctionEntry 14788->14789 14790 7ff670a7b63a RtlVirtualUnwind 14789->14790 14791 7ff670a7b676 __scrt_get_show_window_mode 14789->14791 14790->14791 14792 7ff670a7b6a8 IsDebuggerPresent SetUnhandledExceptionFilter UnhandledExceptionFilter 14791->14792 14793 7ff670a7b6fa _wfindfirst32i64 14792->14793 14793->14670 14795 7ff670a7b2be __scrt_dllmain_crt_thread_attach 14794->14795 14795->14688 14795->14689 14797 7ff670a7ca0a 14796->14797 14798 7ff670a7ca00 14796->14798 14797->14688 14802 7ff670a7cd74 14798->14802 14803 7ff670a7cd83 14802->14803 14804 7ff670a7ca05 14802->14804 14810 7ff670a7cfb0 14803->14810 14806 7ff670a7cde0 14804->14806 14807 7ff670a7ce0b 14806->14807 14808 7ff670a7ce0f 14807->14808 14809 7ff670a7cdee DeleteCriticalSection 14807->14809 14808->14797 14809->14807 14814 7ff670a7ce18 14810->14814 14815 7ff670a7cf32 TlsFree 14814->14815 14820 7ff670a7ce5c __vcrt_FlsAlloc 14814->14820 14816 7ff670a7ce8a LoadLibraryExW 14818 7ff670a7ceab GetLastError 14816->14818 14819 7ff670a7cf01 14816->14819 14817 7ff670a7cf21 GetProcAddress 14817->14815 14818->14820 14819->14817 14821 7ff670a7cf18 FreeLibrary 14819->14821 14820->14815 14820->14816 14820->14817 14822 7ff670a7cecd LoadLibraryExW 14820->14822 14821->14817 14822->14819 14822->14820 14824 7ff670a7c120 14823->14824 14824->14693 14824->14824 14828 7ff670a7757f 14825->14828 14826 7ff670a77587 __vcrt_freefls 14826->14697 14827 7ff670a775d0 WideCharToMultiByte 14827->14828 14831 7ff670a77678 14827->14831 14828->14826 14828->14827 14830 7ff670a77626 WideCharToMultiByte 14828->14830 14828->14831 14830->14828 14830->14831 15172 7ff670a72620 14831->15172 14834 7ff670a8ef9c 14832->14834 14833 7ff670a8efef 14835 7ff670a8a030 _invalid_parameter_noinfo 37 API calls 14833->14835 14834->14833 14836 7ff670a8f045 14834->14836 14838 7ff670a8f018 14835->14838 15669 7ff670a8ee74 14836->15669 14838->14699 14840 7ff670a71b05 14839->14840 14841 7ff670a71b20 14840->14841 15677 7ff670a724d0 14840->15677 14841->14768 14843 7ff670a73b80 14841->14843 14844 7ff670a7acf0 14843->14844 14845 7ff670a73b8c GetModuleFileNameW 14844->14845 14846 7ff670a73bbb 14845->14846 14847 7ff670a73bd2 14845->14847 14848 7ff670a72620 57 API calls 14846->14848 15717 7ff670a77aa0 14847->15717 14854 7ff670a73bce 14848->14854 14851 7ff670a7acc0 _wfindfirst32i64 8 API calls 14853 7ff670a73c0f 14851->14853 14852 7ff670a72770 59 API calls 14852->14854 14853->14705 14854->14851 14856 7ff670a71b30 49 API calls 14855->14856 14857 7ff670a73b1d 14856->14857 14857->14707 14859 7ff670a7695a 14858->14859 14860 7ff670a77990 57 API calls 14859->14860 14861 7ff670a7697c GetEnvironmentVariableW 14860->14861 14862 7ff670a769e6 14861->14862 14863 7ff670a76994 ExpandEnvironmentStringsW 14861->14863 14865 7ff670a7acc0 _wfindfirst32i64 8 API calls 14862->14865 14864 7ff670a77aa0 59 API calls 14863->14864 14866 7ff670a769bc 14864->14866 14867 7ff670a769f8 14865->14867 14866->14862 14868 7ff670a769c6 14866->14868 14867->14709 15728 7ff670a8946c 14868->15728 14871 7ff670a7acc0 _wfindfirst32i64 8 API calls 14872 7ff670a769de 14871->14872 14872->14709 14874 7ff670a77990 57 API calls 14873->14874 14875 7ff670a76f07 SetEnvironmentVariableW 14874->14875 14876 7ff670a76f1f __vcrt_freefls 14875->14876 14876->14713 14878 7ff670a71b30 49 API calls 14877->14878 14879 7ff670a71a00 14878->14879 14880 7ff670a71b30 49 API calls 14879->14880 14886 7ff670a71a7a 14879->14886 14881 7ff670a71a22 14880->14881 14882 7ff670a73b00 49 API calls 14881->14882 14881->14886 14883 7ff670a71a3b 14882->14883 15735 7ff670a717b0 14883->15735 14886->14716 14886->14718 14887 7ff670a7f1c8 74 API calls 14887->14886 14889 7ff670a77a37 MultiByteToWideChar 14888->14889 14890 7ff670a779b1 MultiByteToWideChar 14888->14890 14893 7ff670a77a5a 14889->14893 14894 7ff670a77a7f 14889->14894 14891 7ff670a779fc 14890->14891 14892 7ff670a779d7 14890->14892 14891->14889 14899 7ff670a77a12 14891->14899 14895 7ff670a72620 55 API calls 14892->14895 14896 7ff670a72620 55 API calls 14893->14896 14894->14724 14897 7ff670a779ea 14895->14897 14898 7ff670a77a6d 14896->14898 14897->14724 14898->14724 14900 7ff670a72620 55 API calls 14899->14900 14901 7ff670a77a25 14900->14901 14901->14724 14903 7ff670a75e35 14902->14903 14904 7ff670a73890 14903->14904 14905 7ff670a724d0 59 API calls 14903->14905 14904->14737 15023 7ff670a75ac0 14904->15023 14905->14904 14908 7ff670a731a4 14906->14908 14915 7ff670a73163 14906->14915 14907 7ff670a731e3 14910 7ff670a7acc0 _wfindfirst32i64 8 API calls 14907->14910 14908->14907 14909 7ff670a71ab0 74 API calls 14908->14909 14909->14908 14911 7ff670a731f5 14910->14911 14911->14768 14916 7ff670a76e80 14911->14916 14915->14908 15808 7ff670a71440 14915->15808 15842 7ff670a72990 14915->15842 15896 7ff670a71780 14915->15896 14917 7ff670a77990 57 API calls 14916->14917 14918 7ff670a76e9f 14917->14918 14919 7ff670a77990 57 API calls 14918->14919 14920 7ff670a76eaf 14919->14920 14921 7ff670a86444 38 API calls 14920->14921 14922 7ff670a76ebd __vcrt_freefls 14921->14922 14922->14759 14924 7ff670a76f40 14923->14924 14925 7ff670a77990 57 API calls 14924->14925 14926 7ff670a76f71 14925->14926 16764 7ff670a870f8 14926->16764 14929 7ff670a870f8 14 API calls 14930 7ff670a76f8a 14929->14930 14975 7ff670a72790 14974->14975 14976 7ff670a83994 49 API calls 14975->14976 14977 7ff670a727dd __scrt_get_show_window_mode 14976->14977 14978 7ff670a77990 57 API calls 14977->14978 14979 7ff670a7280a 14978->14979 14980 7ff670a72849 MessageBoxA 14979->14980 14981 7ff670a7280f 14979->14981 14983 7ff670a72863 14980->14983 14982 7ff670a77990 57 API calls 14981->14982 14984 7ff670a72829 MessageBoxW 14982->14984 14985 7ff670a7acc0 _wfindfirst32i64 8 API calls 14983->14985 14984->14983 14986 7ff670a72873 14985->14986 14986->14768 14988 7ff670a7acc9 14987->14988 14989 7ff670a7378e 14988->14989 14990 7ff670a7aff0 IsProcessorFeaturePresent 14988->14990 14989->14781 14991 7ff670a7b008 14990->14991 16838 7ff670a7b1e4 RtlCaptureContext 14991->16838 14997 7ff670a73c9c 14996->14997 14998 7ff670a77990 57 API calls 14997->14998 14999 7ff670a73cc7 14998->14999 15000 7ff670a77990 57 API calls 14999->15000 15001 7ff670a73cda 15000->15001 16843 7ff670a85278 15001->16843 15004 7ff670a7acc0 _wfindfirst32i64 8 API calls 15005 7ff670a737ba 15004->15005 15005->14736 15006 7ff670a77160 15005->15006 15007 7ff670a77184 15006->15007 15008 7ff670a7725b __vcrt_freefls 15007->15008 15009 7ff670a7f830 73 API calls 15007->15009 15008->14740 15010 7ff670a7719e 15009->15010 15010->15008 17222 7ff670a87c94 15010->17222 15012 7ff670a7f830 73 API calls 15013 7ff670a771b3 15012->15013 15013->15008 15013->15012 15014 7ff670a7f518 _fread_nolock 53 API calls 15013->15014 15014->15013 15016 7ff670a7f1f8 15015->15016 17237 7ff670a7efa8 15016->17237 15018 7ff670a7f211 15018->14736 15020 7ff670a73277 15019->15020 15021 7ff670a732a0 15019->15021 15020->15021 15022 7ff670a71780 59 API calls 15020->15022 15021->14719 15022->15020 15024 7ff670a75ae4 15023->15024 15029 7ff670a75b11 15023->15029 15025 7ff670a75b07 memcpy_s __vcrt_freefls 15024->15025 15026 7ff670a75b0c 15024->15026 15028 7ff670a71780 59 API calls 15024->15028 15024->15029 15025->14742 17248 7ff670a712b0 15026->17248 15028->15024 15029->15025 17274 7ff670a73d10 15029->17274 15031 7ff670a75b77 15031->15025 15032 7ff670a72770 59 API calls 15031->15032 15032->15025 15040 7ff670a7563a memcpy_s 15033->15040 15034 7ff670a7575f 15037 7ff670a73d10 49 API calls 15034->15037 15036 7ff670a7577b 15038 7ff670a72770 59 API calls 15036->15038 15039 7ff670a757d8 15037->15039 15050 7ff670a75771 __vcrt_freefls 15038->15050 15043 7ff670a73d10 49 API calls 15039->15043 15040->15034 15040->15036 15041 7ff670a73d10 49 API calls 15040->15041 15042 7ff670a75740 15040->15042 15049 7ff670a71440 161 API calls 15040->15049 15051 7ff670a75761 15040->15051 17277 7ff670a71650 15040->17277 15041->15040 15042->15034 15044 7ff670a73d10 49 API calls 15042->15044 15045 7ff670a75808 15043->15045 15044->15034 15048 7ff670a73d10 49 API calls 15045->15048 15046 7ff670a7acc0 _wfindfirst32i64 8 API calls 15047 7ff670a738b9 15046->15047 15047->14751 15047->14752 15048->15050 15049->15040 15050->15046 15052 7ff670a72770 59 API calls 15051->15052 15052->15050 17282 7ff670a77110 15053->17282 15055 7ff670a755c2 15056 7ff670a77110 58 API calls 15055->15056 15057 7ff670a755d5 15056->15057 15058 7ff670a755fa 15057->15058 15059 7ff670a755ed GetProcAddress 15057->15059 15060 7ff670a72770 59 API calls 15058->15060 15063 7ff670a75f7c GetProcAddress 15059->15063 15064 7ff670a75f59 15059->15064 15062 7ff670a75606 15060->15062 15062->14758 15063->15064 15065 7ff670a75fa1 GetProcAddress 15063->15065 15066 7ff670a72620 57 API calls 15064->15066 15065->15064 15067 7ff670a75fc6 GetProcAddress 15065->15067 15068 7ff670a75f6c 15066->15068 15067->15064 15069 7ff670a75fee GetProcAddress 15067->15069 15068->14758 15069->15064 15070 7ff670a76016 GetProcAddress 15069->15070 15070->15064 15128 7ff670a71b55 15127->15128 15129 7ff670a83994 49 API calls 15128->15129 15130 7ff670a71b78 15129->15130 15130->14757 17286 7ff670a74940 15131->17286 15134 7ff670a730dd 15134->14764 15136 7ff670a730b4 15136->15134 17342 7ff670a746c0 15136->17342 15191 7ff670a7acf0 15172->15191 15174 7ff670a7263c GetLastError 15175 7ff670a72669 15174->15175 15193 7ff670a83994 15175->15193 15180 7ff670a71b30 49 API calls 15181 7ff670a726c8 __scrt_get_show_window_mode 15180->15181 15182 7ff670a77990 54 API calls 15181->15182 15183 7ff670a726f5 15182->15183 15184 7ff670a726fa 15183->15184 15185 7ff670a72734 MessageBoxA 15183->15185 15186 7ff670a77990 54 API calls 15184->15186 15187 7ff670a7274e 15185->15187 15188 7ff670a72714 MessageBoxW 15186->15188 15189 7ff670a7acc0 _wfindfirst32i64 8 API calls 15187->15189 15188->15187 15190 7ff670a7275e 15189->15190 15190->14826 15192 7ff670a7ad1a 15191->15192 15192->15174 15192->15192 15196 7ff670a839ee 15193->15196 15194 7ff670a83a13 15223 7ff670a8a030 15194->15223 15196->15194 15197 7ff670a83a4f 15196->15197 15231 7ff670a81ca0 15197->15231 15199 7ff670a83a3d 15200 7ff670a7acc0 _wfindfirst32i64 8 API calls 15199->15200 15202 7ff670a72699 15200->15202 15201 7ff670a8a168 __free_lconv_num 11 API calls 15201->15199 15211 7ff670a77410 15202->15211 15204 7ff670a83b50 15205 7ff670a83b5a 15204->15205 15208 7ff670a83b2c 15204->15208 15209 7ff670a8a168 __free_lconv_num 11 API calls 15205->15209 15207 7ff670a83af8 15207->15208 15210 7ff670a83b01 15207->15210 15208->15201 15209->15199 15245 7ff670a8a168 15210->15245 15212 7ff670a7741c 15211->15212 15213 7ff670a7743d FormatMessageW 15212->15213 15214 7ff670a77437 GetLastError 15212->15214 15215 7ff670a7748c WideCharToMultiByte 15213->15215 15216 7ff670a77470 15213->15216 15214->15213 15218 7ff670a774c6 15215->15218 15219 7ff670a77483 15215->15219 15217 7ff670a72620 54 API calls 15216->15217 15217->15219 15220 7ff670a72620 54 API calls 15218->15220 15221 7ff670a7acc0 _wfindfirst32i64 8 API calls 15219->15221 15220->15219 15222 7ff670a726a0 15221->15222 15222->15180 15251 7ff670a89d78 15223->15251 15228 7ff670a8a06b 15228->15199 15232 7ff670a81cd7 15231->15232 15233 7ff670a81cc7 15231->15233 15234 7ff670a81cdd 15232->15234 15243 7ff670a81d0d 15232->15243 15235 7ff670a8a030 _invalid_parameter_noinfo 37 API calls 15233->15235 15236 7ff670a8a030 _invalid_parameter_noinfo 37 API calls 15234->15236 15237 7ff670a81d05 15235->15237 15236->15237 15237->15204 15237->15207 15237->15208 15237->15210 15240 7ff670a81fc6 15242 7ff670a8a030 _invalid_parameter_noinfo 37 API calls 15240->15242 15242->15233 15243->15233 15243->15237 15243->15240 15343 7ff670a82618 15243->15343 15368 7ff670a822e8 15243->15368 15397 7ff670a81b80 15243->15397 15400 7ff670a837d0 15243->15400 15246 7ff670a8a16d RtlFreeHeap 15245->15246 15250 7ff670a8a19c 15245->15250 15247 7ff670a8a188 GetLastError 15246->15247 15246->15250 15248 7ff670a8a195 __free_lconv_num 15247->15248 15249 7ff670a841f4 _get_daylight 9 API calls 15248->15249 15249->15250 15250->15199 15252 7ff670a89dcf 15251->15252 15253 7ff670a89d94 GetLastError 15251->15253 15252->15228 15257 7ff670a89de4 15252->15257 15254 7ff670a89da4 15253->15254 15264 7ff670a8aba0 15254->15264 15258 7ff670a89e00 GetLastError SetLastError 15257->15258 15259 7ff670a89e18 15257->15259 15258->15259 15259->15228 15260 7ff670a8a120 IsProcessorFeaturePresent 15259->15260 15261 7ff670a8a133 15260->15261 15335 7ff670a89e30 15261->15335 15265 7ff670a8abbf FlsGetValue 15264->15265 15266 7ff670a8abda FlsSetValue 15264->15266 15268 7ff670a89dbf SetLastError 15265->15268 15269 7ff670a8abd4 15265->15269 15267 7ff670a8abe7 15266->15267 15266->15268 15281 7ff670a8e0e0 15267->15281 15268->15252 15269->15266 15272 7ff670a8ac14 FlsSetValue 15275 7ff670a8ac20 FlsSetValue 15272->15275 15276 7ff670a8ac32 15272->15276 15273 7ff670a8ac04 FlsSetValue 15274 7ff670a8ac0d 15273->15274 15277 7ff670a8a168 __free_lconv_num 11 API calls 15274->15277 15275->15274 15288 7ff670a8a710 15276->15288 15277->15268 15286 7ff670a8e0f1 _get_daylight 15281->15286 15282 7ff670a8e142 15296 7ff670a841f4 15282->15296 15283 7ff670a8e126 HeapAlloc 15284 7ff670a8abf6 15283->15284 15283->15286 15284->15272 15284->15273 15286->15282 15286->15283 15293 7ff670a929c0 15286->15293 15321 7ff670a8a5e8 15288->15321 15299 7ff670a929fc 15293->15299 15304 7ff670a8aad8 GetLastError 15296->15304 15298 7ff670a841fd 15298->15284 15300 7ff670a8fac8 _isindst EnterCriticalSection 15299->15300 15301 7ff670a92a09 15300->15301 15302 7ff670a8fb28 _isindst LeaveCriticalSection 15301->15302 15303 7ff670a929ce 15302->15303 15303->15286 15305 7ff670a8ab19 FlsSetValue 15304->15305 15308 7ff670a8aafc 15304->15308 15306 7ff670a8ab09 15305->15306 15307 7ff670a8ab2b 15305->15307 15309 7ff670a8ab85 SetLastError 15306->15309 15310 7ff670a8e0e0 _get_daylight 5 API calls 15307->15310 15308->15305 15308->15306 15309->15298 15311 7ff670a8ab3a 15310->15311 15312 7ff670a8ab58 FlsSetValue 15311->15312 15313 7ff670a8ab48 FlsSetValue 15311->15313 15315 7ff670a8ab64 FlsSetValue 15312->15315 15316 7ff670a8ab76 15312->15316 15314 7ff670a8ab51 15313->15314 15317 7ff670a8a168 __free_lconv_num 5 API calls 15314->15317 15315->15314 15318 7ff670a8a710 _get_daylight 5 API calls 15316->15318 15317->15306 15319 7ff670a8ab7e 15318->15319 15320 7ff670a8a168 __free_lconv_num 5 API calls 15319->15320 15320->15309 15333 7ff670a8fac8 EnterCriticalSection 15321->15333 15336 7ff670a89e6a _wfindfirst32i64 __scrt_get_show_window_mode 15335->15336 15337 7ff670a89e92 RtlCaptureContext RtlLookupFunctionEntry 15336->15337 15338 7ff670a89f02 IsDebuggerPresent SetUnhandledExceptionFilter UnhandledExceptionFilter 15337->15338 15339 7ff670a89ecc RtlVirtualUnwind 15337->15339 15340 7ff670a89f54 _wfindfirst32i64 15338->15340 15339->15338 15341 7ff670a7acc0 _wfindfirst32i64 8 API calls 15340->15341 15342 7ff670a89f73 GetCurrentProcess TerminateProcess 15341->15342 15344 7ff670a826bb 15343->15344 15345 7ff670a8265e 15343->15345 15348 7ff670a8272b 15344->15348 15349 7ff670a826bf 15344->15349 15346 7ff670a82664 15345->15346 15347 7ff670a8271e 15345->15347 15346->15348 15360 7ff670a8268a 15346->15360 15362 7ff670a826b1 15346->15362 15364 7ff670a82696 15346->15364 15366 7ff670a826a5 15346->15366 15367 7ff670a82734 15346->15367 15428 7ff670a80c38 15347->15428 15435 7ff670a82f34 15348->15435 15349->15347 15351 7ff670a82717 15349->15351 15352 7ff670a826c7 15349->15352 15424 7ff670a83568 15351->15424 15355 7ff670a826f7 15352->15355 15357 7ff670a826cb 15352->15357 15417 7ff670a80864 15355->15417 15357->15347 15357->15362 15357->15366 15359 7ff670a7acc0 _wfindfirst32i64 8 API calls 15361 7ff670a829c6 15359->15361 15360->15348 15360->15364 15360->15366 15361->15243 15362->15367 15410 7ff670a8100c 15362->15410 15364->15367 15406 7ff670a833e0 15364->15406 15366->15367 15445 7ff670a8dda0 15366->15445 15367->15359 15369 7ff670a82309 15368->15369 15370 7ff670a822f3 15368->15370 15373 7ff670a8a030 _invalid_parameter_noinfo 37 API calls 15369->15373 15377 7ff670a82347 15369->15377 15371 7ff670a826bb 15370->15371 15372 7ff670a8265e 15370->15372 15370->15377 15375 7ff670a8272b 15371->15375 15376 7ff670a826bf 15371->15376 15374 7ff670a8271e 15372->15374 15387 7ff670a82664 15372->15387 15373->15377 15382 7ff670a80c38 38 API calls 15374->15382 15378 7ff670a82f34 47 API calls 15375->15378 15376->15374 15380 7ff670a82717 15376->15380 15381 7ff670a826c7 15376->15381 15377->15243 15394 7ff670a826a5 15378->15394 15379 7ff670a82696 15386 7ff670a833e0 47 API calls 15379->15386 15396 7ff670a82734 15379->15396 15383 7ff670a83568 37 API calls 15380->15383 15384 7ff670a826cb 15381->15384 15385 7ff670a826f7 15381->15385 15382->15394 15383->15394 15384->15374 15393 7ff670a826b1 15384->15393 15384->15394 15389 7ff670a80864 38 API calls 15385->15389 15386->15394 15387->15375 15387->15379 15391 7ff670a8268a 15387->15391 15387->15393 15387->15394 15387->15396 15388 7ff670a7acc0 _wfindfirst32i64 8 API calls 15390 7ff670a829c6 15388->15390 15389->15394 15390->15243 15391->15375 15391->15379 15391->15394 15392 7ff670a8100c 38 API calls 15392->15394 15393->15392 15393->15396 15395 7ff670a8dda0 47 API calls 15394->15395 15394->15396 15395->15394 15396->15388 15597 7ff670a7fe5c 15397->15597 15401 7ff670a837e7 15400->15401 15614 7ff670a8cee4 15401->15614 15407 7ff670a833f4 15406->15407 15409 7ff670a83453 15406->15409 15408 7ff670a8dda0 47 API calls 15407->15408 15407->15409 15408->15409 15409->15366 15411 7ff670a81032 15410->15411 15412 7ff670a8105c 15411->15412 15414 7ff670a81113 15411->15414 15416 7ff670a81098 15412->15416 15455 7ff670a7fcc8 15412->15455 15415 7ff670a8a030 _invalid_parameter_noinfo 37 API calls 15414->15415 15415->15416 15416->15366 15418 7ff670a8088a 15417->15418 15419 7ff670a808b4 15418->15419 15421 7ff670a8096b 15418->15421 15420 7ff670a7fcc8 12 API calls 15419->15420 15423 7ff670a808f0 15419->15423 15420->15423 15422 7ff670a8a030 _invalid_parameter_noinfo 37 API calls 15421->15422 15422->15423 15423->15366 15427 7ff670a83587 15424->15427 15425 7ff670a8a030 _invalid_parameter_noinfo 37 API calls 15426 7ff670a835b8 15425->15426 15426->15366 15427->15425 15427->15426 15429 7ff670a80c5e 15428->15429 15430 7ff670a80c88 15429->15430 15432 7ff670a80d3f 15429->15432 15431 7ff670a7fcc8 12 API calls 15430->15431 15434 7ff670a80cc4 15430->15434 15431->15434 15433 7ff670a8a030 _invalid_parameter_noinfo 37 API calls 15432->15433 15433->15434 15434->15366 15436 7ff670a82f56 15435->15436 15437 7ff670a7fcc8 12 API calls 15436->15437 15438 7ff670a82fa0 15437->15438 15470 7ff670a8dab8 15438->15470 15441 7ff670a837d0 45 API calls 15442 7ff670a8308c 15441->15442 15443 7ff670a837d0 45 API calls 15442->15443 15444 7ff670a83115 15442->15444 15443->15444 15444->15366 15446 7ff670a8ddc8 15445->15446 15447 7ff670a8de0d 15446->15447 15448 7ff670a837d0 45 API calls 15446->15448 15450 7ff670a8ddcd __scrt_get_show_window_mode 15446->15450 15454 7ff670a8ddf6 __scrt_get_show_window_mode 15446->15454 15447->15450 15447->15454 15594 7ff670a8f424 15447->15594 15448->15447 15449 7ff670a8a030 _invalid_parameter_noinfo 37 API calls 15449->15450 15450->15366 15454->15449 15454->15450 15456 7ff670a7fcff 15455->15456 15462 7ff670a7fcee 15455->15462 15456->15462 15463 7ff670a8ce50 15456->15463 15459 7ff670a8a168 __free_lconv_num 11 API calls 15461 7ff670a7fd40 15459->15461 15460 7ff670a8a168 __free_lconv_num 11 API calls 15460->15462 15461->15460 15462->15416 15464 7ff670a8ce9b 15463->15464 15468 7ff670a8ce5f _get_daylight 15463->15468 15466 7ff670a841f4 _get_daylight 11 API calls 15464->15466 15465 7ff670a8ce82 HeapAlloc 15467 7ff670a7fd2c 15465->15467 15465->15468 15466->15467 15467->15459 15467->15461 15468->15464 15468->15465 15469 7ff670a929c0 _get_daylight 2 API calls 15468->15469 15469->15468 15471 7ff670a8dad5 15470->15471 15472 7ff670a8db08 15470->15472 15473 7ff670a8a030 _invalid_parameter_noinfo 37 API calls 15471->15473 15472->15471 15474 7ff670a8db3a 15472->15474 15482 7ff670a8306a 15473->15482 15478 7ff670a8dc4d 15474->15478 15487 7ff670a8db82 15474->15487 15475 7ff670a8dd3f 15525 7ff670a8cf88 15475->15525 15477 7ff670a8dd05 15518 7ff670a8d33c 15477->15518 15478->15475 15478->15477 15480 7ff670a8dcd4 15478->15480 15481 7ff670a8dc97 15478->15481 15484 7ff670a8dc8d 15478->15484 15511 7ff670a8d61c 15480->15511 15501 7ff670a8d84c 15481->15501 15482->15441 15482->15442 15484->15477 15486 7ff670a8dc92 15484->15486 15486->15480 15486->15481 15487->15482 15492 7ff670a8950c 15487->15492 15490 7ff670a8a120 _wfindfirst32i64 17 API calls 15491 7ff670a8dd9c 15490->15491 15493 7ff670a89523 15492->15493 15494 7ff670a89519 15492->15494 15495 7ff670a841f4 _get_daylight 11 API calls 15493->15495 15494->15493 15499 7ff670a8953e 15494->15499 15496 7ff670a8952a 15495->15496 15534 7ff670a8a100 15496->15534 15498 7ff670a89536 15498->15482 15498->15490 15499->15498 15500 7ff670a841f4 _get_daylight 11 API calls 15499->15500 15500->15496 15536 7ff670a9314c 15501->15536 15505 7ff670a8d8f4 15506 7ff670a8d949 15505->15506 15508 7ff670a8d914 15505->15508 15510 7ff670a8d8f8 15505->15510 15583 7ff670a8d438 15506->15583 15579 7ff670a8d6f4 15508->15579 15510->15482 15512 7ff670a9314c 38 API calls 15511->15512 15513 7ff670a8d666 15512->15513 15514 7ff670a92b38 37 API calls 15513->15514 15515 7ff670a8d6b6 15514->15515 15516 7ff670a8d6ba 15515->15516 15517 7ff670a8d6f4 45 API calls 15515->15517 15516->15482 15517->15516 15519 7ff670a9314c 38 API calls 15518->15519 15520 7ff670a8d387 15519->15520 15521 7ff670a92b38 37 API calls 15520->15521 15522 7ff670a8d3df 15521->15522 15523 7ff670a8d3e3 15522->15523 15524 7ff670a8d438 45 API calls 15522->15524 15523->15482 15524->15523 15526 7ff670a8d000 15525->15526 15527 7ff670a8cfcd 15525->15527 15529 7ff670a8d01b 15526->15529 15531 7ff670a8d09f 15526->15531 15528 7ff670a8a030 _invalid_parameter_noinfo 37 API calls 15527->15528 15533 7ff670a8cff9 __scrt_get_show_window_mode 15528->15533 15530 7ff670a8d33c 46 API calls 15529->15530 15530->15533 15532 7ff670a837d0 45 API calls 15531->15532 15531->15533 15532->15533 15533->15482 15535 7ff670a89f94 _invalid_parameter_noinfo 37 API calls 15534->15535 15537 7ff670a931a0 fegetenv 15536->15537 15538 7ff670a9703c 37 API calls 15537->15538 15542 7ff670a931f4 15538->15542 15539 7ff670a93223 15543 7ff670a8950c __std_exception_copy 37 API calls 15539->15543 15540 7ff670a932e3 15541 7ff670a97220 20 API calls 15540->15541 15558 7ff670a9334e __scrt_get_show_window_mode 15541->15558 15542->15540 15544 7ff670a932c0 15542->15544 15545 7ff670a93210 15542->15545 15546 7ff670a932a1 15543->15546 15548 7ff670a8950c __std_exception_copy 37 API calls 15544->15548 15545->15539 15545->15540 15547 7ff670a94376 15546->15547 15561 7ff670a932a9 15546->15561 15549 7ff670a8a120 _wfindfirst32i64 17 API calls 15547->15549 15548->15546 15550 7ff670a9438b 15549->15550 15551 7ff670a7acc0 _wfindfirst32i64 8 API calls 15552 7ff670a8d899 15551->15552 15575 7ff670a92b38 15552->15575 15553 7ff670a936f7 __scrt_get_show_window_mode 15554 7ff670a93a38 15555 7ff670a92cc0 37 API calls 15554->15555 15563 7ff670a9414b 15555->15563 15556 7ff670a939e3 15556->15554 15559 7ff670a9438c memcpy_s 37 API calls 15556->15559 15557 7ff670a9338f memcpy_s 15570 7ff670a937eb memcpy_s __scrt_get_show_window_mode 15557->15570 15571 7ff670a93cd1 memcpy_s __scrt_get_show_window_mode 15557->15571 15558->15553 15558->15557 15560 7ff670a841f4 _get_daylight 11 API calls 15558->15560 15559->15554 15562 7ff670a937c8 15560->15562 15561->15551 15564 7ff670a8a100 _invalid_parameter_noinfo 37 API calls 15562->15564 15565 7ff670a9438c memcpy_s 37 API calls 15563->15565 15574 7ff670a941a6 15563->15574 15564->15557 15565->15574 15566 7ff670a841f4 11 API calls _get_daylight 15566->15570 15567 7ff670a841f4 11 API calls _get_daylight 15567->15571 15568 7ff670a92cc0 37 API calls 15568->15574 15569 7ff670a8a100 37 API calls _invalid_parameter_noinfo 15569->15571 15570->15556 15570->15566 15572 7ff670a8a100 37 API calls _invalid_parameter_noinfo 15570->15572 15571->15554 15571->15556 15571->15567 15571->15569 15572->15570 15573 7ff670a9438c memcpy_s 37 API calls 15573->15574 15574->15561 15574->15568 15574->15573 15576 7ff670a92b60 15575->15576 15577 7ff670a8a030 _invalid_parameter_noinfo 37 API calls 15576->15577 15578 7ff670a92b8e memcpy_s 15576->15578 15577->15578 15578->15505 15580 7ff670a8d720 memcpy_s 15579->15580 15581 7ff670a837d0 45 API calls 15580->15581 15582 7ff670a8d7da memcpy_s __scrt_get_show_window_mode 15580->15582 15581->15582 15582->15510 15584 7ff670a8d473 15583->15584 15587 7ff670a8d4c0 memcpy_s 15583->15587 15585 7ff670a8a030 _invalid_parameter_noinfo 37 API calls 15584->15585 15586 7ff670a8d49f 15585->15586 15586->15510 15588 7ff670a8d52b 15587->15588 15590 7ff670a837d0 45 API calls 15587->15590 15589 7ff670a8950c __std_exception_copy 37 API calls 15588->15589 15593 7ff670a8d56d memcpy_s 15589->15593 15590->15588 15591 7ff670a8a120 _wfindfirst32i64 17 API calls 15592 7ff670a8d618 15591->15592 15593->15591 15596 7ff670a8f447 WideCharToMultiByte 15594->15596 15598 7ff670a7fe9c 15597->15598 15599 7ff670a7fe8a 15597->15599 15602 7ff670a7fea9 15598->15602 15605 7ff670a7fee6 15598->15605 15600 7ff670a841f4 _get_daylight 11 API calls 15599->15600 15601 7ff670a7fe8f 15600->15601 15603 7ff670a8a100 _invalid_parameter_noinfo 37 API calls 15601->15603 15604 7ff670a8a030 _invalid_parameter_noinfo 37 API calls 15602->15604 15610 7ff670a7fe9a 15603->15610 15604->15610 15606 7ff670a841f4 _get_daylight 11 API calls 15605->15606 15607 7ff670a7ff92 15605->15607 15608 7ff670a7ff87 15606->15608 15609 7ff670a841f4 _get_daylight 11 API calls 15607->15609 15607->15610 15611 7ff670a8a100 _invalid_parameter_noinfo 37 API calls 15608->15611 15612 7ff670a8003f 15609->15612 15610->15243 15611->15607 15613 7ff670a8a100 _invalid_parameter_noinfo 37 API calls 15612->15613 15613->15610 15615 7ff670a8380f 15614->15615 15616 7ff670a8cefd 15614->15616 15618 7ff670a8cf50 15615->15618 15616->15615 15622 7ff670a92738 15616->15622 15619 7ff670a8381f 15618->15619 15620 7ff670a8cf69 15618->15620 15619->15243 15620->15619 15666 7ff670a91ac0 15620->15666 15634 7ff670a8a960 GetLastError 15622->15634 15625 7ff670a92792 15625->15615 15635 7ff670a8a9a1 FlsSetValue 15634->15635 15636 7ff670a8a984 FlsGetValue 15634->15636 15637 7ff670a8a991 15635->15637 15638 7ff670a8a9b3 15635->15638 15636->15637 15639 7ff670a8a99b 15636->15639 15640 7ff670a8aa0d SetLastError 15637->15640 15641 7ff670a8e0e0 _get_daylight 11 API calls 15638->15641 15639->15635 15642 7ff670a8aa1a 15640->15642 15643 7ff670a8aa2d 15640->15643 15644 7ff670a8a9c2 15641->15644 15642->15625 15656 7ff670a8fac8 EnterCriticalSection 15642->15656 15657 7ff670a8956c 15643->15657 15646 7ff670a8a9e0 FlsSetValue 15644->15646 15647 7ff670a8a9d0 FlsSetValue 15644->15647 15650 7ff670a8a9fe 15646->15650 15651 7ff670a8a9ec FlsSetValue 15646->15651 15649 7ff670a8a9d9 15647->15649 15652 7ff670a8a168 __free_lconv_num 11 API calls 15649->15652 15653 7ff670a8a710 _get_daylight 11 API calls 15650->15653 15651->15649 15652->15637 15654 7ff670a8aa06 15653->15654 15655 7ff670a8a168 __free_lconv_num 11 API calls 15654->15655 15655->15640 15658 7ff670a86e28 __FrameHandler3::FrameUnwindToEmptyState EnterCriticalSection LeaveCriticalSection 15657->15658 15659 7ff670a89575 15658->15659 15660 7ff670a89584 15659->15660 15663 7ff670a86e78 __FrameHandler3::FrameUnwindToEmptyState 44 API calls 15659->15663 15661 7ff670a895b7 __FrameHandler3::FrameUnwindToEmptyState 15660->15661 15662 7ff670a8958d IsProcessorFeaturePresent 15660->15662 15664 7ff670a8959c 15662->15664 15663->15660 15665 7ff670a89e30 _wfindfirst32i64 14 API calls 15664->15665 15665->15661 15667 7ff670a8a960 __FrameHandler3::FrameUnwindToEmptyState 45 API calls 15666->15667 15668 7ff670a91ac9 15667->15668 15676 7ff670a8409c EnterCriticalSection 15669->15676 15678 7ff670a724ec 15677->15678 15679 7ff670a83994 49 API calls 15678->15679 15680 7ff670a7253f 15679->15680 15681 7ff670a841f4 _get_daylight 11 API calls 15680->15681 15682 7ff670a72544 15681->15682 15696 7ff670a84214 15682->15696 15685 7ff670a71b30 49 API calls 15686 7ff670a72573 __scrt_get_show_window_mode 15685->15686 15687 7ff670a77990 57 API calls 15686->15687 15688 7ff670a725a0 15687->15688 15689 7ff670a725a5 15688->15689 15690 7ff670a725df MessageBoxA 15688->15690 15691 7ff670a77990 57 API calls 15689->15691 15692 7ff670a725f9 15690->15692 15693 7ff670a725bf MessageBoxW 15691->15693 15694 7ff670a7acc0 _wfindfirst32i64 8 API calls 15692->15694 15693->15692 15695 7ff670a72609 15694->15695 15695->14841 15697 7ff670a8aad8 _get_daylight 11 API calls 15696->15697 15698 7ff670a8422b 15697->15698 15699 7ff670a8426b 15698->15699 15700 7ff670a8e0e0 _get_daylight 11 API calls 15698->15700 15705 7ff670a7254b 15698->15705 15699->15705 15708 7ff670a8e7b8 15699->15708 15701 7ff670a84260 15700->15701 15703 7ff670a8a168 __free_lconv_num 11 API calls 15701->15703 15703->15699 15705->15685 15706 7ff670a8a120 _wfindfirst32i64 17 API calls 15707 7ff670a842b0 15706->15707 15713 7ff670a8e7d5 15708->15713 15709 7ff670a8e7da 15710 7ff670a84291 15709->15710 15711 7ff670a841f4 _get_daylight 11 API calls 15709->15711 15710->15705 15710->15706 15712 7ff670a8e7e4 15711->15712 15714 7ff670a8a100 _invalid_parameter_noinfo 37 API calls 15712->15714 15713->15709 15713->15710 15715 7ff670a8e824 15713->15715 15714->15710 15715->15710 15716 7ff670a841f4 _get_daylight 11 API calls 15715->15716 15716->15712 15718 7ff670a77ac4 WideCharToMultiByte 15717->15718 15719 7ff670a77b32 WideCharToMultiByte 15717->15719 15720 7ff670a77b05 15718->15720 15721 7ff670a77aee 15718->15721 15722 7ff670a77b5f 15719->15722 15727 7ff670a73be5 15719->15727 15720->15719 15725 7ff670a77b1b 15720->15725 15723 7ff670a72620 57 API calls 15721->15723 15724 7ff670a72620 57 API calls 15722->15724 15723->15727 15724->15727 15726 7ff670a72620 57 API calls 15725->15726 15726->15727 15727->14852 15727->14854 15729 7ff670a769ce 15728->15729 15730 7ff670a89483 15728->15730 15729->14871 15730->15729 15731 7ff670a8950c __std_exception_copy 37 API calls 15730->15731 15732 7ff670a894b0 15731->15732 15732->15729 15733 7ff670a8a120 _wfindfirst32i64 17 API calls 15732->15733 15734 7ff670a894e0 15733->15734 15736 7ff670a717d4 15735->15736 15737 7ff670a717e4 15735->15737 15738 7ff670a73c90 116 API calls 15736->15738 15739 7ff670a77160 83 API calls 15737->15739 15765 7ff670a71842 15737->15765 15738->15737 15740 7ff670a71815 15739->15740 15740->15765 15769 7ff670a7f830 15740->15769 15742 7ff670a7acc0 _wfindfirst32i64 8 API calls 15744 7ff670a719c0 15742->15744 15743 7ff670a7182b 15745 7ff670a7184c 15743->15745 15746 7ff670a7182f 15743->15746 15744->14886 15744->14887 15773 7ff670a7f518 15745->15773 15748 7ff670a724d0 59 API calls 15746->15748 15748->15765 15750 7ff670a71867 15752 7ff670a724d0 59 API calls 15750->15752 15751 7ff670a7f830 73 API calls 15753 7ff670a718d1 15751->15753 15752->15765 15754 7ff670a718e3 15753->15754 15755 7ff670a718fe 15753->15755 15756 7ff670a724d0 59 API calls 15754->15756 15757 7ff670a7f518 _fread_nolock 53 API calls 15755->15757 15756->15765 15758 7ff670a71913 15757->15758 15758->15750 15759 7ff670a71925 15758->15759 15776 7ff670a7f28c 15759->15776 15762 7ff670a7193d 15763 7ff670a72770 59 API calls 15762->15763 15763->15765 15764 7ff670a71993 15764->15765 15766 7ff670a7f1c8 74 API calls 15764->15766 15765->15742 15766->15765 15767 7ff670a71950 15767->15764 15768 7ff670a72770 59 API calls 15767->15768 15768->15764 15770 7ff670a7f860 15769->15770 15782 7ff670a7f5e0 15770->15782 15772 7ff670a7f879 15772->15743 15794 7ff670a7f538 15773->15794 15777 7ff670a7f295 15776->15777 15781 7ff670a71939 15776->15781 15778 7ff670a841f4 _get_daylight 11 API calls 15777->15778 15779 7ff670a7f29a 15778->15779 15780 7ff670a8a100 _invalid_parameter_noinfo 37 API calls 15779->15780 15780->15781 15781->15762 15781->15767 15783 7ff670a7f64a 15782->15783 15784 7ff670a7f60a 15782->15784 15783->15784 15786 7ff670a7f64f 15783->15786 15785 7ff670a8a030 _invalid_parameter_noinfo 37 API calls 15784->15785 15788 7ff670a7f631 15785->15788 15793 7ff670a8409c EnterCriticalSection 15786->15793 15788->15772 15795 7ff670a7f562 15794->15795 15806 7ff670a71861 15794->15806 15796 7ff670a7f5ae 15795->15796 15797 7ff670a7f571 __scrt_get_show_window_mode 15795->15797 15795->15806 15807 7ff670a8409c EnterCriticalSection 15796->15807 15800 7ff670a841f4 _get_daylight 11 API calls 15797->15800 15802 7ff670a7f586 15800->15802 15804 7ff670a8a100 _invalid_parameter_noinfo 37 API calls 15802->15804 15804->15806 15806->15750 15806->15751 15900 7ff670a766e0 15808->15900 15810 7ff670a71454 15811 7ff670a71459 15810->15811 15909 7ff670a76a00 15810->15909 15811->14915 15814 7ff670a71487 15815 7ff670a724d0 59 API calls 15814->15815 15818 7ff670a7149d 15815->15818 15816 7ff670a714e0 15820 7ff670a7f830 73 API calls 15816->15820 15817 7ff670a714a7 15817->15816 15819 7ff670a73c90 116 API calls 15817->15819 15818->14915 15821 7ff670a714bf 15819->15821 15822 7ff670a714f2 15820->15822 15821->15816 15823 7ff670a714c7 15821->15823 15824 7ff670a71516 15822->15824 15825 7ff670a714f6 15822->15825 15829 7ff670a72770 59 API calls 15823->15829 15827 7ff670a7151c 15824->15827 15828 7ff670a71534 15824->15828 15826 7ff670a724d0 59 API calls 15825->15826 15836 7ff670a714d6 __vcrt_freefls 15826->15836 15929 7ff670a71050 15827->15929 15832 7ff670a71556 15828->15832 15840 7ff670a71575 15828->15840 15829->15836 15831 7ff670a71624 15834 7ff670a7f1c8 74 API calls 15831->15834 15835 7ff670a724d0 59 API calls 15832->15835 15833 7ff670a7f1c8 74 API calls 15833->15831 15834->15818 15835->15836 15836->15831 15836->15833 15837 7ff670a7f518 _fread_nolock 53 API calls 15837->15840 15838 7ff670a715d5 15841 7ff670a724d0 59 API calls 15838->15841 15840->15836 15840->15837 15840->15838 15947 7ff670a7fc24 15840->15947 15841->15836 15843 7ff670a729a6 15842->15843 15844 7ff670a71b30 49 API calls 15843->15844 15846 7ff670a729db 15844->15846 15845 7ff670a72dc9 15846->15845 15847 7ff670a73b00 49 API calls 15846->15847 15848 7ff670a72a57 15847->15848 16522 7ff670a72ff0 15848->16522 15851 7ff670a72ae7 15853 7ff670a766e0 98 API calls 15851->15853 15852 7ff670a72ff0 75 API calls 15854 7ff670a72ae3 15852->15854 15855 7ff670a72aef 15853->15855 15854->15851 15856 7ff670a72b55 15854->15856 15857 7ff670a72b0c 15855->15857 16530 7ff670a765c0 15855->16530 15858 7ff670a72ff0 75 API calls 15856->15858 15861 7ff670a72770 59 API calls 15857->15861 15895 7ff670a72b26 15857->15895 15860 7ff670a72b7e 15858->15860 15862 7ff670a72bd8 15860->15862 15863 7ff670a72ff0 75 API calls 15860->15863 15861->15895 15862->15857 15864 7ff670a766e0 98 API calls 15862->15864 15865 7ff670a72bab 15863->15865 15870 7ff670a72be8 15864->15870 15865->15862 15868 7ff670a72ff0 75 API calls 15865->15868 15866 7ff670a7acc0 _wfindfirst32i64 8 API calls 15867 7ff670a72b4a 15866->15867 15867->14915 15868->15862 15870->15857 15895->15866 15897 7ff670a717a1 15896->15897 15898 7ff670a71795 15896->15898 15897->14915 15899 7ff670a72770 59 API calls 15898->15899 15899->15897 15901 7ff670a76728 15900->15901 15902 7ff670a766f2 15900->15902 15901->15810 15951 7ff670a716d0 15902->15951 15910 7ff670a76a10 15909->15910 15911 7ff670a71b30 49 API calls 15910->15911 15912 7ff670a76a41 15911->15912 15913 7ff670a76bc9 15912->15913 15914 7ff670a71b30 49 API calls 15912->15914 15915 7ff670a7acc0 _wfindfirst32i64 8 API calls 15913->15915 15917 7ff670a76a68 15914->15917 15916 7ff670a7147f 15915->15916 15916->15814 15916->15817 15917->15913 16472 7ff670a84e98 15917->16472 15919 7ff670a76b79 15920 7ff670a77990 57 API calls 15919->15920 15922 7ff670a76b91 15920->15922 15921 7ff670a76bb8 15922->15921 16481 7ff670a72880 15922->16481 15925 7ff670a76a9d 15925->15913 15925->15919 15926 7ff670a84e98 49 API calls 15925->15926 15927 7ff670a77990 57 API calls 15925->15927 15928 7ff670a77800 58 API calls 15925->15928 15926->15925 15927->15925 15928->15925 15930 7ff670a710a6 15929->15930 15931 7ff670a710ad 15930->15931 15932 7ff670a710d3 15930->15932 15933 7ff670a72770 59 API calls 15931->15933 15935 7ff670a710ed 15932->15935 15936 7ff670a71109 15932->15936 15938 7ff670a7111b 15936->15938 15943 7ff670a71137 memcpy_s 15936->15943 15948 7ff670a7fc54 15947->15948 16507 7ff670a7f988 15948->16507 15952 7ff670a716f5 15951->15952 15953 7ff670a72770 59 API calls 15952->15953 15954 7ff670a71738 15952->15954 15953->15954 15955 7ff670a76740 15954->15955 15956 7ff670a76758 15955->15956 15957 7ff670a767cb 15956->15957 15958 7ff670a76778 15956->15958 15959 7ff670a767d0 GetTempPathW 15957->15959 15960 7ff670a76950 61 API calls 15958->15960 15961 7ff670a767e5 15959->15961 15962 7ff670a76784 15960->15962 15995 7ff670a72470 15961->15995 16019 7ff670a76440 15962->16019 15973 7ff670a768a6 15974 7ff670a767fe __vcrt_freefls 15974->15973 15978 7ff670a76831 15974->15978 15999 7ff670a876dc 15974->15999 16002 7ff670a77800 15974->16002 15993 7ff670a7686a __vcrt_freefls 15978->15993 15996 7ff670a72495 15995->15996 16053 7ff670a83be8 15996->16053 16020 7ff670a7644c 16019->16020 16021 7ff670a77990 57 API calls 16020->16021 16022 7ff670a7646e 16021->16022 16023 7ff670a76489 ExpandEnvironmentStringsW 16022->16023 16024 7ff670a76476 16022->16024 16025 7ff670a764af __vcrt_freefls 16023->16025 16026 7ff670a72770 59 API calls 16024->16026 16028 7ff670a764b3 16025->16028 16030 7ff670a764c6 16025->16030 16027 7ff670a76482 16026->16027 16031 7ff670a7acc0 _wfindfirst32i64 8 API calls 16027->16031 16029 7ff670a72770 59 API calls 16028->16029 16029->16027 16033 7ff670a764d4 16030->16033 16034 7ff670a764e0 16030->16034 16032 7ff670a765a8 16031->16032 16032->15993 16043 7ff670a86444 16032->16043 16356 7ff670a85cd4 16033->16356 16363 7ff670a850f8 16034->16363 16037 7ff670a764de 16044 7ff670a86464 16043->16044 16057 7ff670a83c42 16053->16057 16054 7ff670a83c67 16055 7ff670a8a030 _invalid_parameter_noinfo 37 API calls 16054->16055 16059 7ff670a83c91 16055->16059 16056 7ff670a83ca3 16071 7ff670a82024 16056->16071 16057->16054 16057->16056 16061 7ff670a7acc0 _wfindfirst32i64 8 API calls 16059->16061 16060 7ff670a83d84 16064 7ff670a724b4 16061->16064 16064->15974 16065 7ff670a83daa 16065->16060 16067 7ff670a83db4 16065->16067 16066 7ff670a83d59 16068 7ff670a8a168 __free_lconv_num 11 API calls 16066->16068 16068->16059 16069 7ff670a83d50 16069->16060 16069->16066 16072 7ff670a82062 16071->16072 16073 7ff670a82052 16071->16073 16074 7ff670a82068 16072->16074 16078 7ff670a82098 16072->16078 16077 7ff670a8a030 _invalid_parameter_noinfo 37 API calls 16073->16077 16075 7ff670a8a030 _invalid_parameter_noinfo 37 API calls 16074->16075 16076 7ff670a82090 16075->16076 16076->16060 16076->16065 16076->16066 16076->16069 16077->16076 16078->16073 16078->16076 16082 7ff670a829e4 16078->16082 16113 7ff670a8246c 16078->16113 16148 7ff670a81c10 16078->16148 16083 7ff670a82a9a 16082->16083 16084 7ff670a82a28 16082->16084 16086 7ff670a82b18 16083->16086 16087 7ff670a82aa0 16083->16087 16085 7ff670a82b0b 16084->16085 16097 7ff670a82a2e 16084->16097 16087->16085 16097->16086 16114 7ff670a8247a 16113->16114 16115 7ff670a82490 16113->16115 16204 7ff670a8010c 16148->16204 16205 7ff670a80153 16204->16205 16206 7ff670a80141 16204->16206 16357 7ff670a85cf2 16356->16357 16360 7ff670a85d25 16356->16360 16357->16360 16375 7ff670a8fc64 16357->16375 16360->16037 16364 7ff670a85114 16363->16364 16365 7ff670a85182 16363->16365 16364->16365 16473 7ff670a8a960 __FrameHandler3::FrameUnwindToEmptyState 45 API calls 16472->16473 16474 7ff670a84ead 16473->16474 16475 7ff670a8f1f9 16474->16475 16480 7ff670a8f112 16474->16480 16494 7ff670a7b0c4 16475->16494 16478 7ff670a7acc0 _wfindfirst32i64 8 API calls 16479 7ff670a8f1f1 16478->16479 16479->15925 16480->16478 16482 7ff670a728a0 16481->16482 16497 7ff670a7b0d8 IsProcessorFeaturePresent 16494->16497 16498 7ff670a7b0ef 16497->16498 16503 7ff670a7b174 RtlCaptureContext RtlLookupFunctionEntry 16498->16503 16504 7ff670a7b103 16503->16504 16505 7ff670a7b1a4 RtlVirtualUnwind 16503->16505 16506 7ff670a7afb4 SetUnhandledExceptionFilter UnhandledExceptionFilter GetCurrentProcess TerminateProcess 16504->16506 16505->16504 16523 7ff670a73024 16522->16523 16524 7ff670a83994 49 API calls 16523->16524 16525 7ff670a7304a 16524->16525 16526 7ff670a7305b 16525->16526 16554 7ff670a84bbc 16525->16554 16528 7ff670a7acc0 _wfindfirst32i64 8 API calls 16526->16528 16529 7ff670a72a96 16528->16529 16529->15851 16529->15852 16531 7ff670a765ce 16530->16531 16532 7ff670a73c90 116 API calls 16531->16532 16533 7ff670a765f5 16532->16533 16534 7ff670a76a00 132 API calls 16533->16534 16535 7ff670a76603 16534->16535 16555 7ff670a84bd9 16554->16555 16556 7ff670a84be5 16554->16556 16571 7ff670a84430 16555->16571 16596 7ff670a847cc 16556->16596 16562 7ff670a84c1d 16607 7ff670a842b4 16562->16607 16564 7ff670a84c8d 16567 7ff670a84430 69 API calls 16564->16567 16565 7ff670a84c79 16566 7ff670a84bde 16565->16566 16568 7ff670a8a168 __free_lconv_num 11 API calls 16565->16568 16566->16526 16569 7ff670a84c99 16567->16569 16568->16566 16569->16566 16572 7ff670a8444a 16571->16572 16573 7ff670a84467 16571->16573 16574 7ff670a841d4 _fread_nolock 11 API calls 16572->16574 16573->16572 16575 7ff670a8447a CreateFileW 16573->16575 16576 7ff670a8444f 16574->16576 16577 7ff670a844e4 16575->16577 16578 7ff670a844ae 16575->16578 16580 7ff670a841f4 _get_daylight 11 API calls 16576->16580 16655 7ff670a84aac 16577->16655 16629 7ff670a84584 GetFileType 16578->16629 16583 7ff670a84457 16580->16583 16587 7ff670a8a100 _invalid_parameter_noinfo 37 API calls 16583->16587 16585 7ff670a844ed 16586 7ff670a84518 16590 7ff670a84462 16587->16590 16590->16566 16597 7ff670a847f0 16596->16597 16603 7ff670a847eb 16596->16603 16598 7ff670a8a960 __FrameHandler3::FrameUnwindToEmptyState 45 API calls 16597->16598 16597->16603 16599 7ff670a8480b 16598->16599 16717 7ff670a8ceb0 16599->16717 16603->16562 16604 7ff670a8e370 16603->16604 16725 7ff670a8e158 16604->16725 16608 7ff670a84302 16607->16608 16609 7ff670a842de 16607->16609 16610 7ff670a8435c 16608->16610 16611 7ff670a84307 16608->16611 16613 7ff670a8a168 __free_lconv_num 11 API calls 16609->16613 16618 7ff670a842ed 16609->16618 16735 7ff670a8eb84 16610->16735 16614 7ff670a8431c 16611->16614 16615 7ff670a8a168 __free_lconv_num 11 API calls 16611->16615 16611->16618 16613->16618 16616 7ff670a8ce50 _fread_nolock 12 API calls 16614->16616 16615->16614 16616->16618 16618->16564 16618->16565 16630 7ff670a845d2 16629->16630 16631 7ff670a8468f 16629->16631 16634 7ff670a845fe GetFileInformationByHandle 16630->16634 16639 7ff670a849a4 21 API calls 16630->16639 16632 7ff670a846b9 16631->16632 16633 7ff670a84697 16631->16633 16638 7ff670a846dc PeekNamedPipe 16632->16638 16654 7ff670a8467a 16632->16654 16635 7ff670a8469b 16633->16635 16636 7ff670a846aa GetLastError 16633->16636 16634->16636 16637 7ff670a84627 16634->16637 16641 7ff670a841f4 _get_daylight 11 API calls 16635->16641 16643 7ff670a84168 _fread_nolock 11 API calls 16636->16643 16642 7ff670a84868 51 API calls 16637->16642 16638->16654 16640 7ff670a845ec 16639->16640 16640->16634 16640->16654 16641->16654 16644 7ff670a84632 16642->16644 16643->16654 16645 7ff670a7acc0 _wfindfirst32i64 8 API calls 16646 7ff670a844bc 16645->16646 16654->16645 16656 7ff670a84ae2 16655->16656 16657 7ff670a84b7a __vcrt_freefls 16656->16657 16658 7ff670a841f4 _get_daylight 11 API calls 16656->16658 16659 7ff670a7acc0 _wfindfirst32i64 8 API calls 16657->16659 16660 7ff670a84af4 16658->16660 16661 7ff670a844e9 16659->16661 16662 7ff670a841f4 _get_daylight 11 API calls 16660->16662 16661->16585 16661->16586 16663 7ff670a84afc 16662->16663 16718 7ff670a8cec5 16717->16718 16719 7ff670a8482e 16717->16719 16718->16719 16720 7ff670a92738 45 API calls 16718->16720 16721 7ff670a8cf1c 16719->16721 16720->16719 16722 7ff670a8cf31 16721->16722 16724 7ff670a8cf44 16721->16724 16723 7ff670a91ac0 45 API calls 16722->16723 16722->16724 16723->16724 16724->16603 16726 7ff670a8e1b9 16725->16726 16728 7ff670a8e1b4 __vcrt_FlsAlloc 16725->16728 16726->16562 16727 7ff670a8e1e8 LoadLibraryExW 16730 7ff670a8e2bd 16727->16730 16731 7ff670a8e20d GetLastError 16727->16731 16728->16726 16728->16727 16729 7ff670a8e2dd GetProcAddress 16728->16729 16734 7ff670a8e247 LoadLibraryExW 16728->16734 16729->16726 16733 7ff670a8e2ee 16729->16733 16730->16729 16732 7ff670a8e2d4 FreeLibrary 16730->16732 16731->16728 16732->16729 16733->16726 16734->16728 16734->16730 16736 7ff670a8eb8c MultiByteToWideChar 16735->16736 16765 7ff670a87120 16764->16765 16777 7ff670a871d2 memcpy_s 16764->16777 16767 7ff670a87137 16765->16767 16769 7ff670a871e2 16765->16769 16766 7ff670a841f4 _get_daylight 11 API calls 16780 7ff670a76f80 16766->16780 16799 7ff670a8fac8 EnterCriticalSection 16767->16799 16771 7ff670a8aad8 _get_daylight 11 API calls 16769->16771 16769->16777 16772 7ff670a871fe 16771->16772 16772->16777 16777->16766 16777->16780 16780->14929 16839 7ff670a7b1fe RtlLookupFunctionEntry 16838->16839 16840 7ff670a7b01b 16839->16840 16841 7ff670a7b214 RtlVirtualUnwind 16839->16841 16842 7ff670a7afb4 SetUnhandledExceptionFilter UnhandledExceptionFilter GetCurrentProcess TerminateProcess 16840->16842 16841->16839 16841->16840 16844 7ff670a851ac 16843->16844 16845 7ff670a851d2 16844->16845 16847 7ff670a85205 16844->16847 16846 7ff670a841f4 _get_daylight 11 API calls 16845->16846 16848 7ff670a851d7 16846->16848 16849 7ff670a8520b 16847->16849 16850 7ff670a85218 16847->16850 16851 7ff670a8a100 _invalid_parameter_noinfo 37 API calls 16848->16851 16853 7ff670a841f4 _get_daylight 11 API calls 16849->16853 16862 7ff670a8a448 16850->16862 16852 7ff670a73ce9 16851->16852 16852->15004 16853->16852 16875 7ff670a8fac8 EnterCriticalSection 16862->16875 17223 7ff670a87cc4 17222->17223 17226 7ff670a877a8 17223->17226 17225 7ff670a87cdd 17225->15013 17227 7ff670a877c3 17226->17227 17228 7ff670a877f2 17226->17228 17230 7ff670a8a030 _invalid_parameter_noinfo 37 API calls 17227->17230 17236 7ff670a8409c EnterCriticalSection 17228->17236 17232 7ff670a877e3 17230->17232 17232->17225 17238 7ff670a7efc3 17237->17238 17239 7ff670a7eff1 17237->17239 17240 7ff670a8a030 _invalid_parameter_noinfo 37 API calls 17238->17240 17242 7ff670a7efe3 17239->17242 17247 7ff670a8409c EnterCriticalSection 17239->17247 17240->17242 17242->15018 17249 7ff670a712f8 17248->17249 17250 7ff670a712c6 17248->17250 17251 7ff670a7f830 73 API calls 17249->17251 17252 7ff670a73c90 116 API calls 17250->17252 17253 7ff670a7130a 17251->17253 17254 7ff670a712d6 17252->17254 17255 7ff670a7130e 17253->17255 17256 7ff670a7132f 17253->17256 17254->17249 17257 7ff670a712de 17254->17257 17258 7ff670a724d0 59 API calls 17255->17258 17262 7ff670a71364 17256->17262 17263 7ff670a71344 17256->17263 17259 7ff670a72770 59 API calls 17257->17259 17260 7ff670a71325 17258->17260 17261 7ff670a712ee 17259->17261 17260->15029 17261->15029 17265 7ff670a7137e 17262->17265 17270 7ff670a71395 17262->17270 17264 7ff670a724d0 59 API calls 17263->17264 17269 7ff670a7135f __vcrt_freefls 17264->17269 17266 7ff670a71050 98 API calls 17265->17266 17266->17269 17267 7ff670a7f518 _fread_nolock 53 API calls 17267->17270 17268 7ff670a71421 17268->15029 17269->17268 17271 7ff670a7f1c8 74 API calls 17269->17271 17270->17267 17270->17269 17272 7ff670a713de 17270->17272 17271->17268 17273 7ff670a724d0 59 API calls 17272->17273 17273->17269 17275 7ff670a71b30 49 API calls 17274->17275 17276 7ff670a73d40 17275->17276 17276->15031 17278 7ff670a716aa 17277->17278 17279 7ff670a71666 17277->17279 17278->15040 17279->17278 17280 7ff670a72770 59 API calls 17279->17280 17281 7ff670a716be 17280->17281 17281->15040 17283 7ff670a77990 57 API calls 17282->17283 17284 7ff670a77127 LoadLibraryExW 17283->17284 17285 7ff670a77144 __vcrt_freefls 17284->17285 17285->15055 17287 7ff670a74950 17286->17287 17288 7ff670a71b30 49 API calls 17287->17288 17289 7ff670a74982 17288->17289 17290 7ff670a749ab 17289->17290 17291 7ff670a7498b 17289->17291 17293 7ff670a74a02 17290->17293 17296 7ff670a73d10 49 API calls 17290->17296 17292 7ff670a72770 59 API calls 17291->17292 17295 7ff670a749a1 17292->17295 17294 7ff670a73d10 49 API calls 17293->17294 17297 7ff670a74a1b 17294->17297 17301 7ff670a7acc0 _wfindfirst32i64 8 API calls 17295->17301 17298 7ff670a749cc 17296->17298 17299 7ff670a74a39 17297->17299 17302 7ff670a72770 59 API calls 17297->17302 17300 7ff670a749ea 17298->17300 17304 7ff670a72770 59 API calls 17298->17304 17303 7ff670a77110 58 API calls 17299->17303 17371 7ff670a73c20 17300->17371 17306 7ff670a7309e 17301->17306 17302->17299 17307 7ff670a74a46 17303->17307 17304->17300 17306->15134 17314 7ff670a74cc0 17306->17314 17309 7ff670a74a6d 17307->17309 17310 7ff670a74a4b 17307->17310 17377 7ff670a73dd0 GetProcAddress 17309->17377 17311 7ff670a72620 57 API calls 17310->17311 17311->17295 17313 7ff670a77110 58 API calls 17313->17293 17315 7ff670a76950 61 API calls 17314->17315 17317 7ff670a74cd5 17315->17317 17316 7ff670a74cf0 17318 7ff670a77990 57 API calls 17316->17318 17317->17316 17319 7ff670a72880 59 API calls 17317->17319 17320 7ff670a74d34 17318->17320 17319->17316 17321 7ff670a74d39 17320->17321 17322 7ff670a74d50 17320->17322 17323 7ff670a72770 59 API calls 17321->17323 17325 7ff670a77990 57 API calls 17322->17325 17324 7ff670a74d45 17323->17324 17324->15136 17326 7ff670a74d85 17325->17326 17328 7ff670a71b30 49 API calls 17326->17328 17340 7ff670a74d8a __vcrt_freefls 17326->17340 17327 7ff670a72770 59 API calls 17329 7ff670a74f31 17327->17329 17330 7ff670a74e07 17328->17330 17329->15136 17331 7ff670a74e33 17330->17331 17332 7ff670a74e0e 17330->17332 17340->17327 17341 7ff670a74f1a 17340->17341 17341->15136 17343 7ff670a746d7 17342->17343 17343->17343 17372 7ff670a73c2a 17371->17372 17373 7ff670a77990 57 API calls 17372->17373 17374 7ff670a73c52 17373->17374 17375 7ff670a7acc0 _wfindfirst32i64 8 API calls 17374->17375 17376 7ff670a73c7a 17375->17376 17376->17293 17376->17313 17378 7ff670a73e1b GetProcAddress 17377->17378 17379 7ff670a73df8 17377->17379 17378->17379 17380 7ff670a73e40 GetProcAddress 17378->17380 17381 7ff670a72620 57 API calls 17379->17381 17380->17379 17382 7ff670a73e65 GetProcAddress 17380->17382 17383 7ff670a73e0b 17381->17383 17382->17379 17384 7ff670a73e8d GetProcAddress 17382->17384 17383->17295 17384->17379 17385 7ff670a73eb5 GetProcAddress 17384->17385 17385->17379 17386 7ff670a73edd GetProcAddress 17385->17386 17387 7ff670a73ef9 17386->17387 17388 7ff670a73f05 GetProcAddress 17386->17388 17387->17388 17389 7ff670a73f2d GetProcAddress 17388->17389 17390 7ff670a73f21 17388->17390 17390->17389 17616 7ff670a8a960 __FrameHandler3::FrameUnwindToEmptyState 45 API calls 17615->17616 17617 7ff670a89441 17616->17617 17618 7ff670a8956c __FrameHandler3::FrameUnwindToEmptyState 45 API calls 17617->17618 17619 7ff670a89461 17618->17619 19227 7ff670a88db0 19230 7ff670a88d34 19227->19230 19237 7ff670a8fac8 EnterCriticalSection 19230->19237 18736 7ff670a90b20 18747 7ff670a96680 18736->18747 18748 7ff670a9668d 18747->18748 18749 7ff670a8a168 __free_lconv_num 11 API calls 18748->18749 18750 7ff670a966a9 18748->18750 18749->18748 18751 7ff670a8a168 __free_lconv_num 11 API calls 18750->18751 18752 7ff670a90b29 18750->18752 18751->18750 18753 7ff670a8fac8 EnterCriticalSection 18752->18753 17717 7ff670a864a4 17718 7ff670a8650b 17717->17718 17719 7ff670a864d2 17717->17719 17718->17719 17721 7ff670a86510 FindFirstFileExW 17718->17721 17720 7ff670a841f4 _get_daylight 11 API calls 17719->17720 17722 7ff670a864d7 17720->17722 17723 7ff670a86579 17721->17723 17724 7ff670a86532 GetLastError 17721->17724 17725 7ff670a8a100 _invalid_parameter_noinfo 37 API calls 17722->17725 17777 7ff670a86714 17723->17777 17727 7ff670a8653d 17724->17727 17728 7ff670a8654c 17724->17728 17745 7ff670a864e2 17725->17745 17731 7ff670a86569 17727->17731 17734 7ff670a86559 17727->17734 17735 7ff670a86547 17727->17735 17729 7ff670a841f4 _get_daylight 11 API calls 17728->17729 17729->17745 17732 7ff670a841f4 _get_daylight 11 API calls 17731->17732 17732->17745 17733 7ff670a86714 _wfindfirst32i64 10 API calls 17738 7ff670a8659f 17733->17738 17736 7ff670a841f4 _get_daylight 11 API calls 17734->17736 17735->17728 17735->17731 17736->17745 17737 7ff670a7acc0 _wfindfirst32i64 8 API calls 17739 7ff670a864f6 17737->17739 17740 7ff670a86714 _wfindfirst32i64 10 API calls 17738->17740 17741 7ff670a865ad 17740->17741 17742 7ff670a8fc64 _wfindfirst32i64 37 API calls 17741->17742 17743 7ff670a865cb 17742->17743 17744 7ff670a865d7 17743->17744 17743->17745 17746 7ff670a8a120 _wfindfirst32i64 17 API calls 17744->17746 17745->17737 17747 7ff670a865eb 17746->17747 17748 7ff670a86615 17747->17748 17750 7ff670a86654 FindNextFileW 17747->17750 17749 7ff670a841f4 _get_daylight 11 API calls 17748->17749 17751 7ff670a8661a 17749->17751 17752 7ff670a866a4 17750->17752 17753 7ff670a86663 GetLastError 17750->17753 17754 7ff670a8a100 _invalid_parameter_noinfo 37 API calls 17751->17754 17758 7ff670a86714 _wfindfirst32i64 10 API calls 17752->17758 17755 7ff670a8667d 17753->17755 17756 7ff670a8666e 17753->17756 17757 7ff670a86625 17754->17757 17761 7ff670a841f4 _get_daylight 11 API calls 17755->17761 17760 7ff670a86697 17756->17760 17763 7ff670a8668a 17756->17763 17764 7ff670a86678 17756->17764 17766 7ff670a7acc0 _wfindfirst32i64 8 API calls 17757->17766 17759 7ff670a866bc 17758->17759 17762 7ff670a86714 _wfindfirst32i64 10 API calls 17759->17762 17765 7ff670a841f4 _get_daylight 11 API calls 17760->17765 17761->17757 17767 7ff670a866ca 17762->17767 17768 7ff670a841f4 _get_daylight 11 API calls 17763->17768 17764->17755 17764->17760 17765->17757 17769 7ff670a86638 17766->17769 17770 7ff670a86714 _wfindfirst32i64 10 API calls 17767->17770 17768->17757 17771 7ff670a866d8 17770->17771 17772 7ff670a8fc64 _wfindfirst32i64 37 API calls 17771->17772 17773 7ff670a866f6 17772->17773 17773->17757 17774 7ff670a866fe 17773->17774 17775 7ff670a8a120 _wfindfirst32i64 17 API calls 17774->17775 17776 7ff670a86712 17775->17776 17778 7ff670a8672c 17777->17778 17779 7ff670a86732 FileTimeToSystemTime 17777->17779 17778->17779 17782 7ff670a86757 17778->17782 17780 7ff670a86741 SystemTimeToTzSpecificLocalTime 17779->17780 17779->17782 17780->17782 17781 7ff670a7acc0 _wfindfirst32i64 8 API calls 17783 7ff670a86591 17781->17783 17782->17781 17783->17733 17674 7ff670a88b11 17675 7ff670a89438 45 API calls 17674->17675 17676 7ff670a88b16 17675->17676 17677 7ff670a88b87 17676->17677 17678 7ff670a88b3d GetModuleHandleW 17676->17678 17686 7ff670a88a14 17677->17686 17678->17677 17683 7ff670a88b4a 17678->17683 17683->17677 17700 7ff670a88c44 GetModuleHandleExW 17683->17700 17706 7ff670a8fac8 EnterCriticalSection 17686->17706 17701 7ff670a88ca1 17700->17701 17702 7ff670a88c78 GetProcAddress 17700->17702 17703 7ff670a88ca6 FreeLibrary 17701->17703 17704 7ff670a88cad 17701->17704 17705 7ff670a88c8a 17702->17705 17703->17704 17704->17677 17705->17701 18399 7ff670a79610 18400 7ff670a7963e 18399->18400 18401 7ff670a79625 18399->18401 18401->18400 18403 7ff670a8ce50 12 API calls 18401->18403 18402 7ff670a7969c 18403->18402 18783 7ff670a993fc 18785 7ff670a9940c 18783->18785 18787 7ff670a840a8 LeaveCriticalSection 18785->18787

                                                                                                                                                                                                                                              Executed Functions

                                                                                                                                                                                                                                              Function 00007FF670A94D48 Relevance: 14.3, APIs: 6, Strings: 2, Instructions: 334timeCOMMON
                                                                                                                                                                                                                                              Download Yara Rule

                                                                                                                                                                                                                                              Control-flow Graph

                                                                                                                                                                                                                                              • Executed
                                                                                                                                                                                                                                              • Not Executed
                                                                                                                                                                                                                                              control_flow_graph 135 7ff670a94d48-7ff670a94d83 call 7ff670a946d8 call 7ff670a946e0 call 7ff670a94748 142 7ff670a94d89-7ff670a94d94 call 7ff670a946e8 135->142 143 7ff670a94fad-7ff670a94ff9 call 7ff670a8a120 call 7ff670a946d8 call 7ff670a946e0 call 7ff670a94748 135->143 142->143 148 7ff670a94d9a-7ff670a94da4 142->148 168 7ff670a94fff-7ff670a9500a call 7ff670a946e8 143->168 169 7ff670a95137-7ff670a951a5 call 7ff670a8a120 call 7ff670a909e8 143->169 150 7ff670a94dc6-7ff670a94dca 148->150 151 7ff670a94da6-7ff670a94da9 148->151 154 7ff670a94dcd-7ff670a94dd5 150->154 153 7ff670a94dac-7ff670a94db7 151->153 156 7ff670a94dc2-7ff670a94dc4 153->156 157 7ff670a94db9-7ff670a94dc0 153->157 154->154 158 7ff670a94dd7-7ff670a94dea call 7ff670a8ce50 154->158 156->150 160 7ff670a94df3-7ff670a94e01 156->160 157->153 157->156 166 7ff670a94e02-7ff670a94e0e call 7ff670a8a168 158->166 167 7ff670a94dec-7ff670a94dee call 7ff670a8a168 158->167 176 7ff670a94e15-7ff670a94e1d 166->176 167->160 168->169 178 7ff670a95010-7ff670a9501b call 7ff670a94718 168->178 189 7ff670a951b3-7ff670a951b6 169->189 190 7ff670a951a7-7ff670a951ae 169->190 176->176 179 7ff670a94e1f-7ff670a94e30 call 7ff670a8fc64 176->179 178->169 187 7ff670a95021-7ff670a95044 call 7ff670a8a168 GetTimeZoneInformation 178->187 179->143 188 7ff670a94e36-7ff670a94e8c call 7ff670a7c140 * 4 call 7ff670a94c64 179->188 204 7ff670a9504a-7ff670a9506b 187->204 205 7ff670a9510c-7ff670a95136 call 7ff670a946d0 call 7ff670a946c0 call 7ff670a946c8 187->205 247 7ff670a94e8e-7ff670a94e92 188->247 191 7ff670a951b8 189->191 192 7ff670a951ed-7ff670a95200 call 7ff670a8ce50 189->192 195 7ff670a95243-7ff670a95246 190->195 196 7ff670a951bb call 7ff670a94fc4 191->196 210 7ff670a95202 192->210 211 7ff670a9520b-7ff670a95226 call 7ff670a909e8 192->211 195->196 197 7ff670a9524c-7ff670a95254 call 7ff670a94d48 195->197 208 7ff670a951c0-7ff670a951ec call 7ff670a8a168 call 7ff670a7acc0 196->208 197->208 212 7ff670a95076-7ff670a9507d 204->212 213 7ff670a9506d-7ff670a95073 204->213 218 7ff670a95204-7ff670a95209 call 7ff670a8a168 210->218 230 7ff670a95228-7ff670a9522b 211->230 231 7ff670a9522d-7ff670a9523f call 7ff670a8a168 211->231 219 7ff670a9507f-7ff670a95087 212->219 220 7ff670a95091 212->220 213->212 218->191 219->220 228 7ff670a95089-7ff670a9508f 219->228 224 7ff670a95093-7ff670a95107 call 7ff670a7c140 * 4 call 7ff670a91f84 call 7ff670a9525c * 2 220->224 224->205 228->224 230->218 231->195 249 7ff670a94e94 247->249 250 7ff670a94e98-7ff670a94e9c 247->250 249->250 250->247 252 7ff670a94e9e-7ff670a94ec3 call 7ff670a97b68 250->252 258 7ff670a94ec6-7ff670a94eca 252->258 260 7ff670a94ed9-7ff670a94edd 258->260 261 7ff670a94ecc-7ff670a94ed7 258->261 260->258 261->260 263 7ff670a94edf-7ff670a94ee3 261->263 266 7ff670a94f64-7ff670a94f68 263->266 267 7ff670a94ee5-7ff670a94f0d call 7ff670a97b68 263->267 269 7ff670a94f6f-7ff670a94f7c 266->269 270 7ff670a94f6a-7ff670a94f6c 266->270 275 7ff670a94f0f 267->275 276 7ff670a94f2b-7ff670a94f2f 267->276 272 7ff670a94f7e-7ff670a94f94 call 7ff670a94c64 269->272 273 7ff670a94f97-7ff670a94fa6 call 7ff670a946d0 call 7ff670a946c0 269->273 270->269 272->273 273->143 279 7ff670a94f12-7ff670a94f19 275->279 276->266 281 7ff670a94f31-7ff670a94f4f call 7ff670a97b68 276->281 279->276 282 7ff670a94f1b-7ff670a94f29 279->282 287 7ff670a94f5b-7ff670a94f62 281->287 282->276 282->279 287->266 288 7ff670a94f51-7ff670a94f55 287->288 288->266 289 7ff670a94f57 288->289 289->287
                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                              • _get_daylight.LIBCMT ref: 00007FF670A94D8D
                                                                                                                                                                                                                                                • Part of subcall function 00007FF670A946E8: _invalid_parameter_noinfo.LIBCMT ref: 00007FF670A946FC
                                                                                                                                                                                                                                                • Part of subcall function 00007FF670A8A168: RtlFreeHeap.NTDLL(?,?,?,00007FF670A9214A,?,?,?,00007FF670A92187,?,?,00000000,00007FF670A92658,?,?,?,00007FF670A9258B), ref: 00007FF670A8A17E
                                                                                                                                                                                                                                                • Part of subcall function 00007FF670A8A168: GetLastError.KERNEL32(?,?,?,00007FF670A9214A,?,?,?,00007FF670A92187,?,?,00000000,00007FF670A92658,?,?,?,00007FF670A9258B), ref: 00007FF670A8A188
                                                                                                                                                                                                                                                • Part of subcall function 00007FF670A8A120: IsProcessorFeaturePresent.KERNEL32(?,?,?,?,00007FF670A8A0FE,?,?,?,?,?,00007FF670A8201E), ref: 00007FF670A8A129
                                                                                                                                                                                                                                                • Part of subcall function 00007FF670A8A120: GetCurrentProcess.KERNEL32(?,?,?,?,00007FF670A8A0FE,?,?,?,?,?,00007FF670A8201E), ref: 00007FF670A8A14E
                                                                                                                                                                                                                                              • _get_daylight.LIBCMT ref: 00007FF670A94D7C
                                                                                                                                                                                                                                                • Part of subcall function 00007FF670A94748: _invalid_parameter_noinfo.LIBCMT ref: 00007FF670A9475C
                                                                                                                                                                                                                                              • _get_daylight.LIBCMT ref: 00007FF670A94FF2
                                                                                                                                                                                                                                              • _get_daylight.LIBCMT ref: 00007FF670A95003
                                                                                                                                                                                                                                              • _get_daylight.LIBCMT ref: 00007FF670A95014
                                                                                                                                                                                                                                              • GetTimeZoneInformation.KERNELBASE(?,?,?,?,?,?,?,?,?,00000000,?,00007FF670A95254), ref: 00007FF670A9503B
                                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 00000019.00000002.2211089282.00007FF670A71000.00000020.00000001.01000000.0000003F.sdmp, Offset: 00007FF670A70000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 00000019.00000002.2211012606.00007FF670A70000.00000002.00000001.01000000.0000003F.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000019.00000002.2211171848.00007FF670A9A000.00000002.00000001.01000000.0000003F.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000019.00000002.2211223436.00007FF670AAD000.00000004.00000001.01000000.0000003F.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000019.00000002.2211223436.00007FF670ABC000.00000004.00000001.01000000.0000003F.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000019.00000002.2211367389.00007FF670ABE000.00000002.00000001.01000000.0000003F.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_25_2_7ff670a70000_dat.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: _get_daylight$_invalid_parameter_noinfo$CurrentErrorFeatureFreeHeapInformationLastPresentProcessProcessorTimeZone
                                                                                                                                                                                                                                              • String ID: Eastern Standard Time$Eastern Summer Time
                                                                                                                                                                                                                                              • API String ID: 4070488512-239921721
                                                                                                                                                                                                                                              • Opcode ID: 117bb5b06d64383e6cb5a61328ac0362288f3110439e8fd4eb588df6a1d5683c
                                                                                                                                                                                                                                              • Instruction ID: 0b52e011238e2a992fe1d2dde9f2171429d0b83af9c04be4ab3336182ae9e5c4
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 117bb5b06d64383e6cb5a61328ac0362288f3110439e8fd4eb588df6a1d5683c
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 09D1C027B38242A6EB24EF26D8515B963A1FF84B94F408135EA0DC7787EF7DE4418760
                                                                                                                                                                                                                                              Function 00007FF670A76740 Relevance: 12.4, APIs: 3, Strings: 4, Instructions: 139COMMON
                                                                                                                                                                                                                                              Download Yara Rule

                                                                                                                                                                                                                                              Control-flow Graph

                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                              • GetTempPathW.KERNEL32(?,00000000,?,00007FF670A7670D), ref: 00007FF670A767DA
                                                                                                                                                                                                                                                • Part of subcall function 00007FF670A76950: GetEnvironmentVariableW.KERNEL32(00007FF670A736C7), ref: 00007FF670A7698A
                                                                                                                                                                                                                                                • Part of subcall function 00007FF670A76950: ExpandEnvironmentStringsW.KERNEL32 ref: 00007FF670A769A7
                                                                                                                                                                                                                                                • Part of subcall function 00007FF670A86444: _invalid_parameter_noinfo.LIBCMT ref: 00007FF670A8645D
                                                                                                                                                                                                                                              • SetEnvironmentVariableW.KERNEL32(?,TokenIntegrityLevel), ref: 00007FF670A76891
                                                                                                                                                                                                                                                • Part of subcall function 00007FF670A72770: MessageBoxW.USER32 ref: 00007FF670A72841
                                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 00000019.00000002.2211089282.00007FF670A71000.00000020.00000001.01000000.0000003F.sdmp, Offset: 00007FF670A70000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 00000019.00000002.2211012606.00007FF670A70000.00000002.00000001.01000000.0000003F.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000019.00000002.2211171848.00007FF670A9A000.00000002.00000001.01000000.0000003F.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000019.00000002.2211223436.00007FF670AAD000.00000004.00000001.01000000.0000003F.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000019.00000002.2211223436.00007FF670ABC000.00000004.00000001.01000000.0000003F.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000019.00000002.2211367389.00007FF670ABE000.00000002.00000001.01000000.0000003F.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_25_2_7ff670a70000_dat.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: Environment$Variable$ExpandMessagePathStringsTemp_invalid_parameter_noinfo
                                                                                                                                                                                                                                              • String ID: LOADER: Failed to set the TMP environment variable.$TMP$TMP$_MEI%d
                                                                                                                                                                                                                                              • API String ID: 3752271684-1116378104
                                                                                                                                                                                                                                              • Opcode ID: daad18c94c9eccee41a47fbc3eff9a78f751603554adec551ca5327a9dc0f93d
                                                                                                                                                                                                                                              • Instruction ID: 5493a74bc1cc651485ae582cfd3382117291b5c3f3e17a1b629bc09190f4a67f
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: daad18c94c9eccee41a47fbc3eff9a78f751603554adec551ca5327a9dc0f93d
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 11514E13B39A5375FA55E722A9152BE5291AF89BC0F44A031ED0EC77DBEF2CE4018720
                                                                                                                                                                                                                                              Function 00007FF670A8B28C Relevance: 10.8, APIs: 7, Instructions: 286COMMONLIBRARYCODE
                                                                                                                                                                                                                                              Download Yara Rule

                                                                                                                                                                                                                                              Control-flow Graph

                                                                                                                                                                                                                                              • Executed
                                                                                                                                                                                                                                              • Not Executed
                                                                                                                                                                                                                                              control_flow_graph 694 7ff670a8b28c-7ff670a8b2ad 695 7ff670a8b2af-7ff670a8b2c2 call 7ff670a841d4 call 7ff670a841f4 694->695 696 7ff670a8b2c7-7ff670a8b2c9 694->696 712 7ff670a8b6c3 695->712 698 7ff670a8b2cf-7ff670a8b2d6 696->698 699 7ff670a8b6ab-7ff670a8b6b8 call 7ff670a841d4 call 7ff670a841f4 696->699 698->699 701 7ff670a8b2dc-7ff670a8b310 698->701 718 7ff670a8b6be call 7ff670a8a100 699->718 701->699 704 7ff670a8b316-7ff670a8b31d 701->704 707 7ff670a8b31f-7ff670a8b332 call 7ff670a841d4 call 7ff670a841f4 704->707 708 7ff670a8b337-7ff670a8b33a 704->708 707->718 710 7ff670a8b340-7ff670a8b342 708->710 711 7ff670a8b6a7-7ff670a8b6a9 708->711 710->711 716 7ff670a8b348-7ff670a8b34b 710->716 715 7ff670a8b6c6-7ff670a8b6d5 711->715 712->715 716->707 719 7ff670a8b34d-7ff670a8b371 716->719 718->712 722 7ff670a8b373-7ff670a8b376 719->722 723 7ff670a8b3a6-7ff670a8b3ae 719->723 725 7ff670a8b39e-7ff670a8b3a4 722->725 726 7ff670a8b378-7ff670a8b380 722->726 727 7ff670a8b3b0-7ff670a8b3da call 7ff670a8ce50 call 7ff670a8a168 * 2 723->727 728 7ff670a8b382-7ff670a8b399 call 7ff670a841d4 call 7ff670a841f4 call 7ff670a8a100 723->728 730 7ff670a8b425-7ff670a8b436 725->730 726->725 726->728 755 7ff670a8b3f7-7ff670a8b421 call 7ff670a8babc 727->755 756 7ff670a8b3dc-7ff670a8b3f2 call 7ff670a841f4 call 7ff670a841d4 727->756 759 7ff670a8b535 728->759 734 7ff670a8b43c-7ff670a8b444 730->734 735 7ff670a8b4bd-7ff670a8b4c7 call 7ff670a92a30 730->735 734->735 739 7ff670a8b446-7ff670a8b448 734->739 747 7ff670a8b553 735->747 748 7ff670a8b4cd-7ff670a8b4e3 735->748 739->735 740 7ff670a8b44a-7ff670a8b468 739->740 740->735 744 7ff670a8b46a-7ff670a8b476 740->744 744->735 749 7ff670a8b478-7ff670a8b47a 744->749 751 7ff670a8b558-7ff670a8b579 ReadFile 747->751 748->747 753 7ff670a8b4e5-7ff670a8b4f7 GetConsoleMode 748->753 749->735 754 7ff670a8b47c-7ff670a8b494 749->754 757 7ff670a8b57f-7ff670a8b587 751->757 758 7ff670a8b671-7ff670a8b67a GetLastError 751->758 753->747 760 7ff670a8b4f9-7ff670a8b501 753->760 754->735 764 7ff670a8b496-7ff670a8b4a2 754->764 755->730 756->759 757->758 766 7ff670a8b58d 757->766 761 7ff670a8b697-7ff670a8b69a 758->761 762 7ff670a8b67c-7ff670a8b692 call 7ff670a841f4 call 7ff670a841d4 758->762 763 7ff670a8b538-7ff670a8b542 call 7ff670a8a168 759->763 760->751 768 7ff670a8b503-7ff670a8b526 ReadConsoleW 760->768 772 7ff670a8b52e-7ff670a8b530 call 7ff670a84168 761->772 773 7ff670a8b6a0-7ff670a8b6a2 761->773 762->759 763->715 764->735 771 7ff670a8b4a4-7ff670a8b4a6 764->771 775 7ff670a8b594-7ff670a8b5ab 766->775 777 7ff670a8b547-7ff670a8b551 768->777 778 7ff670a8b528 GetLastError 768->778 771->735 782 7ff670a8b4a8-7ff670a8b4b8 771->782 772->759 773->763 775->763 784 7ff670a8b5ad-7ff670a8b5b8 775->784 777->775 778->772 782->735 787 7ff670a8b5df-7ff670a8b5e7 784->787 788 7ff670a8b5ba-7ff670a8b5d3 call 7ff670a8ae9c 784->788 789 7ff670a8b65f-7ff670a8b66c call 7ff670a8acc4 787->789 790 7ff670a8b5e9-7ff670a8b5fb 787->790 796 7ff670a8b5d8-7ff670a8b5da 788->796 789->796 793 7ff670a8b652-7ff670a8b65a 790->793 794 7ff670a8b5fd 790->794 793->763 797 7ff670a8b603-7ff670a8b60a 794->797 796->763 799 7ff670a8b647-7ff670a8b64c 797->799 800 7ff670a8b60c-7ff670a8b610 797->800 799->793 801 7ff670a8b612-7ff670a8b619 800->801 802 7ff670a8b62d 800->802 801->802 803 7ff670a8b61b-7ff670a8b61f 801->803 804 7ff670a8b633-7ff670a8b643 802->804 803->802 805 7ff670a8b621-7ff670a8b62b 803->805 804->797 806 7ff670a8b645 804->806 805->804 806->793
                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 00000019.00000002.2211089282.00007FF670A71000.00000020.00000001.01000000.0000003F.sdmp, Offset: 00007FF670A70000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 00000019.00000002.2211012606.00007FF670A70000.00000002.00000001.01000000.0000003F.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000019.00000002.2211171848.00007FF670A9A000.00000002.00000001.01000000.0000003F.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000019.00000002.2211223436.00007FF670AAD000.00000004.00000001.01000000.0000003F.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000019.00000002.2211223436.00007FF670ABC000.00000004.00000001.01000000.0000003F.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000019.00000002.2211367389.00007FF670ABE000.00000002.00000001.01000000.0000003F.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_25_2_7ff670a70000_dat.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: _invalid_parameter_noinfo
                                                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                                                              • API String ID: 3215553584-0
                                                                                                                                                                                                                                              • Opcode ID: 5a7dabb1e9ef4c9dfb2dafabf883447c7ea8797d5f58d5bd2ce831bfa94d3783
                                                                                                                                                                                                                                              • Instruction ID: 69b5356f583ab117af90af04c8ae2aab36205f457f8c8267ef1f2981842780f6
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 5a7dabb1e9ef4c9dfb2dafabf883447c7ea8797d5f58d5bd2ce831bfa94d3783
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 4DC1DD63A387C6A5EB629B1594443BD6BA0FB91B80F440231DA4EC77D3DF7DE4A48720
                                                                                                                                                                                                                                              Function 00007FF670A94FC4 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 143timeCOMMON
                                                                                                                                                                                                                                              Download Yara Rule

                                                                                                                                                                                                                                              Control-flow Graph

                                                                                                                                                                                                                                              • Executed
                                                                                                                                                                                                                                              • Not Executed
                                                                                                                                                                                                                                              control_flow_graph 807 7ff670a94fc4-7ff670a94ff9 call 7ff670a946d8 call 7ff670a946e0 call 7ff670a94748 814 7ff670a94fff-7ff670a9500a call 7ff670a946e8 807->814 815 7ff670a95137-7ff670a951a5 call 7ff670a8a120 call 7ff670a909e8 807->815 814->815 820 7ff670a95010-7ff670a9501b call 7ff670a94718 814->820 827 7ff670a951b3-7ff670a951b6 815->827 828 7ff670a951a7-7ff670a951ae 815->828 820->815 826 7ff670a95021-7ff670a95044 call 7ff670a8a168 GetTimeZoneInformation 820->826 840 7ff670a9504a-7ff670a9506b 826->840 841 7ff670a9510c-7ff670a95136 call 7ff670a946d0 call 7ff670a946c0 call 7ff670a946c8 826->841 829 7ff670a951b8 827->829 830 7ff670a951ed-7ff670a95200 call 7ff670a8ce50 827->830 832 7ff670a95243-7ff670a95246 828->832 833 7ff670a951bb call 7ff670a94fc4 829->833 845 7ff670a95202 830->845 846 7ff670a9520b-7ff670a95226 call 7ff670a909e8 830->846 832->833 834 7ff670a9524c-7ff670a95254 call 7ff670a94d48 832->834 843 7ff670a951c0-7ff670a951ec call 7ff670a8a168 call 7ff670a7acc0 833->843 834->843 847 7ff670a95076-7ff670a9507d 840->847 848 7ff670a9506d-7ff670a95073 840->848 852 7ff670a95204-7ff670a95209 call 7ff670a8a168 845->852 861 7ff670a95228-7ff670a9522b 846->861 862 7ff670a9522d-7ff670a9523f call 7ff670a8a168 846->862 853 7ff670a9507f-7ff670a95087 847->853 854 7ff670a95091 847->854 848->847 852->829 853->854 860 7ff670a95089-7ff670a9508f 853->860 856 7ff670a95093-7ff670a95107 call 7ff670a7c140 * 4 call 7ff670a91f84 call 7ff670a9525c * 2 854->856 856->841 860->856 861->852 862->832
                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                              • _get_daylight.LIBCMT ref: 00007FF670A94FF2
                                                                                                                                                                                                                                                • Part of subcall function 00007FF670A94748: _invalid_parameter_noinfo.LIBCMT ref: 00007FF670A9475C
                                                                                                                                                                                                                                              • _get_daylight.LIBCMT ref: 00007FF670A95003
                                                                                                                                                                                                                                                • Part of subcall function 00007FF670A946E8: _invalid_parameter_noinfo.LIBCMT ref: 00007FF670A946FC
                                                                                                                                                                                                                                              • _get_daylight.LIBCMT ref: 00007FF670A95014
                                                                                                                                                                                                                                                • Part of subcall function 00007FF670A94718: _invalid_parameter_noinfo.LIBCMT ref: 00007FF670A9472C
                                                                                                                                                                                                                                                • Part of subcall function 00007FF670A8A168: RtlFreeHeap.NTDLL(?,?,?,00007FF670A9214A,?,?,?,00007FF670A92187,?,?,00000000,00007FF670A92658,?,?,?,00007FF670A9258B), ref: 00007FF670A8A17E
                                                                                                                                                                                                                                                • Part of subcall function 00007FF670A8A168: GetLastError.KERNEL32(?,?,?,00007FF670A9214A,?,?,?,00007FF670A92187,?,?,00000000,00007FF670A92658,?,?,?,00007FF670A9258B), ref: 00007FF670A8A188
                                                                                                                                                                                                                                              • GetTimeZoneInformation.KERNELBASE(?,?,?,?,?,?,?,?,?,00000000,?,00007FF670A95254), ref: 00007FF670A9503B
                                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 00000019.00000002.2211089282.00007FF670A71000.00000020.00000001.01000000.0000003F.sdmp, Offset: 00007FF670A70000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 00000019.00000002.2211012606.00007FF670A70000.00000002.00000001.01000000.0000003F.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000019.00000002.2211171848.00007FF670A9A000.00000002.00000001.01000000.0000003F.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000019.00000002.2211223436.00007FF670AAD000.00000004.00000001.01000000.0000003F.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000019.00000002.2211223436.00007FF670ABC000.00000004.00000001.01000000.0000003F.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000019.00000002.2211367389.00007FF670ABE000.00000002.00000001.01000000.0000003F.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_25_2_7ff670a70000_dat.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: _get_daylight_invalid_parameter_noinfo$ErrorFreeHeapInformationLastTimeZone
                                                                                                                                                                                                                                              • String ID: Eastern Standard Time$Eastern Summer Time
                                                                                                                                                                                                                                              • API String ID: 3458911817-239921721
                                                                                                                                                                                                                                              • Opcode ID: 8f76df28c868a91264669dac662f976d2c43e9fa87f2a31bca7d0f342cd26d0f
                                                                                                                                                                                                                                              • Instruction ID: 9980184c89db70da15ec6c0d17ff0ba8abfc5a62344998caf775bd6e4e35bd11
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 8f76df28c868a91264669dac662f976d2c43e9fa87f2a31bca7d0f342cd26d0f
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 02516D37B38642A6E710EF35E8915A967A0FB48784F40423AEA4DC7797EF3DE5408760
                                                                                                                                                                                                                                              Function 00007FF670A77780 Relevance: 3.0, APIs: 2, Instructions: 29COMMON
                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 00000019.00000002.2211089282.00007FF670A71000.00000020.00000001.01000000.0000003F.sdmp, Offset: 00007FF670A70000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 00000019.00000002.2211012606.00007FF670A70000.00000002.00000001.01000000.0000003F.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000019.00000002.2211171848.00007FF670A9A000.00000002.00000001.01000000.0000003F.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000019.00000002.2211223436.00007FF670AAD000.00000004.00000001.01000000.0000003F.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000019.00000002.2211223436.00007FF670ABC000.00000004.00000001.01000000.0000003F.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000019.00000002.2211367389.00007FF670ABE000.00000002.00000001.01000000.0000003F.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_25_2_7ff670a70000_dat.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: Find$CloseFileFirst
                                                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                                                              • API String ID: 2295610775-0
                                                                                                                                                                                                                                              • Opcode ID: 956b6e7c3410f1f64b138177879099c8869163cebd60ae685645dcaa55457231
                                                                                                                                                                                                                                              • Instruction ID: 3f15e607591881f8eb37319276418d8daebee46b6c93c4e98a4eb8623387beb6
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 956b6e7c3410f1f64b138177879099c8869163cebd60ae685645dcaa55457231
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: AAF03123A2868196E7A0CF64A44976A7390AB84728F545736D6AE82BD9DF3CD4098A10
                                                                                                                                                                                                                                              Function 00007FF670A8FD48 Relevance: 2.0, APIs: 1, Instructions: 462COMMON
                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 00000019.00000002.2211089282.00007FF670A71000.00000020.00000001.01000000.0000003F.sdmp, Offset: 00007FF670A70000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 00000019.00000002.2211012606.00007FF670A70000.00000002.00000001.01000000.0000003F.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000019.00000002.2211171848.00007FF670A9A000.00000002.00000001.01000000.0000003F.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000019.00000002.2211223436.00007FF670AAD000.00000004.00000001.01000000.0000003F.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000019.00000002.2211223436.00007FF670ABC000.00000004.00000001.01000000.0000003F.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000019.00000002.2211367389.00007FF670ABE000.00000002.00000001.01000000.0000003F.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_25_2_7ff670a70000_dat.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: CurrentFeaturePresentProcessProcessor
                                                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                                                              • API String ID: 1010374628-0
                                                                                                                                                                                                                                              • Opcode ID: d68a4561d4443392d37dbbd3e574b346064aadcb7cdc880701d4372b212264c2
                                                                                                                                                                                                                                              • Instruction ID: 5382b21de33ee45efe2c1397723bce6314bd837821a62a1fff2c35e6a20d84b4
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: d68a4561d4443392d37dbbd3e574b346064aadcb7cdc880701d4372b212264c2
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: F402DF23B3D687A5FE66AB159805A7A2690AF11BD0F144635DE5DCA3D3DF3DE4018330
                                                                                                                                                                                                                                              Function 00007FF670A717B0 Relevance: 21.1, APIs: 2, Strings: 10, Instructions: 144COMMON
                                                                                                                                                                                                                                              Download Yara Rule

                                                                                                                                                                                                                                              Control-flow Graph

                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 00000019.00000002.2211089282.00007FF670A71000.00000020.00000001.01000000.0000003F.sdmp, Offset: 00007FF670A70000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 00000019.00000002.2211012606.00007FF670A70000.00000002.00000001.01000000.0000003F.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000019.00000002.2211171848.00007FF670A9A000.00000002.00000001.01000000.0000003F.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000019.00000002.2211223436.00007FF670AAD000.00000004.00000001.01000000.0000003F.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000019.00000002.2211223436.00007FF670ABC000.00000004.00000001.01000000.0000003F.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000019.00000002.2211367389.00007FF670ABE000.00000002.00000001.01000000.0000003F.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_25_2_7ff670a70000_dat.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: _fread_nolock$Message_invalid_parameter_noinfo
                                                                                                                                                                                                                                              • String ID: Cannot read Table of Contents.$Could not allocate buffer for TOC!$Could not read full TOC!$Error on file.$Failed to read cookie!$Failed to seek to cookie position!$MEI$fread$fseek$malloc
                                                                                                                                                                                                                                              • API String ID: 2153230061-4158440160
                                                                                                                                                                                                                                              • Opcode ID: 17f583abcf6ee6174b2311b8cb015d58e59dd73b6590ad39d8b536019a0cb674
                                                                                                                                                                                                                                              • Instruction ID: b68f051a5404e5a8246b3b3b6ec63020df39e836852d32e880d59a01790c105e
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 17f583abcf6ee6174b2311b8cb015d58e59dd73b6590ad39d8b536019a0cb674
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 5B513873B29A02A6EB54CF28D49427833A0FB48B48F51A536DA4DC779ADF3CE541C760
                                                                                                                                                                                                                                              Function 00007FF670A71440 Relevance: 21.1, APIs: 1, Strings: 11, Instructions: 133COMMON
                                                                                                                                                                                                                                              Download Yara Rule

                                                                                                                                                                                                                                              Control-flow Graph

                                                                                                                                                                                                                                              • Executed
                                                                                                                                                                                                                                              • Not Executed
                                                                                                                                                                                                                                              control_flow_graph 53 7ff670a71440-7ff670a71457 call 7ff670a766e0 56 7ff670a71459-7ff670a71461 53->56 57 7ff670a71462-7ff670a71485 call 7ff670a76a00 53->57 60 7ff670a714a7-7ff670a714ad 57->60 61 7ff670a71487-7ff670a714a2 call 7ff670a724d0 57->61 63 7ff670a714e0-7ff670a714f4 call 7ff670a7f830 60->63 64 7ff670a714af-7ff670a714ba call 7ff670a73c90 60->64 68 7ff670a71635-7ff670a71647 61->68 72 7ff670a71516-7ff670a7151a 63->72 73 7ff670a714f6-7ff670a71511 call 7ff670a724d0 63->73 69 7ff670a714bf-7ff670a714c5 64->69 69->63 71 7ff670a714c7-7ff670a714db call 7ff670a72770 69->71 82 7ff670a71617-7ff670a7161d 71->82 75 7ff670a7151c-7ff670a71528 call 7ff670a71050 72->75 76 7ff670a71534-7ff670a71554 call 7ff670a83e60 72->76 73->82 83 7ff670a7152d-7ff670a7152f 75->83 87 7ff670a71556-7ff670a71570 call 7ff670a724d0 76->87 88 7ff670a71575-7ff670a7157b 76->88 85 7ff670a7162b-7ff670a7162e call 7ff670a7f1c8 82->85 86 7ff670a7161f call 7ff670a7f1c8 82->86 83->82 95 7ff670a71633 85->95 94 7ff670a71624 86->94 99 7ff670a7160d-7ff670a71612 87->99 92 7ff670a71605-7ff670a71608 call 7ff670a83e4c 88->92 93 7ff670a71581-7ff670a71586 88->93 92->99 98 7ff670a71590-7ff670a715b2 call 7ff670a7f518 93->98 94->85 95->68 102 7ff670a715b4-7ff670a715cc call 7ff670a7fc24 98->102 103 7ff670a715e5-7ff670a715ec 98->103 99->82 108 7ff670a715d5-7ff670a715e3 102->108 109 7ff670a715ce-7ff670a715d1 102->109 105 7ff670a715f3-7ff670a715fb call 7ff670a724d0 103->105 112 7ff670a71600 105->112 108->105 109->98 111 7ff670a715d3 109->111 111->112 112->92
                                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 00000019.00000002.2211089282.00007FF670A71000.00000020.00000001.01000000.0000003F.sdmp, Offset: 00007FF670A70000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 00000019.00000002.2211012606.00007FF670A70000.00000002.00000001.01000000.0000003F.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000019.00000002.2211171848.00007FF670A9A000.00000002.00000001.01000000.0000003F.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000019.00000002.2211223436.00007FF670AAD000.00000004.00000001.01000000.0000003F.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000019.00000002.2211223436.00007FF670ABC000.00000004.00000001.01000000.0000003F.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000019.00000002.2211367389.00007FF670ABE000.00000002.00000001.01000000.0000003F.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_25_2_7ff670a70000_dat.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID:
                                                                                                                                                                                                                                              • String ID: Failed to extract %s: failed to allocate temporary buffer!$Failed to extract %s: failed to open archive file!$Failed to extract %s: failed to open target file!$Failed to extract %s: failed to read data chunk!$Failed to extract %s: failed to seek to the entry's data!$Failed to extract %s: failed to write data chunk!$fopen$fread$fseek$fwrite$malloc
                                                                                                                                                                                                                                              • API String ID: 0-666925554
                                                                                                                                                                                                                                              • Opcode ID: efa7e8e8c8920664d50b82c3ca04325f755b35b03cbdb45f8cfaf1504c2d3f10
                                                                                                                                                                                                                                              • Instruction ID: 4aec43c3acb4e66c2e9c0e481b3d84ccc9959b3d89a1a19ed1bf2445383c8344
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: efa7e8e8c8920664d50b82c3ca04325f755b35b03cbdb45f8cfaf1504c2d3f10
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 0E51EC63B38643A1EA109B19E4046B963A0BF50BD8F44A132DE4DC779BEF3DE545C320
                                                                                                                                                                                                                                              Function 00007FF670A77800 Relevance: 21.1, APIs: 10, Strings: 2, Instructions: 91COMMON
                                                                                                                                                                                                                                              Download Yara Rule

                                                                                                                                                                                                                                              Control-flow Graph

                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 00000019.00000002.2211089282.00007FF670A71000.00000020.00000001.01000000.0000003F.sdmp, Offset: 00007FF670A70000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 00000019.00000002.2211012606.00007FF670A70000.00000002.00000001.01000000.0000003F.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000019.00000002.2211171848.00007FF670A9A000.00000002.00000001.01000000.0000003F.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000019.00000002.2211223436.00007FF670AAD000.00000004.00000001.01000000.0000003F.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000019.00000002.2211223436.00007FF670ABC000.00000004.00000001.01000000.0000003F.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000019.00000002.2211367389.00007FF670ABE000.00000002.00000001.01000000.0000003F.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_25_2_7ff670a70000_dat.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: Token$ConvertDescriptorInformationProcessSecurityString$CloseCreateCurrentDirectoryErrorFreeHandleLastLocalOpen
                                                                                                                                                                                                                                              • String ID: D:(A;;FA;;;%s)$S-1-3-4
                                                                                                                                                                                                                                              • API String ID: 4998090-2855260032
                                                                                                                                                                                                                                              • Opcode ID: 6591b1212da81ebedb1b6999a7ad6cd934ab4383e2d97f6c3f94acd8b2e06d7e
                                                                                                                                                                                                                                              • Instruction ID: 514358f8cc45bfe9c4de27073e40124e897d31713650baac1334d53a4e3cc900
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 6591b1212da81ebedb1b6999a7ad6cd934ab4383e2d97f6c3f94acd8b2e06d7e
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: F3415133A28A82A2E750DF60E4446AA7361FB84794F505231EA9EC77DADF3CD444C750
                                                                                                                                                                                                                                              Function 00007FF670A95C88 Relevance: 13.8, APIs: 9, Instructions: 276fileCOMMON
                                                                                                                                                                                                                                              Download Yara Rule

                                                                                                                                                                                                                                              Control-flow Graph

                                                                                                                                                                                                                                              • Executed
                                                                                                                                                                                                                                              • Not Executed
                                                                                                                                                                                                                                              control_flow_graph 290 7ff670a95c88-7ff670a95cfb call 7ff670a959b8 293 7ff670a95d15-7ff670a95d1f call 7ff670a86a8c 290->293 294 7ff670a95cfd-7ff670a95d06 call 7ff670a841d4 290->294 299 7ff670a95d21-7ff670a95d38 call 7ff670a841d4 call 7ff670a841f4 293->299 300 7ff670a95d3a-7ff670a95da3 CreateFileW 293->300 301 7ff670a95d09-7ff670a95d10 call 7ff670a841f4 294->301 299->301 303 7ff670a95e20-7ff670a95e2b GetFileType 300->303 304 7ff670a95da5-7ff670a95dab 300->304 312 7ff670a96057-7ff670a96077 301->312 307 7ff670a95e7e-7ff670a95e85 303->307 308 7ff670a95e2d-7ff670a95e68 GetLastError call 7ff670a84168 CloseHandle 303->308 310 7ff670a95ded-7ff670a95e1b GetLastError call 7ff670a84168 304->310 311 7ff670a95dad-7ff670a95db1 304->311 315 7ff670a95e87-7ff670a95e8b 307->315 316 7ff670a95e8d-7ff670a95e90 307->316 308->301 324 7ff670a95e6e-7ff670a95e79 call 7ff670a841f4 308->324 310->301 311->310 317 7ff670a95db3-7ff670a95deb CreateFileW 311->317 321 7ff670a95e96-7ff670a95eeb call 7ff670a869a4 315->321 316->321 322 7ff670a95e92 316->322 317->303 317->310 329 7ff670a95f0a-7ff670a95f3b call 7ff670a95740 321->329 330 7ff670a95eed-7ff670a95ef9 call 7ff670a95bc4 321->330 322->321 324->301 336 7ff670a95f41-7ff670a95f84 329->336 337 7ff670a95f3d-7ff670a95f3f 329->337 330->329 335 7ff670a95efb 330->335 338 7ff670a95efd-7ff670a95f05 call 7ff670a8a2e0 335->338 339 7ff670a95fa6-7ff670a95fb1 336->339 340 7ff670a95f86-7ff670a95f8a 336->340 337->338 338->312 343 7ff670a96055 339->343 344 7ff670a95fb7-7ff670a95fbb 339->344 340->339 342 7ff670a95f8c-7ff670a95fa1 340->342 342->339 343->312 344->343 346 7ff670a95fc1-7ff670a96006 CloseHandle CreateFileW 344->346 347 7ff670a96008-7ff670a96036 GetLastError call 7ff670a84168 call 7ff670a86bcc 346->347 348 7ff670a9603b-7ff670a96050 346->348 347->348 348->343
                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 00000019.00000002.2211089282.00007FF670A71000.00000020.00000001.01000000.0000003F.sdmp, Offset: 00007FF670A70000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 00000019.00000002.2211012606.00007FF670A70000.00000002.00000001.01000000.0000003F.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000019.00000002.2211171848.00007FF670A9A000.00000002.00000001.01000000.0000003F.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000019.00000002.2211223436.00007FF670AAD000.00000004.00000001.01000000.0000003F.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000019.00000002.2211223436.00007FF670ABC000.00000004.00000001.01000000.0000003F.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000019.00000002.2211367389.00007FF670ABE000.00000002.00000001.01000000.0000003F.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_25_2_7ff670a70000_dat.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: File$CreateErrorLast_invalid_parameter_noinfo$CloseHandle$Type_get_daylight
                                                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                                                              • API String ID: 1330151763-0
                                                                                                                                                                                                                                              • Opcode ID: e7a227fa92ea7581bfd134bfea7d4b548e5a44fbdc42318de0dcb122e3032d81
                                                                                                                                                                                                                                              • Instruction ID: 807aa86ac848e8d586b0cb9a89559d8f35de8a2d694d75137c5bff11282da192
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: e7a227fa92ea7581bfd134bfea7d4b548e5a44fbdc42318de0dcb122e3032d81
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: F8C1CF37B38A4299EB10CFA9C4816AC3761EB59BA8F014325DA1ED77D6DF39D055C310
                                                                                                                                                                                                                                              Function 00007FF670A71000 Relevance: 12.5, APIs: 1, Strings: 6, Instructions: 273COMMON
                                                                                                                                                                                                                                              Download Yara Rule

                                                                                                                                                                                                                                              Control-flow Graph

                                                                                                                                                                                                                                              • Executed
                                                                                                                                                                                                                                              • Not Executed
                                                                                                                                                                                                                                              control_flow_graph 353 7ff670a71000-7ff670a73666 call 7ff670a7efa0 call 7ff670a7ef98 call 7ff670a77560 call 7ff670a7ef98 call 7ff670a7acf0 call 7ff670a84020 call 7ff670a84cc8 call 7ff670a71af0 371 7ff670a7366c-7ff670a7367b call 7ff670a73b80 353->371 372 7ff670a7377a 353->372 371->372 377 7ff670a73681-7ff670a73694 call 7ff670a73a50 371->377 374 7ff670a7377f-7ff670a7379f call 7ff670a7acc0 372->374 377->372 381 7ff670a7369a-7ff670a736ad call 7ff670a73b00 377->381 381->372 384 7ff670a736b3-7ff670a736da call 7ff670a76950 381->384 387 7ff670a7371c-7ff670a73744 call 7ff670a76ef0 call 7ff670a719d0 384->387 388 7ff670a736dc-7ff670a736eb call 7ff670a76950 384->388 398 7ff670a7382d-7ff670a7383e 387->398 399 7ff670a7374a-7ff670a73760 call 7ff670a719d0 387->399 388->387 394 7ff670a736ed-7ff670a736f3 388->394 396 7ff670a736f5-7ff670a736fd 394->396 397 7ff670a736ff-7ff670a73719 call 7ff670a83e4c call 7ff670a76ef0 394->397 396->397 397->387 403 7ff670a73853-7ff670a7386b call 7ff670a77990 398->403 404 7ff670a73840-7ff670a7384a call 7ff670a73260 398->404 411 7ff670a73762-7ff670a73775 call 7ff670a72770 399->411 412 7ff670a737a0-7ff670a737a3 399->412 416 7ff670a7386d-7ff670a73879 call 7ff670a72770 403->416 417 7ff670a7387e-7ff670a73885 SetDllDirectoryW 403->417 414 7ff670a7384c 404->414 415 7ff670a7388b-7ff670a73898 call 7ff670a75e20 404->415 411->372 412->398 419 7ff670a737a9-7ff670a737c0 call 7ff670a73c90 412->419 414->403 428 7ff670a7389a-7ff670a738aa call 7ff670a75ac0 415->428 429 7ff670a738e6-7ff670a738eb call 7ff670a75da0 415->429 416->372 417->415 426 7ff670a737c7-7ff670a737f3 call 7ff670a77160 419->426 427 7ff670a737c2-7ff670a737c5 419->427 438 7ff670a7381d-7ff670a7382b 426->438 439 7ff670a737f5-7ff670a737fd call 7ff670a7f1c8 426->439 430 7ff670a73802-7ff670a73818 call 7ff670a72770 427->430 428->429 443 7ff670a738ac-7ff670a738bb call 7ff670a75620 428->443 436 7ff670a738f0-7ff670a738f3 429->436 430->372 441 7ff670a738f9-7ff670a73906 436->441 442 7ff670a739a6-7ff670a739b5 call 7ff670a730f0 436->442 438->404 439->430 447 7ff670a73910-7ff670a7391a 441->447 442->372 457 7ff670a739bb-7ff670a739f2 call 7ff670a76e80 call 7ff670a76950 call 7ff670a753c0 442->457 455 7ff670a738dc-7ff670a738e1 call 7ff670a75870 443->455 456 7ff670a738bd-7ff670a738c9 call 7ff670a755b0 443->456 451 7ff670a7391c-7ff670a73921 447->451 452 7ff670a73923-7ff670a73925 447->452 451->447 451->452 453 7ff670a73927-7ff670a7394a call 7ff670a71b30 452->453 454 7ff670a73971-7ff670a739a1 call 7ff670a73250 call 7ff670a73090 call 7ff670a73240 call 7ff670a75870 call 7ff670a75da0 452->454 453->372 467 7ff670a73950-7ff670a7395b 453->467 454->374 455->429 456->455 468 7ff670a738cb-7ff670a738da call 7ff670a75c70 456->468 457->372 480 7ff670a739f8-7ff670a73a2d call 7ff670a73250 call 7ff670a76f30 call 7ff670a75870 call 7ff670a75da0 457->480 471 7ff670a73960-7ff670a7396f 467->471 468->436 471->454 471->471 493 7ff670a73a37-7ff670a73a41 call 7ff670a71ab0 480->493 494 7ff670a73a2f-7ff670a73a32 call 7ff670a76bf0 480->494 493->374 494->493
                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                                • Part of subcall function 00007FF670A73B80: GetModuleFileNameW.KERNEL32(?,00007FF670A73679), ref: 00007FF670A73BB1
                                                                                                                                                                                                                                              • SetDllDirectoryW.KERNEL32 ref: 00007FF670A73885
                                                                                                                                                                                                                                                • Part of subcall function 00007FF670A76950: GetEnvironmentVariableW.KERNEL32(00007FF670A736C7), ref: 00007FF670A7698A
                                                                                                                                                                                                                                                • Part of subcall function 00007FF670A76950: ExpandEnvironmentStringsW.KERNEL32 ref: 00007FF670A769A7
                                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 00000019.00000002.2211089282.00007FF670A71000.00000020.00000001.01000000.0000003F.sdmp, Offset: 00007FF670A70000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 00000019.00000002.2211012606.00007FF670A70000.00000002.00000001.01000000.0000003F.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000019.00000002.2211171848.00007FF670A9A000.00000002.00000001.01000000.0000003F.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000019.00000002.2211223436.00007FF670AAD000.00000004.00000001.01000000.0000003F.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000019.00000002.2211223436.00007FF670ABC000.00000004.00000001.01000000.0000003F.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000019.00000002.2211367389.00007FF670ABE000.00000002.00000001.01000000.0000003F.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_25_2_7ff670a70000_dat.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: Environment$DirectoryExpandFileModuleNameStringsVariable
                                                                                                                                                                                                                                              • String ID: Cannot open PyInstaller archive from executable (%s) or external archive (%s)$Cannot side-load external archive %s (code %d)!$Failed to convert DLL search path!$MEI$_MEIPASS2$_PYI_ONEDIR_MODE
                                                                                                                                                                                                                                              • API String ID: 2344891160-3602715111
                                                                                                                                                                                                                                              • Opcode ID: 7b27e692fffd17c9cd3fc80547596bb65de96c9f74a007269f28a02662107058
                                                                                                                                                                                                                                              • Instruction ID: 5bc7fa45936104a29309c46730177a8d3713a0cffadcd05c81bc1782dd3cea10
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 7b27e692fffd17c9cd3fc80547596bb65de96c9f74a007269f28a02662107058
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 08B15F63E3C68361FA64AB2199512FE1390AF94784F44A032EA4DC779FEF2CE5058761
                                                                                                                                                                                                                                              Function 00007FF670A71050 Relevance: 12.4, APIs: 1, Strings: 6, Instructions: 156COMMON
                                                                                                                                                                                                                                              Download Yara Rule

                                                                                                                                                                                                                                              Control-flow Graph

                                                                                                                                                                                                                                              • Executed
                                                                                                                                                                                                                                              • Not Executed
                                                                                                                                                                                                                                              control_flow_graph 498 7ff670a71050-7ff670a710ab call 7ff670a798a0 501 7ff670a710ad-7ff670a710d2 call 7ff670a72770 498->501 502 7ff670a710d3-7ff670a710eb call 7ff670a83e60 498->502 507 7ff670a710ed-7ff670a71104 call 7ff670a724d0 502->507 508 7ff670a71109-7ff670a71119 call 7ff670a83e60 502->508 513 7ff670a7126c-7ff670a71281 call 7ff670a79590 call 7ff670a83e4c * 2 507->513 514 7ff670a7111b-7ff670a71132 call 7ff670a724d0 508->514 515 7ff670a71137-7ff670a71147 508->515 531 7ff670a71286-7ff670a712a0 513->531 514->513 517 7ff670a71150-7ff670a71175 call 7ff670a7f518 515->517 525 7ff670a7117b-7ff670a71185 call 7ff670a7f28c 517->525 526 7ff670a7125e 517->526 525->526 532 7ff670a7118b-7ff670a71197 525->532 528 7ff670a71264 526->528 528->513 533 7ff670a711a0-7ff670a711c8 call 7ff670a77d10 532->533 536 7ff670a711ca-7ff670a711cd 533->536 537 7ff670a71241-7ff670a7125c call 7ff670a72770 533->537 538 7ff670a7123c 536->538 539 7ff670a711cf-7ff670a711d9 536->539 537->528 538->537 541 7ff670a711db-7ff670a711e8 call 7ff670a7fc24 539->541 542 7ff670a71203-7ff670a71206 539->542 549 7ff670a711ed-7ff670a711f0 541->549 545 7ff670a71208-7ff670a71216 call 7ff670a7ba90 542->545 546 7ff670a71219-7ff670a7121e 542->546 545->546 546->533 548 7ff670a71220-7ff670a71223 546->548 551 7ff670a71237-7ff670a7123a 548->551 552 7ff670a71225-7ff670a71228 548->552 553 7ff670a711f2-7ff670a711fc call 7ff670a7f28c 549->553 554 7ff670a711fe-7ff670a71201 549->554 551->528 552->537 555 7ff670a7122a-7ff670a71232 552->555 553->546 553->554 554->537 555->517
                                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 00000019.00000002.2211089282.00007FF670A71000.00000020.00000001.01000000.0000003F.sdmp, Offset: 00007FF670A70000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 00000019.00000002.2211012606.00007FF670A70000.00000002.00000001.01000000.0000003F.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000019.00000002.2211171848.00007FF670A9A000.00000002.00000001.01000000.0000003F.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000019.00000002.2211223436.00007FF670AAD000.00000004.00000001.01000000.0000003F.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000019.00000002.2211223436.00007FF670ABC000.00000004.00000001.01000000.0000003F.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000019.00000002.2211367389.00007FF670ABE000.00000002.00000001.01000000.0000003F.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_25_2_7ff670a70000_dat.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: Message
                                                                                                                                                                                                                                              • String ID: 1.2.12$Failed to extract %s: decompression resulted in return code %d!$Failed to extract %s: failed to allocate temporary input buffer!$Failed to extract %s: failed to allocate temporary output buffer!$Failed to extract %s: inflateInit() failed with return code %d!$malloc
                                                                                                                                                                                                                                              • API String ID: 2030045667-1282086711
                                                                                                                                                                                                                                              • Opcode ID: e4af29d8bbb6958e4f3836b59739e748bcb5d87c6e06322c09a4b1d955b1c8ea
                                                                                                                                                                                                                                              • Instruction ID: 0993081be79d8f1d9f3bc5d779676a6131e3a49296de261137ae9df8992046a4
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: e4af29d8bbb6958e4f3836b59739e748bcb5d87c6e06322c09a4b1d955b1c8ea
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: A051E123B28682A5EA209B19E4403FA63D1FB84794F489136DE4DC779BEF3CE545C750
                                                                                                                                                                                                                                              Function 00007FF670A8E158 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 117libraryloaderCOMMONLIBRARYCODE
                                                                                                                                                                                                                                              Download Yara Rule

                                                                                                                                                                                                                                              Control-flow Graph

                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                              • FreeLibrary.KERNEL32(?,00000000,?,00007FF670A8E4F6,?,?,-00000018,00007FF670A8A572,?,?,?,00007FF670A8A46A,?,?,?,00007FF670A85222), ref: 00007FF670A8E2D7
                                                                                                                                                                                                                                              • GetProcAddress.KERNEL32(?,00000000,?,00007FF670A8E4F6,?,?,-00000018,00007FF670A8A572,?,?,?,00007FF670A8A46A,?,?,?,00007FF670A85222), ref: 00007FF670A8E2E3
                                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 00000019.00000002.2211089282.00007FF670A71000.00000020.00000001.01000000.0000003F.sdmp, Offset: 00007FF670A70000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 00000019.00000002.2211012606.00007FF670A70000.00000002.00000001.01000000.0000003F.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000019.00000002.2211171848.00007FF670A9A000.00000002.00000001.01000000.0000003F.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000019.00000002.2211223436.00007FF670AAD000.00000004.00000001.01000000.0000003F.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000019.00000002.2211223436.00007FF670ABC000.00000004.00000001.01000000.0000003F.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000019.00000002.2211367389.00007FF670ABE000.00000002.00000001.01000000.0000003F.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_25_2_7ff670a70000_dat.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: AddressFreeLibraryProc
                                                                                                                                                                                                                                              • String ID: api-ms-$ext-ms-
                                                                                                                                                                                                                                              • API String ID: 3013587201-537541572
                                                                                                                                                                                                                                              • Opcode ID: a2ae2c3a07d48552731a8859b03eb7dfad6cfb60df2b5b495a033224e1b0bc41
                                                                                                                                                                                                                                              • Instruction ID: 35d6ccedf70239bc34fb687bf9593cdbbe1c73df16cc33e0cdc361a498b3f373
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: a2ae2c3a07d48552731a8859b03eb7dfad6cfb60df2b5b495a033224e1b0bc41
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 16410263B39642A1FE42DB1698046B52396BF65BE4F084235DD0ECB7C6EF3CE0458320
                                                                                                                                                                                                                                              Function 00007FF670A76F30 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 93processsynchronizationCOMMON
                                                                                                                                                                                                                                              Download Yara Rule

                                                                                                                                                                                                                                              Control-flow Graph

                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                                • Part of subcall function 00007FF670A77990: MultiByteToWideChar.KERNEL32 ref: 00007FF670A779CA
                                                                                                                                                                                                                                                • Part of subcall function 00007FF670A870F8: SetConsoleCtrlHandler.KERNEL32(?,?,?,?,?,?,?,?,?,?,00000000,00000000,00000000,00007FF670A89584), ref: 00007FF670A87165
                                                                                                                                                                                                                                                • Part of subcall function 00007FF670A870F8: GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,00000000,00000000,00000000,00007FF670A89584), ref: 00007FF670A87178
                                                                                                                                                                                                                                              • GetStartupInfoW.KERNEL32 ref: 00007FF670A76FB7
                                                                                                                                                                                                                                                • Part of subcall function 00007FF670A894E4: _invalid_parameter_noinfo.LIBCMT ref: 00007FF670A894F8
                                                                                                                                                                                                                                                • Part of subcall function 00007FF670A86C88: _invalid_parameter_noinfo.LIBCMT ref: 00007FF670A86CEF
                                                                                                                                                                                                                                              • GetCommandLineW.KERNEL32 ref: 00007FF670A7703F
                                                                                                                                                                                                                                              • CreateProcessW.KERNELBASE ref: 00007FF670A77081
                                                                                                                                                                                                                                              • WaitForSingleObject.KERNEL32 ref: 00007FF670A77095
                                                                                                                                                                                                                                              • GetExitCodeProcess.KERNELBASE ref: 00007FF670A770A5
                                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 00000019.00000002.2211089282.00007FF670A71000.00000020.00000001.01000000.0000003F.sdmp, Offset: 00007FF670A70000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 00000019.00000002.2211012606.00007FF670A70000.00000002.00000001.01000000.0000003F.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000019.00000002.2211171848.00007FF670A9A000.00000002.00000001.01000000.0000003F.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000019.00000002.2211223436.00007FF670AAD000.00000004.00000001.01000000.0000003F.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000019.00000002.2211223436.00007FF670ABC000.00000004.00000001.01000000.0000003F.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000019.00000002.2211367389.00007FF670ABE000.00000002.00000001.01000000.0000003F.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_25_2_7ff670a70000_dat.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: Process_invalid_parameter_noinfo$ByteCharCodeCommandConsoleCreateCtrlErrorExitHandlerInfoLastLineMultiObjectSingleStartupWaitWide
                                                                                                                                                                                                                                              • String ID: CreateProcessW$Error creating child process!
                                                                                                                                                                                                                                              • API String ID: 1742298069-3524285272
                                                                                                                                                                                                                                              • Opcode ID: 1cd61e54566385a94fb47874bd0fcb1c582be0e90f0846e9646c3e9263d15197
                                                                                                                                                                                                                                              • Instruction ID: 75f794799d0bb33fdb58e22e1655478353ae76ccb04e6b5642cf5757e6b6315c
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 1cd61e54566385a94fb47874bd0fcb1c582be0e90f0846e9646c3e9263d15197
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 4A414033A286C2A6E721DB64E4552AEB3A0FB94350F50413AE68DC7BDBDF7CD0558B10
                                                                                                                                                                                                                                              Function 00007FF670A8C7BC Relevance: 6.2, APIs: 4, Instructions: 218COMMON
                                                                                                                                                                                                                                              Download Yara Rule

                                                                                                                                                                                                                                              Control-flow Graph

                                                                                                                                                                                                                                              • Executed
                                                                                                                                                                                                                                              • Not Executed
                                                                                                                                                                                                                                              control_flow_graph 884 7ff670a8c7bc-7ff670a8c7e1 885 7ff670a8c7e7-7ff670a8c7ea 884->885 886 7ff670a8cab9 884->886 887 7ff670a8c823-7ff670a8c84e 885->887 888 7ff670a8c7ec-7ff670a8c81e call 7ff670a8a030 885->888 889 7ff670a8cabb-7ff670a8cacb 886->889 891 7ff670a8c850-7ff670a8c857 887->891 892 7ff670a8c859-7ff670a8c85f 887->892 888->889 891->888 891->892 894 7ff670a8c86f-7ff670a8c888 call 7ff670a92a30 892->894 895 7ff670a8c861-7ff670a8c86a call 7ff670a8bb58 892->895 899 7ff670a8c88e-7ff670a8c897 894->899 900 7ff670a8c9a5-7ff670a8c9ae 894->900 895->894 899->900 903 7ff670a8c89d-7ff670a8c8a1 899->903 901 7ff670a8c9b0-7ff670a8c9b5 900->901 902 7ff670a8ca01-7ff670a8ca26 WriteFile 900->902 908 7ff670a8c9b7-7ff670a8c9ba 901->908 909 7ff670a8c9ed-7ff670a8c9ff call 7ff670a8c26c 901->909 906 7ff670a8ca31 902->906 907 7ff670a8ca28-7ff670a8ca2e GetLastError 902->907 904 7ff670a8c8a3-7ff670a8c8af call 7ff670a837d0 903->904 905 7ff670a8c8b6-7ff670a8c8c1 903->905 904->905 911 7ff670a8c8d2-7ff670a8c8e7 GetConsoleMode 905->911 912 7ff670a8c8c3-7ff670a8c8cc 905->912 914 7ff670a8ca34 906->914 907->906 915 7ff670a8c9d9-7ff670a8c9eb call 7ff670a8c48c 908->915 916 7ff670a8c9bc-7ff670a8c9bf 908->916 926 7ff670a8c98e-7ff670a8c995 909->926 920 7ff670a8c99a-7ff670a8c99e 911->920 921 7ff670a8c8ed-7ff670a8c8f0 911->921 912->900 912->911 922 7ff670a8ca39 914->922 915->926 923 7ff670a8c9c5-7ff670a8c9d7 call 7ff670a8c370 916->923 924 7ff670a8ca49-7ff670a8ca53 916->924 920->900 927 7ff670a8c8f6-7ff670a8c8fd 921->927 928 7ff670a8c977-7ff670a8c989 call 7ff670a8bde0 921->928 929 7ff670a8ca3e-7ff670a8ca42 922->929 923->926 930 7ff670a8cab2-7ff670a8cab7 924->930 931 7ff670a8ca55-7ff670a8ca5a 924->931 926->922 927->929 934 7ff670a8c903-7ff670a8c911 927->934 928->926 929->924 930->889 935 7ff670a8ca88-7ff670a8ca92 931->935 936 7ff670a8ca5c-7ff670a8ca5f 931->936 934->914 940 7ff670a8c917 934->940 938 7ff670a8ca94-7ff670a8ca98 935->938 939 7ff670a8ca9a-7ff670a8caa9 935->939 941 7ff670a8ca61-7ff670a8ca70 936->941 942 7ff670a8ca78-7ff670a8ca83 call 7ff670a841b0 936->942 938->886 938->939 939->930 944 7ff670a8c91a-7ff670a8c931 call 7ff670a92afc 940->944 941->942 942->935 948 7ff670a8c933-7ff670a8c93d 944->948 949 7ff670a8c969-7ff670a8c972 GetLastError 944->949 950 7ff670a8c93f-7ff670a8c951 call 7ff670a92afc 948->950 951 7ff670a8c95a-7ff670a8c961 948->951 949->914 950->949 955 7ff670a8c953-7ff670a8c958 950->955 951->914 952 7ff670a8c967 951->952 952->944 955->951
                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                              • GetConsoleMode.KERNEL32(?,?,?,?,?,?,?,?,?,?,00000000,00000000,00007FF670A8C75C), ref: 00007FF670A8C8DF
                                                                                                                                                                                                                                              • GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,00000000,00000000,00007FF670A8C75C), ref: 00007FF670A8C969
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 00000019.00000002.2211089282.00007FF670A71000.00000020.00000001.01000000.0000003F.sdmp, Offset: 00007FF670A70000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 00000019.00000002.2211012606.00007FF670A70000.00000002.00000001.01000000.0000003F.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000019.00000002.2211171848.00007FF670A9A000.00000002.00000001.01000000.0000003F.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000019.00000002.2211223436.00007FF670AAD000.00000004.00000001.01000000.0000003F.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000019.00000002.2211223436.00007FF670ABC000.00000004.00000001.01000000.0000003F.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000019.00000002.2211367389.00007FF670ABE000.00000002.00000001.01000000.0000003F.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_25_2_7ff670a70000_dat.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: ConsoleErrorLastMode
                                                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                                                              • API String ID: 953036326-0
                                                                                                                                                                                                                                              • Opcode ID: fd137403e6e97c1a5ba82b3419691a9ebc8bf035f7c52069c471a636664b9908
                                                                                                                                                                                                                                              • Instruction ID: 65eee6b4bbde3737c625426fafd87692cf62e6131995dc83ed73b7af3f18f130
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: fd137403e6e97c1a5ba82b3419691a9ebc8bf035f7c52069c471a636664b9908
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 3991CD63A28796A9FB52CB6594406BD7BA1AB04B88F404136DE4EE37D6CF38D4458B20
                                                                                                                                                                                                                                              Function 00007FF670A8EC40 Relevance: 6.2, APIs: 4, Instructions: 161COMMON
                                                                                                                                                                                                                                              Download Yara Rule

                                                                                                                                                                                                                                              Control-flow Graph

                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 00000019.00000002.2211089282.00007FF670A71000.00000020.00000001.01000000.0000003F.sdmp, Offset: 00007FF670A70000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 00000019.00000002.2211012606.00007FF670A70000.00000002.00000001.01000000.0000003F.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000019.00000002.2211171848.00007FF670A9A000.00000002.00000001.01000000.0000003F.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000019.00000002.2211223436.00007FF670AAD000.00000004.00000001.01000000.0000003F.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000019.00000002.2211223436.00007FF670ABC000.00000004.00000001.01000000.0000003F.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000019.00000002.2211367389.00007FF670ABE000.00000002.00000001.01000000.0000003F.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_25_2_7ff670a70000_dat.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: _get_daylight$_isindst
                                                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                                                              • API String ID: 4170891091-0
                                                                                                                                                                                                                                              • Opcode ID: 9a335e65895d815b06806fcf897e1ccafa5e2f7da5d283a57fe6a61041334353
                                                                                                                                                                                                                                              • Instruction ID: 5aaf45a9b32cd16e36fbcbd7a0bbdda11345da83751ad5c814d6fe6e18c7f50f
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 9a335e65895d815b06806fcf897e1ccafa5e2f7da5d283a57fe6a61041334353
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: AB510473F24292AAFB19DF6499855BC27A1AB2039CF500135EE0ED2BD6DF3CA402C710
                                                                                                                                                                                                                                              Function 00007FF670A84584 Relevance: 6.1, APIs: 4, Instructions: 119pipeCOMMON
                                                                                                                                                                                                                                              Download Yara Rule

                                                                                                                                                                                                                                              Control-flow Graph

                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 00000019.00000002.2211089282.00007FF670A71000.00000020.00000001.01000000.0000003F.sdmp, Offset: 00007FF670A70000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 00000019.00000002.2211012606.00007FF670A70000.00000002.00000001.01000000.0000003F.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000019.00000002.2211171848.00007FF670A9A000.00000002.00000001.01000000.0000003F.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000019.00000002.2211223436.00007FF670AAD000.00000004.00000001.01000000.0000003F.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000019.00000002.2211223436.00007FF670ABC000.00000004.00000001.01000000.0000003F.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000019.00000002.2211367389.00007FF670ABE000.00000002.00000001.01000000.0000003F.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_25_2_7ff670a70000_dat.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: File$ErrorHandleInformationLastNamedPeekPipeType
                                                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                                                              • API String ID: 2780335769-0
                                                                                                                                                                                                                                              • Opcode ID: 3f6f626b493e936080ee1a0a18c01430c27b183f7118c2d49098fba4b2d843d4
                                                                                                                                                                                                                                              • Instruction ID: c66ac59a6b3f4a3c8f89c23ad0b241a1f70ed16eda81abfbec45a146f1bd4f62
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 3f6f626b493e936080ee1a0a18c01430c27b183f7118c2d49098fba4b2d843d4
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: F5518823E28681AAFB11CFB0D4503BD37A1AB59B88F108135DE49C778AEF78D4818720
                                                                                                                                                                                                                                              Function 00007FF670A7AE2C Relevance: 6.1, APIs: 4, Instructions: 94COMMON
                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 00000019.00000002.2211089282.00007FF670A71000.00000020.00000001.01000000.0000003F.sdmp, Offset: 00007FF670A70000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 00000019.00000002.2211012606.00007FF670A70000.00000002.00000001.01000000.0000003F.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000019.00000002.2211171848.00007FF670A9A000.00000002.00000001.01000000.0000003F.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000019.00000002.2211223436.00007FF670AAD000.00000004.00000001.01000000.0000003F.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000019.00000002.2211223436.00007FF670ABC000.00000004.00000001.01000000.0000003F.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000019.00000002.2211367389.00007FF670ABE000.00000002.00000001.01000000.0000003F.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_25_2_7ff670a70000_dat.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: __scrt_acquire_startup_lock__scrt_dllmain_crt_thread_attach__scrt_get_show_window_mode__scrt_initialize_crt__scrt_release_startup_lock
                                                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                                                              • API String ID: 1452418845-0
                                                                                                                                                                                                                                              • Opcode ID: 2dfea9045f881ff78022f3a65fc22168407db2ca461a817ccd3f57a6f463f9a5
                                                                                                                                                                                                                                              • Instruction ID: 09a8cdf80cf151a47a8347c0f41ff7f71aa1abd272c05ae36e9a03b778c49243
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 2dfea9045f881ff78022f3a65fc22168407db2ca461a817ccd3f57a6f463f9a5
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 50315A53A3D247B5FA24AB24D4553B92391AFA1344F84A035E94ECB3DBDF2DB8058371
                                                                                                                                                                                                                                              Function 00007FF670A84430 Relevance: 6.1, APIs: 4, Instructions: 90fileCOMMON
                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 00000019.00000002.2211089282.00007FF670A71000.00000020.00000001.01000000.0000003F.sdmp, Offset: 00007FF670A70000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 00000019.00000002.2211012606.00007FF670A70000.00000002.00000001.01000000.0000003F.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000019.00000002.2211171848.00007FF670A9A000.00000002.00000001.01000000.0000003F.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000019.00000002.2211223436.00007FF670AAD000.00000004.00000001.01000000.0000003F.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000019.00000002.2211223436.00007FF670ABC000.00000004.00000001.01000000.0000003F.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000019.00000002.2211367389.00007FF670ABE000.00000002.00000001.01000000.0000003F.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_25_2_7ff670a70000_dat.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: CloseCreateFileHandle_invalid_parameter_noinfo
                                                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                                                              • API String ID: 1279662727-0
                                                                                                                                                                                                                                              • Opcode ID: aff0d7c093882a4d26d3a8b99022a8fcabbcfeaf98423b8fc509e437e0bc8c36
                                                                                                                                                                                                                                              • Instruction ID: 7105536bca24708c196aa6c972e578419f5da1bb6913897120cd5e7545177024
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: aff0d7c093882a4d26d3a8b99022a8fcabbcfeaf98423b8fc509e437e0bc8c36
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: C6419263E287C197F7558B6195003796760FBA4764F109335EA9CC3BD2EFACA5E08710
                                                                                                                                                                                                                                              Function 00007FF670A88BE0 Relevance: 4.5, APIs: 3, Instructions: 14COMMON
                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 00000019.00000002.2211089282.00007FF670A71000.00000020.00000001.01000000.0000003F.sdmp, Offset: 00007FF670A70000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 00000019.00000002.2211012606.00007FF670A70000.00000002.00000001.01000000.0000003F.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000019.00000002.2211171848.00007FF670A9A000.00000002.00000001.01000000.0000003F.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000019.00000002.2211223436.00007FF670AAD000.00000004.00000001.01000000.0000003F.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000019.00000002.2211223436.00007FF670ABC000.00000004.00000001.01000000.0000003F.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000019.00000002.2211367389.00007FF670ABE000.00000002.00000001.01000000.0000003F.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_25_2_7ff670a70000_dat.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: Process$CurrentExitTerminate
                                                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                                                              • API String ID: 1703294689-0
                                                                                                                                                                                                                                              • Opcode ID: d62060bd09c98f63d26231482086f6b03c071e5e7110db56bdb808fa1e27c3c8
                                                                                                                                                                                                                                              • Instruction ID: d286eaeb50e5aa47781fb7fe86f26f8e93e780bb442fa56cccab30f4d1c55f83
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: d62060bd09c98f63d26231482086f6b03c071e5e7110db56bdb808fa1e27c3c8
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: E4D05257F3A382A2EA493B30188503812521F68B40F20143AC88BC63C7CF2EA8888270
                                                                                                                                                                                                                                              Function 00007FF670A7F2B8 Relevance: 3.2, APIs: 2, Instructions: 175COMMONLIBRARYCODE
                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 00000019.00000002.2211089282.00007FF670A71000.00000020.00000001.01000000.0000003F.sdmp, Offset: 00007FF670A70000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 00000019.00000002.2211012606.00007FF670A70000.00000002.00000001.01000000.0000003F.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000019.00000002.2211171848.00007FF670A9A000.00000002.00000001.01000000.0000003F.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000019.00000002.2211223436.00007FF670AAD000.00000004.00000001.01000000.0000003F.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000019.00000002.2211223436.00007FF670ABC000.00000004.00000001.01000000.0000003F.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000019.00000002.2211367389.00007FF670ABE000.00000002.00000001.01000000.0000003F.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_25_2_7ff670a70000_dat.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: _invalid_parameter_noinfo
                                                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                                                              • API String ID: 3215553584-0
                                                                                                                                                                                                                                              • Opcode ID: 46a2af1879c2f50747042a3ab55741b4931bc27440d9acf90303e4543271f7f8
                                                                                                                                                                                                                                              • Instruction ID: 7306b272ac34a9a65697c15aeec472e98c8f80d9e4554125f2e1abc30fe2747e
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 46a2af1879c2f50747042a3ab55741b4931bc27440d9acf90303e4543271f7f8
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: AE51D523B29283A6FA649E25940067A6691BF44BA4F14D331DD7CC77CFDF3CE6018620
                                                                                                                                                                                                                                              Function 00007FF670A8B96C Relevance: 3.0, APIs: 2, Instructions: 46COMMONLIBRARYCODE
                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                              • SetFilePointerEx.KERNELBASE(?,?,?,?,00000000,00007FF670A8BB05), ref: 00007FF670A8B9B8
                                                                                                                                                                                                                                              • GetLastError.KERNEL32(?,?,?,?,00000000,00007FF670A8BB05), ref: 00007FF670A8B9C2
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 00000019.00000002.2211089282.00007FF670A71000.00000020.00000001.01000000.0000003F.sdmp, Offset: 00007FF670A70000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 00000019.00000002.2211012606.00007FF670A70000.00000002.00000001.01000000.0000003F.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000019.00000002.2211171848.00007FF670A9A000.00000002.00000001.01000000.0000003F.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000019.00000002.2211223436.00007FF670AAD000.00000004.00000001.01000000.0000003F.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000019.00000002.2211223436.00007FF670ABC000.00000004.00000001.01000000.0000003F.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000019.00000002.2211367389.00007FF670ABE000.00000002.00000001.01000000.0000003F.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_25_2_7ff670a70000_dat.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: ErrorFileLastPointer
                                                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                                                              • API String ID: 2976181284-0
                                                                                                                                                                                                                                              • Opcode ID: 1eb380e80a89d0b1773f03f267f74a86f3d4599d947c953e904cec0139cff5ef
                                                                                                                                                                                                                                              • Instruction ID: 6c22abf9d870dc7dc23960b20679a68bee21774a5315f05e838855613cc7f3af
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 1eb380e80a89d0b1773f03f267f74a86f3d4599d947c953e904cec0139cff5ef
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 6E11BF63B38B8291DA208B25A404169B761AB84BF4F545331EABDCB7EACF7CD0518740
                                                                                                                                                                                                                                              Function 00007FF670A8472C Relevance: 3.0, APIs: 2, Instructions: 40timeCOMMON
                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                              • FileTimeToSystemTime.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF670A84641), ref: 00007FF670A8475F
                                                                                                                                                                                                                                              • SystemTimeToTzSpecificLocalTime.KERNELBASE(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF670A84641), ref: 00007FF670A84775
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 00000019.00000002.2211089282.00007FF670A71000.00000020.00000001.01000000.0000003F.sdmp, Offset: 00007FF670A70000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 00000019.00000002.2211012606.00007FF670A70000.00000002.00000001.01000000.0000003F.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000019.00000002.2211171848.00007FF670A9A000.00000002.00000001.01000000.0000003F.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000019.00000002.2211223436.00007FF670AAD000.00000004.00000001.01000000.0000003F.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000019.00000002.2211223436.00007FF670ABC000.00000004.00000001.01000000.0000003F.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000019.00000002.2211367389.00007FF670ABE000.00000002.00000001.01000000.0000003F.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_25_2_7ff670a70000_dat.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: Time$System$FileLocalSpecific
                                                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                                                              • API String ID: 1707611234-0
                                                                                                                                                                                                                                              • Opcode ID: 6efbe7fb942df77ddbf8decce42db6b9a9834a1eccc0b4e17cd5f894f5c9f7f5
                                                                                                                                                                                                                                              • Instruction ID: b352c36551421dbc9e0741a5909e0d43346d645babe78369a4935dc0ba6f6373
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 6efbe7fb942df77ddbf8decce42db6b9a9834a1eccc0b4e17cd5f894f5c9f7f5
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: EE11C67362C682A2EB558B11A40107AF7A0FB85765F500235FAEEC1BE9EF7CD014CB10
                                                                                                                                                                                                                                              Function 00007FF670A86714 Relevance: 3.0, APIs: 2, Instructions: 35timeCOMMONLIBRARYCODE
                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                              • FileTimeToSystemTime.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF670A86591), ref: 00007FF670A86737
                                                                                                                                                                                                                                              • SystemTimeToTzSpecificLocalTime.KERNELBASE(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF670A86591), ref: 00007FF670A8674D
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 00000019.00000002.2211089282.00007FF670A71000.00000020.00000001.01000000.0000003F.sdmp, Offset: 00007FF670A70000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 00000019.00000002.2211012606.00007FF670A70000.00000002.00000001.01000000.0000003F.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000019.00000002.2211171848.00007FF670A9A000.00000002.00000001.01000000.0000003F.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000019.00000002.2211223436.00007FF670AAD000.00000004.00000001.01000000.0000003F.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000019.00000002.2211223436.00007FF670ABC000.00000004.00000001.01000000.0000003F.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000019.00000002.2211367389.00007FF670ABE000.00000002.00000001.01000000.0000003F.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_25_2_7ff670a70000_dat.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: Time$System$FileLocalSpecific
                                                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                                                              • API String ID: 1707611234-0
                                                                                                                                                                                                                                              • Opcode ID: a68cac1c454e300f8b3e4b6d5a5d178c803399669668747c19dbdf19a8985f4c
                                                                                                                                                                                                                                              • Instruction ID: c2e1ce2145427ef685b8e3c0032d377e008bc6b88c9bdc30d72d8af5ab4babfd
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: a68cac1c454e300f8b3e4b6d5a5d178c803399669668747c19dbdf19a8985f4c
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 56018E3362C291A2E7518F15A40127AB3A0FB81765F604236E6EAC1AE9DF3DD410CB20
                                                                                                                                                                                                                                              Function 00007FF670A8A168 Relevance: 3.0, APIs: 2, Instructions: 19memoryCOMMONLIBRARYCODE
                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                              • RtlFreeHeap.NTDLL(?,?,?,00007FF670A9214A,?,?,?,00007FF670A92187,?,?,00000000,00007FF670A92658,?,?,?,00007FF670A9258B), ref: 00007FF670A8A17E
                                                                                                                                                                                                                                              • GetLastError.KERNEL32(?,?,?,00007FF670A9214A,?,?,?,00007FF670A92187,?,?,00000000,00007FF670A92658,?,?,?,00007FF670A9258B), ref: 00007FF670A8A188
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 00000019.00000002.2211089282.00007FF670A71000.00000020.00000001.01000000.0000003F.sdmp, Offset: 00007FF670A70000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 00000019.00000002.2211012606.00007FF670A70000.00000002.00000001.01000000.0000003F.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000019.00000002.2211171848.00007FF670A9A000.00000002.00000001.01000000.0000003F.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000019.00000002.2211223436.00007FF670AAD000.00000004.00000001.01000000.0000003F.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000019.00000002.2211223436.00007FF670ABC000.00000004.00000001.01000000.0000003F.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000019.00000002.2211367389.00007FF670ABE000.00000002.00000001.01000000.0000003F.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_25_2_7ff670a70000_dat.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: ErrorFreeHeapLast
                                                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                                                              • API String ID: 485612231-0
                                                                                                                                                                                                                                              • Opcode ID: a673a507b2d9f362c5f5c34d7f5e537087e665f3a82958f491e2c6c5d4392de6
                                                                                                                                                                                                                                              • Instruction ID: 85c5fdfc6984f18cd04c5818ebd4adc810468149d22a30a05283a01ea50bf13f
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: a673a507b2d9f362c5f5c34d7f5e537087e665f3a82958f491e2c6c5d4392de6
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 91E08C17F39282A6FF1AABB2A88907922505FA4B00F444230C90DC63D3EF2CA8858270
                                                                                                                                                                                                                                              Function 00007FF670A872D4 Relevance: 3.0, APIs: 2, Instructions: 12fileCOMMON
                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 00000019.00000002.2211089282.00007FF670A71000.00000020.00000001.01000000.0000003F.sdmp, Offset: 00007FF670A70000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 00000019.00000002.2211012606.00007FF670A70000.00000002.00000001.01000000.0000003F.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000019.00000002.2211171848.00007FF670A9A000.00000002.00000001.01000000.0000003F.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000019.00000002.2211223436.00007FF670AAD000.00000004.00000001.01000000.0000003F.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000019.00000002.2211223436.00007FF670ABC000.00000004.00000001.01000000.0000003F.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000019.00000002.2211367389.00007FF670ABE000.00000002.00000001.01000000.0000003F.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_25_2_7ff670a70000_dat.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: DeleteErrorFileLast
                                                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                                                              • API String ID: 2018770650-0
                                                                                                                                                                                                                                              • Opcode ID: d7499c624ee991937a4b8caa9e62551e14322714b0d7c9d890be704f6f569852
                                                                                                                                                                                                                                              • Instruction ID: 6806176f74c00342598767eed5b255e0ee9c5f3acf599b1ce62b36bc57a0896c
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: d7499c624ee991937a4b8caa9e62551e14322714b0d7c9d890be704f6f569852
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 5BD0C913F39543A5E625277528494BA22905F65720F500631D459C03E2EF5DE0C94621
                                                                                                                                                                                                                                              Function 00007FF670A8647C Relevance: 3.0, APIs: 2, Instructions: 12COMMON
                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 00000019.00000002.2211089282.00007FF670A71000.00000020.00000001.01000000.0000003F.sdmp, Offset: 00007FF670A70000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 00000019.00000002.2211012606.00007FF670A70000.00000002.00000001.01000000.0000003F.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000019.00000002.2211171848.00007FF670A9A000.00000002.00000001.01000000.0000003F.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000019.00000002.2211223436.00007FF670AAD000.00000004.00000001.01000000.0000003F.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000019.00000002.2211223436.00007FF670ABC000.00000004.00000001.01000000.0000003F.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000019.00000002.2211367389.00007FF670ABE000.00000002.00000001.01000000.0000003F.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_25_2_7ff670a70000_dat.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: DirectoryErrorLastRemove
                                                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                                                              • API String ID: 377330604-0
                                                                                                                                                                                                                                              • Opcode ID: 6788dfb68509012efa5509a4fad9878ebfe710630e44273c153ed33f720737c1
                                                                                                                                                                                                                                              • Instruction ID: 685f2b3feea14727265c37ab32edd9b61d8198862da25b23b1288b697cc70853
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 6788dfb68509012efa5509a4fad9878ebfe710630e44273c153ed33f720737c1
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 94D0C917F79582A1F6152771184917D22901F64720F504671D419C03E2EF6DA0994221
                                                                                                                                                                                                                                              Function 00007FF670A8A378 Relevance: 2.6, APIs: 2, Instructions: 59COMMON
                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                              • CloseHandle.KERNELBASE(?,?,?,00007FF670A8A1F5,?,?,00000000,00007FF670A8A2AA), ref: 00007FF670A8A3E6
                                                                                                                                                                                                                                              • GetLastError.KERNEL32(?,?,?,00007FF670A8A1F5,?,?,00000000,00007FF670A8A2AA), ref: 00007FF670A8A3F0
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 00000019.00000002.2211089282.00007FF670A71000.00000020.00000001.01000000.0000003F.sdmp, Offset: 00007FF670A70000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 00000019.00000002.2211012606.00007FF670A70000.00000002.00000001.01000000.0000003F.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000019.00000002.2211171848.00007FF670A9A000.00000002.00000001.01000000.0000003F.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000019.00000002.2211223436.00007FF670AAD000.00000004.00000001.01000000.0000003F.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000019.00000002.2211223436.00007FF670ABC000.00000004.00000001.01000000.0000003F.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000019.00000002.2211367389.00007FF670ABE000.00000002.00000001.01000000.0000003F.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_25_2_7ff670a70000_dat.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: CloseErrorHandleLast
                                                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                                                              • API String ID: 918212764-0
                                                                                                                                                                                                                                              • Opcode ID: 6d510294f211babb34c62ae7a866304dc7809045747c103bf26d8d248780cbcb
                                                                                                                                                                                                                                              • Instruction ID: c96186a7d62e7c1018f99884b89be1e0a58917e835f6a0accc68d1c8947290b1
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 6d510294f211babb34c62ae7a866304dc7809045747c103bf26d8d248780cbcb
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 2921C323F386C261FEA29765944427D2682DF547A0F585239DA6ECB7D3CF6CE4458320
                                                                                                                                                                                                                                              Function 00007FF670A76BF0 Relevance: 1.6, APIs: 1, Instructions: 141COMMON
                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 00000019.00000002.2211089282.00007FF670A71000.00000020.00000001.01000000.0000003F.sdmp, Offset: 00007FF670A70000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 00000019.00000002.2211012606.00007FF670A70000.00000002.00000001.01000000.0000003F.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000019.00000002.2211171848.00007FF670A9A000.00000002.00000001.01000000.0000003F.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000019.00000002.2211223436.00007FF670AAD000.00000004.00000001.01000000.0000003F.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000019.00000002.2211223436.00007FF670ABC000.00000004.00000001.01000000.0000003F.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000019.00000002.2211367389.00007FF670ABE000.00000002.00000001.01000000.0000003F.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_25_2_7ff670a70000_dat.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: ByteCharMultiWide_findclose
                                                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                                                              • API String ID: 2772937645-0
                                                                                                                                                                                                                                              • Opcode ID: edad452182e32503cf477b8d29290849dd4d011102cf2d60055f86b55b9946a1
                                                                                                                                                                                                                                              • Instruction ID: fc2405f3be67b8c28dbe3dc6cfe61cc8003e5feee68bedd58779060a5a3b0760
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: edad452182e32503cf477b8d29290849dd4d011102cf2d60055f86b55b9946a1
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 0E718A53E28AC591EA11CB2CC5052FD7360F7A9B48F54E321DB9C92697EF28E2D9C700
                                                                                                                                                                                                                                              Function 00007FF670A8B6D8 Relevance: 1.6, APIs: 1, Instructions: 105COMMONLIBRARYCODE
                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 00000019.00000002.2211089282.00007FF670A71000.00000020.00000001.01000000.0000003F.sdmp, Offset: 00007FF670A70000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 00000019.00000002.2211012606.00007FF670A70000.00000002.00000001.01000000.0000003F.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000019.00000002.2211171848.00007FF670A9A000.00000002.00000001.01000000.0000003F.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000019.00000002.2211223436.00007FF670AAD000.00000004.00000001.01000000.0000003F.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000019.00000002.2211223436.00007FF670ABC000.00000004.00000001.01000000.0000003F.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000019.00000002.2211367389.00007FF670ABE000.00000002.00000001.01000000.0000003F.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_25_2_7ff670a70000_dat.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: _invalid_parameter_noinfo
                                                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                                                              • API String ID: 3215553584-0
                                                                                                                                                                                                                                              • Opcode ID: 921bdf0eba68be09e4b7463ed2823839ea20c7cdcc22b5de8510a95a494254ce
                                                                                                                                                                                                                                              • Instruction ID: 819a757424129e229b22960ea0e95959f031bbc0d5e37f1cfc0f0ebf29833b1a
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 921bdf0eba68be09e4b7463ed2823839ea20c7cdcc22b5de8510a95a494254ce
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 95419F33A39385A7EA36DB19E54027977A4EB90B94F140231DA8AC77D2CF2CE402C760
                                                                                                                                                                                                                                              Function 00007FF670A77160 Relevance: 1.6, APIs: 1, Instructions: 85COMMON
                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 00000019.00000002.2211089282.00007FF670A71000.00000020.00000001.01000000.0000003F.sdmp, Offset: 00007FF670A70000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 00000019.00000002.2211012606.00007FF670A70000.00000002.00000001.01000000.0000003F.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000019.00000002.2211171848.00007FF670A9A000.00000002.00000001.01000000.0000003F.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000019.00000002.2211223436.00007FF670AAD000.00000004.00000001.01000000.0000003F.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000019.00000002.2211223436.00007FF670ABC000.00000004.00000001.01000000.0000003F.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000019.00000002.2211367389.00007FF670ABE000.00000002.00000001.01000000.0000003F.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_25_2_7ff670a70000_dat.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: _fread_nolock
                                                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                                                              • API String ID: 840049012-0
                                                                                                                                                                                                                                              • Opcode ID: e59626446ef346303721b48eea9cf21a426441a5baccd51d58ec0eba9bcdc55e
                                                                                                                                                                                                                                              • Instruction ID: b3530227134912fddc8b51a76f54b0a26cfb3047c4ff7215658145ffef5c5630
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: e59626446ef346303721b48eea9cf21a426441a5baccd51d58ec0eba9bcdc55e
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 8D21A223B2C29265EA14DA1265047FEA641BF45BD4F88A031EE1DC7B8BDF3CE541C250
                                                                                                                                                                                                                                              Function 00007FF670A8B170 Relevance: 1.6, APIs: 1, Instructions: 74COMMONLIBRARYCODE
                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 00000019.00000002.2211089282.00007FF670A71000.00000020.00000001.01000000.0000003F.sdmp, Offset: 00007FF670A70000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 00000019.00000002.2211012606.00007FF670A70000.00000002.00000001.01000000.0000003F.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000019.00000002.2211171848.00007FF670A9A000.00000002.00000001.01000000.0000003F.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000019.00000002.2211223436.00007FF670AAD000.00000004.00000001.01000000.0000003F.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000019.00000002.2211223436.00007FF670ABC000.00000004.00000001.01000000.0000003F.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000019.00000002.2211367389.00007FF670ABE000.00000002.00000001.01000000.0000003F.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_25_2_7ff670a70000_dat.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: _invalid_parameter_noinfo
                                                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                                                              • API String ID: 3215553584-0
                                                                                                                                                                                                                                              • Opcode ID: ebce2893e7386841ed580dde05bc7058577b7e5d5ec03578d12c1ac3e6eaceb6
                                                                                                                                                                                                                                              • Instruction ID: 821df039cd6c1e489bd2dd5be7d26cc2304a85f92ac17e80550fd9c8b43b8327
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: ebce2893e7386841ed580dde05bc7058577b7e5d5ec03578d12c1ac3e6eaceb6
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 62318173A386C2A5E7429B5588853BC6B51ABA1BA4F510235DA1DC33E3DFBCA4858730
                                                                                                                                                                                                                                              Function 00007FF670A88B11 Relevance: 1.6, APIs: 1, Instructions: 61COMMON
                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 00000019.00000002.2211089282.00007FF670A71000.00000020.00000001.01000000.0000003F.sdmp, Offset: 00007FF670A70000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 00000019.00000002.2211012606.00007FF670A70000.00000002.00000001.01000000.0000003F.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000019.00000002.2211171848.00007FF670A9A000.00000002.00000001.01000000.0000003F.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000019.00000002.2211223436.00007FF670AAD000.00000004.00000001.01000000.0000003F.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000019.00000002.2211223436.00007FF670ABC000.00000004.00000001.01000000.0000003F.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000019.00000002.2211367389.00007FF670ABE000.00000002.00000001.01000000.0000003F.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_25_2_7ff670a70000_dat.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: HandleModule$AddressFreeLibraryProc
                                                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                                                              • API String ID: 3947729631-0
                                                                                                                                                                                                                                              • Opcode ID: e6c24619f5215b83aec1ea87e649774fc018db111b87a8e2cbcec198033a6ec0
                                                                                                                                                                                                                                              • Instruction ID: 178c79ad07966736d0793ee97e36ff8370c472bec79ee56617260a7302dda9e2
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: e6c24619f5215b83aec1ea87e649774fc018db111b87a8e2cbcec198033a6ec0
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 7A21AEB3A257819AEB268F64C4442EC33A0FB8476CF080636D61DC6BC6DF38D494C7A4
                                                                                                                                                                                                                                              Function 00007FF670A85278 Relevance: 1.6, APIs: 1, Instructions: 55COMMON
                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 00000019.00000002.2211089282.00007FF670A71000.00000020.00000001.01000000.0000003F.sdmp, Offset: 00007FF670A70000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 00000019.00000002.2211012606.00007FF670A70000.00000002.00000001.01000000.0000003F.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000019.00000002.2211171848.00007FF670A9A000.00000002.00000001.01000000.0000003F.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000019.00000002.2211223436.00007FF670AAD000.00000004.00000001.01000000.0000003F.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000019.00000002.2211223436.00007FF670ABC000.00000004.00000001.01000000.0000003F.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000019.00000002.2211367389.00007FF670ABE000.00000002.00000001.01000000.0000003F.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_25_2_7ff670a70000_dat.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: _invalid_parameter_noinfo
                                                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                                                              • API String ID: 3215553584-0
                                                                                                                                                                                                                                              • Opcode ID: e2d81e48737d2b9edbd67630313f86d574e33faf5878dae4ee8aa738ebab6973
                                                                                                                                                                                                                                              • Instruction ID: c9297d40711c5a6183a31112ee3944baa91110992e8d1ecc5ca2c4e672d35907
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: e2d81e48737d2b9edbd67630313f86d574e33faf5878dae4ee8aa738ebab6973
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 16118123A2C6C191FE62AF619404279A2A0BF95B80F544131EE8CD77C7DF7CD5418720
                                                                                                                                                                                                                                              Function 00007FF670A9567C Relevance: 1.6, APIs: 1, Instructions: 54COMMON
                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 00000019.00000002.2211089282.00007FF670A71000.00000020.00000001.01000000.0000003F.sdmp, Offset: 00007FF670A70000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 00000019.00000002.2211012606.00007FF670A70000.00000002.00000001.01000000.0000003F.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000019.00000002.2211171848.00007FF670A9A000.00000002.00000001.01000000.0000003F.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000019.00000002.2211223436.00007FF670AAD000.00000004.00000001.01000000.0000003F.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000019.00000002.2211223436.00007FF670ABC000.00000004.00000001.01000000.0000003F.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000019.00000002.2211367389.00007FF670ABE000.00000002.00000001.01000000.0000003F.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_25_2_7ff670a70000_dat.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: _invalid_parameter_noinfo
                                                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                                                              • API String ID: 3215553584-0
                                                                                                                                                                                                                                              • Opcode ID: 60d9f9acc7225305b8a94005220afb75f792b29590b70391da89a6fb11ac5e62
                                                                                                                                                                                                                                              • Instruction ID: f1065a15d6d727be8932efed30d35da879cce3b57b88045c0bd93c6419c0408f
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 60d9f9acc7225305b8a94005220afb75f792b29590b70391da89a6fb11ac5e62
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: CE215033B2868196EB618F28E44176977A0EB94B94F684234E75DC77DADF3DD4018B10
                                                                                                                                                                                                                                              Function 00007FF670A7F538 Relevance: 1.5, APIs: 1, Instructions: 48COMMONLIBRARYCODE
                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 00000019.00000002.2211089282.00007FF670A71000.00000020.00000001.01000000.0000003F.sdmp, Offset: 00007FF670A70000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 00000019.00000002.2211012606.00007FF670A70000.00000002.00000001.01000000.0000003F.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000019.00000002.2211171848.00007FF670A9A000.00000002.00000001.01000000.0000003F.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000019.00000002.2211223436.00007FF670AAD000.00000004.00000001.01000000.0000003F.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000019.00000002.2211223436.00007FF670ABC000.00000004.00000001.01000000.0000003F.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000019.00000002.2211367389.00007FF670ABE000.00000002.00000001.01000000.0000003F.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_25_2_7ff670a70000_dat.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: _invalid_parameter_noinfo
                                                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                                                              • API String ID: 3215553584-0
                                                                                                                                                                                                                                              • Opcode ID: e4873d1516dd9c3e810b3a8ea2f1d2e802796ef0a43dc58582891be639f1b00f
                                                                                                                                                                                                                                              • Instruction ID: 3fb15db8ff1b540981a2af9a4ddf9172bfd0bbcc80adeb358600a25a221d4471
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: e4873d1516dd9c3e810b3a8ea2f1d2e802796ef0a43dc58582891be639f1b00f
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 4601C463B2878251EA04DF529901069A794BF95FE0F489631EE5CD3BDBCF3CD6018310
                                                                                                                                                                                                                                              Function 00007FF670A86108 Relevance: 1.5, APIs: 1, Instructions: 43COMMON
                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 00000019.00000002.2211089282.00007FF670A71000.00000020.00000001.01000000.0000003F.sdmp, Offset: 00007FF670A70000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 00000019.00000002.2211012606.00007FF670A70000.00000002.00000001.01000000.0000003F.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000019.00000002.2211171848.00007FF670A9A000.00000002.00000001.01000000.0000003F.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000019.00000002.2211223436.00007FF670AAD000.00000004.00000001.01000000.0000003F.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000019.00000002.2211223436.00007FF670ABC000.00000004.00000001.01000000.0000003F.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000019.00000002.2211367389.00007FF670ABE000.00000002.00000001.01000000.0000003F.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_25_2_7ff670a70000_dat.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: _invalid_parameter_noinfo
                                                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                                                              • API String ID: 3215553584-0
                                                                                                                                                                                                                                              • Opcode ID: c8495c8db4b93b2348236b75e4dddab1199d47763aee907c09e3955fff9d2071
                                                                                                                                                                                                                                              • Instruction ID: e9ff01533180ab4d06c4116d566d7fbdbe99438a760478fe5fd60a3e709a84c7
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: c8495c8db4b93b2348236b75e4dddab1199d47763aee907c09e3955fff9d2071
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 6B019E23E3D2C2B0FE626B656A49279A690AF047E0F084335E95DC37C7DF3CA4614230
                                                                                                                                                                                                                                              Function 00007FF670A86444 Relevance: 1.5, APIs: 1, Instructions: 19COMMON
                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 00000019.00000002.2211089282.00007FF670A71000.00000020.00000001.01000000.0000003F.sdmp, Offset: 00007FF670A70000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 00000019.00000002.2211012606.00007FF670A70000.00000002.00000001.01000000.0000003F.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000019.00000002.2211171848.00007FF670A9A000.00000002.00000001.01000000.0000003F.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000019.00000002.2211223436.00007FF670AAD000.00000004.00000001.01000000.0000003F.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000019.00000002.2211223436.00007FF670ABC000.00000004.00000001.01000000.0000003F.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000019.00000002.2211367389.00007FF670ABE000.00000002.00000001.01000000.0000003F.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_25_2_7ff670a70000_dat.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: _invalid_parameter_noinfo
                                                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                                                              • API String ID: 3215553584-0
                                                                                                                                                                                                                                              • Opcode ID: 20535c21c059d804b50a95555c923d540c07c7fba9e68ab742a2987665770cc1
                                                                                                                                                                                                                                              • Instruction ID: 8c59c6143f1c8b8b18338d3a52bf59818c2eed178222716541bd6b2798a1bed4
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 20535c21c059d804b50a95555c923d540c07c7fba9e68ab742a2987665770cc1
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 01E01263F683C76AFA1B7BF44AC61BC11205F24340F004134D948C63C3DF1C68895635
                                                                                                                                                                                                                                              Function 00007FF670A77290 Relevance: 1.3, APIs: 1, Instructions: 92COMMON
                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 00000019.00000002.2211089282.00007FF670A71000.00000020.00000001.01000000.0000003F.sdmp, Offset: 00007FF670A70000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 00000019.00000002.2211012606.00007FF670A70000.00000002.00000001.01000000.0000003F.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000019.00000002.2211171848.00007FF670A9A000.00000002.00000001.01000000.0000003F.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000019.00000002.2211223436.00007FF670AAD000.00000004.00000001.01000000.0000003F.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000019.00000002.2211223436.00007FF670ABC000.00000004.00000001.01000000.0000003F.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000019.00000002.2211367389.00007FF670ABE000.00000002.00000001.01000000.0000003F.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_25_2_7ff670a70000_dat.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: DirectoryErrorLastRemove
                                                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                                                              • API String ID: 377330604-0
                                                                                                                                                                                                                                              • Opcode ID: 09a521ef4cb0fd8898bfebd8eeb22065011f25953e633beb0c80092615295a14
                                                                                                                                                                                                                                              • Instruction ID: 4c0ca8717fc1cef2cbea4fb41628f6a66aea73a64722cb409e330421cda2b6d3
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 09a521ef4cb0fd8898bfebd8eeb22065011f25953e633beb0c80092615295a14
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: E0417317E287C592E651DB2495512FC2360FBA9744F54E232EF8DC2297EF68E2D8C320
                                                                                                                                                                                                                                              Function 00007FF670A8E0E0 Relevance: 1.3, APIs: 1, Instructions: 36memoryCOMMONLIBRARYCODE
                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                              • HeapAlloc.KERNEL32(?,?,00000000,00007FF670A8ABF6,?,?,?,00007FF670A89DBF,?,?,00000000,00007FF670A8A05A), ref: 00007FF670A8E135
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 00000019.00000002.2211089282.00007FF670A71000.00000020.00000001.01000000.0000003F.sdmp, Offset: 00007FF670A70000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 00000019.00000002.2211012606.00007FF670A70000.00000002.00000001.01000000.0000003F.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000019.00000002.2211171848.00007FF670A9A000.00000002.00000001.01000000.0000003F.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000019.00000002.2211223436.00007FF670AAD000.00000004.00000001.01000000.0000003F.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000019.00000002.2211223436.00007FF670ABC000.00000004.00000001.01000000.0000003F.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000019.00000002.2211367389.00007FF670ABE000.00000002.00000001.01000000.0000003F.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_25_2_7ff670a70000_dat.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: AllocHeap
                                                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                                                              • API String ID: 4292702814-0
                                                                                                                                                                                                                                              • Opcode ID: a493b6c3a5346acdfb9ba84895edf5a7b56a1aa8e9cf3a29e90864fe141fa411
                                                                                                                                                                                                                                              • Instruction ID: f98861353d133cd735d60d07e71b84bd45775e66a8c413cd6c7fe9d72092056f
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: a493b6c3a5346acdfb9ba84895edf5a7b56a1aa8e9cf3a29e90864fe141fa411
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 2EF01D67B39686A1FE96D76599592B552966FB8B88F0C5530C90EC63C3EF2CE4808230
                                                                                                                                                                                                                                              Function 00007FF670A8CE50 Relevance: 1.3, APIs: 1, Instructions: 29memoryCOMMONLIBRARYCODE
                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                              • HeapAlloc.KERNEL32(?,?,00000000,00007FF670A87228,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 00007FF670A8CE8E
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 00000019.00000002.2211089282.00007FF670A71000.00000020.00000001.01000000.0000003F.sdmp, Offset: 00007FF670A70000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 00000019.00000002.2211012606.00007FF670A70000.00000002.00000001.01000000.0000003F.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000019.00000002.2211171848.00007FF670A9A000.00000002.00000001.01000000.0000003F.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000019.00000002.2211223436.00007FF670AAD000.00000004.00000001.01000000.0000003F.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000019.00000002.2211223436.00007FF670ABC000.00000004.00000001.01000000.0000003F.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000019.00000002.2211367389.00007FF670ABE000.00000002.00000001.01000000.0000003F.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_25_2_7ff670a70000_dat.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: AllocHeap
                                                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                                                              • API String ID: 4292702814-0
                                                                                                                                                                                                                                              • Opcode ID: 4298054405db4a4a08a5b14e1c0068d3d506bccc87335596e9568cb5352a493e
                                                                                                                                                                                                                                              • Instruction ID: d18b59c7d80040a4029cad7c572cb61b99b35c9fcaee18a387718975fa9b8d5b
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 4298054405db4a4a08a5b14e1c0068d3d506bccc87335596e9568cb5352a493e
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: C5F01C63B3D78665FE765BB1598527512805F94BA0F080A30ED2EC63C3EF3CE4818A30

                                                                                                                                                                                                                                              Non-executed Functions

                                                                                                                                                                                                                                              Function 00007FF670A71B90 Relevance: 43.9, APIs: 20, Strings: 5, Instructions: 188windowCOMMON
                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 00000019.00000002.2211089282.00007FF670A71000.00000020.00000001.01000000.0000003F.sdmp, Offset: 00007FF670A70000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 00000019.00000002.2211012606.00007FF670A70000.00000002.00000001.01000000.0000003F.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000019.00000002.2211171848.00007FF670A9A000.00000002.00000001.01000000.0000003F.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000019.00000002.2211223436.00007FF670AAD000.00000004.00000001.01000000.0000003F.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000019.00000002.2211223436.00007FF670ABC000.00000004.00000001.01000000.0000003F.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000019.00000002.2211367389.00007FF670ABE000.00000002.00000001.01000000.0000003F.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_25_2_7ff670a70000_dat.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: MessageSend$Window$Create$Move$ObjectSelect$#380BaseClientDialogDrawFontIndirectInfoParametersRectReleaseSystemTextUnits
                                                                                                                                                                                                                                              • String ID: BUTTON$Close$EDIT$Failed to execute script '%ls' due to unhandled exception: %ls$STATIC
                                                                                                                                                                                                                                              • API String ID: 2446303242-1601438679
                                                                                                                                                                                                                                              • Opcode ID: 7ed90ee14006bcd321cd10bdeb934db8782b761a46ad43856a2a4bf3b656c6c9
                                                                                                                                                                                                                                              • Instruction ID: 04e062997dddaff914c69a7421b570b120fde9ad8b8e0799ff46de774981d25b
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 7ed90ee14006bcd321cd10bdeb934db8782b761a46ad43856a2a4bf3b656c6c9
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 05A14737328B81A7E7148F21E55479AB360F788B84F50412AEB8D87B25CF7EE165CB50
                                                                                                                                                                                                                                              Function 00007FF670A7B5CC Relevance: 10.6, APIs: 7, Instructions: 72COMMON
                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 00000019.00000002.2211089282.00007FF670A71000.00000020.00000001.01000000.0000003F.sdmp, Offset: 00007FF670A70000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 00000019.00000002.2211012606.00007FF670A70000.00000002.00000001.01000000.0000003F.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000019.00000002.2211171848.00007FF670A9A000.00000002.00000001.01000000.0000003F.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000019.00000002.2211223436.00007FF670AAD000.00000004.00000001.01000000.0000003F.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000019.00000002.2211223436.00007FF670ABC000.00000004.00000001.01000000.0000003F.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000019.00000002.2211367389.00007FF670ABE000.00000002.00000001.01000000.0000003F.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_25_2_7ff670a70000_dat.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: ExceptionFilterPresentUnhandled$CaptureContextDebuggerEntryFeatureFunctionLookupProcessorUnwindVirtual
                                                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                                                              • API String ID: 3140674995-0
                                                                                                                                                                                                                                              • Opcode ID: 6b6968d94bce6e9e5fed0559e23dc5a31b9e8664b1d3bb7900027832e5426e22
                                                                                                                                                                                                                                              • Instruction ID: cdd2895671be96718a7f4f3f80a2d708be582abac2b3343861acdc73b4d916f8
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 6b6968d94bce6e9e5fed0559e23dc5a31b9e8664b1d3bb7900027832e5426e22
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: C9314F73729B8195EB608F60E8803E97361FB94744F44453ADA8EC7B9ADF39D648C720
                                                                                                                                                                                                                                              Function 00007FF670A89E30 Relevance: 9.1, APIs: 6, Instructions: 83COMMONLIBRARYCODE
                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 00000019.00000002.2211089282.00007FF670A71000.00000020.00000001.01000000.0000003F.sdmp, Offset: 00007FF670A70000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 00000019.00000002.2211012606.00007FF670A70000.00000002.00000001.01000000.0000003F.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000019.00000002.2211171848.00007FF670A9A000.00000002.00000001.01000000.0000003F.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000019.00000002.2211223436.00007FF670AAD000.00000004.00000001.01000000.0000003F.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000019.00000002.2211223436.00007FF670ABC000.00000004.00000001.01000000.0000003F.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000019.00000002.2211367389.00007FF670ABE000.00000002.00000001.01000000.0000003F.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_25_2_7ff670a70000_dat.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: ExceptionFilterUnhandled$CaptureContextDebuggerEntryFunctionLookupPresentUnwindVirtual
                                                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                                                              • API String ID: 1239891234-0
                                                                                                                                                                                                                                              • Opcode ID: 2a5c43df35e99ae67e4cea9ce9060e2489f8be8a1fb54d96256a74953a59f3d3
                                                                                                                                                                                                                                              • Instruction ID: acabf21722fe7d229b0d280e691202f8abb99d7ac61d2e3187f203721d6c116e
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 2a5c43df35e99ae67e4cea9ce9060e2489f8be8a1fb54d96256a74953a59f3d3
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: A4318233628B81A6DB60CF25E8406AE73A4FB98754F540136EA9DC3B9ADF3CD545CB10
                                                                                                                                                                                                                                              Function 00007FF670A90CE4 Relevance: 7.8, APIs: 5, Instructions: 282COMMON
                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 00000019.00000002.2211089282.00007FF670A71000.00000020.00000001.01000000.0000003F.sdmp, Offset: 00007FF670A70000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 00000019.00000002.2211012606.00007FF670A70000.00000002.00000001.01000000.0000003F.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000019.00000002.2211171848.00007FF670A9A000.00000002.00000001.01000000.0000003F.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000019.00000002.2211223436.00007FF670AAD000.00000004.00000001.01000000.0000003F.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000019.00000002.2211223436.00007FF670ABC000.00000004.00000001.01000000.0000003F.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000019.00000002.2211367389.00007FF670ABE000.00000002.00000001.01000000.0000003F.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_25_2_7ff670a70000_dat.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: FileFindFirst_invalid_parameter_noinfo
                                                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                                                              • API String ID: 2227656907-0
                                                                                                                                                                                                                                              • Opcode ID: b3f1c49e492e255234082c3cff1f32be82a3374c5446236373d35cc3037b48ce
                                                                                                                                                                                                                                              • Instruction ID: 7e38cd301a0dce2137edde66c714d6ebb377d0d526937eb2a50e466e9bbef5a4
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: b3f1c49e492e255234082c3cff1f32be82a3374c5446236373d35cc3037b48ce
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 6FB1D423B3869295EA61DB259404ABE6390EF54BE4F444132EE5EC7BC6DF3EE541C320
                                                                                                                                                                                                                                              Function 00007FF670A92CC0 Relevance: 7.3, APIs: 3, Strings: 1, Instructions: 329COMMON
                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 00000019.00000002.2211089282.00007FF670A71000.00000020.00000001.01000000.0000003F.sdmp, Offset: 00007FF670A70000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 00000019.00000002.2211012606.00007FF670A70000.00000002.00000001.01000000.0000003F.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000019.00000002.2211171848.00007FF670A9A000.00000002.00000001.01000000.0000003F.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000019.00000002.2211223436.00007FF670AAD000.00000004.00000001.01000000.0000003F.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000019.00000002.2211223436.00007FF670ABC000.00000004.00000001.01000000.0000003F.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000019.00000002.2211367389.00007FF670ABE000.00000002.00000001.01000000.0000003F.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_25_2_7ff670a70000_dat.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: memcpy_s
                                                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                                                              • API String ID: 1502251526-3916222277
                                                                                                                                                                                                                                              • Opcode ID: cde1b8b2f6d1160984fe15dbaba42dea7d5925037cfa26e03551a8a86da9f649
                                                                                                                                                                                                                                              • Instruction ID: 872b6bd0525ef30b24778a7e03877540350530ba3cc016993a977ac0d41adb53
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: cde1b8b2f6d1160984fe15dbaba42dea7d5925037cfa26e03551a8a86da9f649
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 49C19F73B3968697EB24CF19E084A6AB7A1F784784F458235DB4A87B45DF3DE805CB00
                                                                                                                                                                                                                                              Function 00007FF670A73DD0 Relevance: 291.0, APIs: 55, Strings: 111, Instructions: 457libraryloaderCOMMON
                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 00000019.00000002.2211089282.00007FF670A71000.00000020.00000001.01000000.0000003F.sdmp, Offset: 00007FF670A70000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 00000019.00000002.2211012606.00007FF670A70000.00000002.00000001.01000000.0000003F.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000019.00000002.2211171848.00007FF670A9A000.00000002.00000001.01000000.0000003F.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000019.00000002.2211223436.00007FF670AAD000.00000004.00000001.01000000.0000003F.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000019.00000002.2211223436.00007FF670ABC000.00000004.00000001.01000000.0000003F.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000019.00000002.2211367389.00007FF670ABE000.00000002.00000001.01000000.0000003F.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_25_2_7ff670a70000_dat.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: AddressProc
                                                                                                                                                                                                                                              • String ID: Failed to get address for PyDict_GetItemString$Failed to get address for PyErr_Clear$Failed to get address for PyErr_Fetch$Failed to get address for PyErr_NormalizeException$Failed to get address for PyErr_Occurred$Failed to get address for PyErr_Print$Failed to get address for PyErr_Restore$Failed to get address for PyEval_EvalCode$Failed to get address for PyImport_AddModule$Failed to get address for PyImport_ExecCodeModule$Failed to get address for PyImport_ImportModule$Failed to get address for PyList_Append$Failed to get address for PyList_New$Failed to get address for PyLong_AsLong$Failed to get address for PyMarshal_ReadObjectFromString$Failed to get address for PyMem_RawFree$Failed to get address for PyModule_GetDict$Failed to get address for PyObject_CallFunction$Failed to get address for PyObject_CallFunctionObjArgs$Failed to get address for PyObject_GetAttrString$Failed to get address for PyObject_SetAttrString$Failed to get address for PyObject_Str$Failed to get address for PyRun_SimpleStringFlags$Failed to get address for PySys_AddWarnOption$Failed to get address for PySys_GetObject$Failed to get address for PySys_SetArgvEx$Failed to get address for PySys_SetObject$Failed to get address for PySys_SetPath$Failed to get address for PyUnicode_AsUTF8$Failed to get address for PyUnicode_Decode$Failed to get address for PyUnicode_DecodeFSDefault$Failed to get address for PyUnicode_FromFormat$Failed to get address for PyUnicode_FromString$Failed to get address for PyUnicode_Join$Failed to get address for PyUnicode_Replace$Failed to get address for Py_BuildValue$Failed to get address for Py_DecRef$Failed to get address for Py_DecodeLocale$Failed to get address for Py_DontWriteBytecodeFlag$Failed to get address for Py_FileSystemDefaultEncoding$Failed to get address for Py_Finalize$Failed to get address for Py_FrozenFlag$Failed to get address for Py_GetPath$Failed to get address for Py_IgnoreEnvironmentFlag$Failed to get address for Py_IncRef$Failed to get address for Py_Initialize$Failed to get address for Py_NoSiteFlag$Failed to get address for Py_NoUserSiteDirectory$Failed to get address for Py_OptimizeFlag$Failed to get address for Py_SetPath$Failed to get address for Py_SetProgramName$Failed to get address for Py_SetPythonHome$Failed to get address for Py_UTF8Mode$Failed to get address for Py_UnbufferedStdioFlag$Failed to get address for Py_VerboseFlag$GetProcAddress$PyDict_GetItemString$PyErr_Clear$PyErr_Fetch$PyErr_NormalizeException$PyErr_Occurred$PyErr_Print$PyErr_Restore$PyEval_EvalCode$PyImport_AddModule$PyImport_ExecCodeModule$PyImport_ImportModule$PyList_Append$PyList_New$PyLong_AsLong$PyMarshal_ReadObjectFromString$PyMem_RawFree$PyModule_GetDict$PyObject_CallFunction$PyObject_CallFunctionObjArgs$PyObject_GetAttrString$PyObject_SetAttrString$PyObject_Str$PyRun_SimpleStringFlags$PySys_AddWarnOption$PySys_GetObject$PySys_SetArgvEx$PySys_SetObject$PySys_SetPath$PyUnicode_AsUTF8$PyUnicode_Decode$PyUnicode_DecodeFSDefault$PyUnicode_FromFormat$PyUnicode_FromString$PyUnicode_Join$PyUnicode_Replace$Py_BuildValue$Py_DecRef$Py_DecodeLocale$Py_DontWriteBytecodeFlag$Py_FileSystemDefaultEncoding$Py_Finalize$Py_FrozenFlag$Py_GetPath$Py_IgnoreEnvironmentFlag$Py_IncRef$Py_Initialize$Py_NoSiteFlag$Py_NoUserSiteDirectory$Py_OptimizeFlag$Py_SetPath$Py_SetProgramName$Py_SetPythonHome$Py_UTF8Mode$Py_UnbufferedStdioFlag$Py_VerboseFlag
                                                                                                                                                                                                                                              • API String ID: 190572456-3109299426
                                                                                                                                                                                                                                              • Opcode ID: 7d3d92c3fb4b4818ef88af2979818605c477eb2c491dbc0430b532d63662b789
                                                                                                                                                                                                                                              • Instruction ID: 25dea2e533e70b56b3e6ea66344a0d0fe87d1d49bda3cc456acd1672d46c1c09
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 7d3d92c3fb4b4818ef88af2979818605c477eb2c491dbc0430b532d63662b789
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 1842B767F3AB03B1EB55CB04A9902B423A5AF54780F95A435C85EC63ABEF7DA514C220
                                                                                                                                                                                                                                              Function 00007FF670A755B0 Relevance: 166.5, APIs: 31, Strings: 64, Instructions: 287libraryloaderCOMMON
                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 00000019.00000002.2211089282.00007FF670A71000.00000020.00000001.01000000.0000003F.sdmp, Offset: 00007FF670A70000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 00000019.00000002.2211012606.00007FF670A70000.00000002.00000001.01000000.0000003F.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000019.00000002.2211171848.00007FF670A9A000.00000002.00000001.01000000.0000003F.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000019.00000002.2211223436.00007FF670AAD000.00000004.00000001.01000000.0000003F.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000019.00000002.2211223436.00007FF670ABC000.00000004.00000001.01000000.0000003F.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000019.00000002.2211367389.00007FF670ABE000.00000002.00000001.01000000.0000003F.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_25_2_7ff670a70000_dat.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: AddressProc$LibraryLoad
                                                                                                                                                                                                                                              • String ID: Failed to get address for Tcl_Alloc$Failed to get address for Tcl_ConditionFinalize$Failed to get address for Tcl_ConditionNotify$Failed to get address for Tcl_ConditionWait$Failed to get address for Tcl_CreateInterp$Failed to get address for Tcl_CreateObjCommand$Failed to get address for Tcl_CreateThread$Failed to get address for Tcl_DeleteInterp$Failed to get address for Tcl_DoOneEvent$Failed to get address for Tcl_EvalEx$Failed to get address for Tcl_EvalFile$Failed to get address for Tcl_EvalObjv$Failed to get address for Tcl_Finalize$Failed to get address for Tcl_FinalizeThread$Failed to get address for Tcl_FindExecutable$Failed to get address for Tcl_Free$Failed to get address for Tcl_GetCurrentThread$Failed to get address for Tcl_GetObjResult$Failed to get address for Tcl_GetString$Failed to get address for Tcl_GetVar2$Failed to get address for Tcl_Init$Failed to get address for Tcl_MutexLock$Failed to get address for Tcl_MutexUnlock$Failed to get address for Tcl_NewByteArrayObj$Failed to get address for Tcl_NewStringObj$Failed to get address for Tcl_SetVar2$Failed to get address for Tcl_SetVar2Ex$Failed to get address for Tcl_ThreadAlert$Failed to get address for Tcl_ThreadQueueEvent$Failed to get address for Tk_GetNumMainWindows$Failed to get address for Tk_Init$GetProcAddress$LOADER: Failed to load tcl/tk libraries$Tcl_Alloc$Tcl_ConditionFinalize$Tcl_ConditionNotify$Tcl_ConditionWait$Tcl_CreateInterp$Tcl_CreateObjCommand$Tcl_CreateThread$Tcl_DeleteInterp$Tcl_DoOneEvent$Tcl_EvalEx$Tcl_EvalFile$Tcl_EvalObjv$Tcl_Finalize$Tcl_FinalizeThread$Tcl_FindExecutable$Tcl_Free$Tcl_GetCurrentThread$Tcl_GetObjResult$Tcl_GetString$Tcl_GetVar2$Tcl_Init$Tcl_MutexLock$Tcl_MutexUnlock$Tcl_NewByteArrayObj$Tcl_NewStringObj$Tcl_SetVar2$Tcl_SetVar2Ex$Tcl_ThreadAlert$Tcl_ThreadQueueEvent$Tk_GetNumMainWindows$Tk_Init
                                                                                                                                                                                                                                              • API String ID: 2238633743-1453502826
                                                                                                                                                                                                                                              • Opcode ID: 45e68652b3cd2763e61bf8c7b4b9299d96d60ba340caa4760d9ec6d98f32a26d
                                                                                                                                                                                                                                              • Instruction ID: 104e02dae5c2e7907ce4c0da7c4808f484173f071cc92dc8c0f7b00e14d3c92d
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 45e68652b3cd2763e61bf8c7b4b9299d96d60ba340caa4760d9ec6d98f32a26d
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 94E1B367B3DF07B1FE15CB24A8502B423A5AF14780F94A035D84EC63AAEFBDA554C760
                                                                                                                                                                                                                                              Function 00007FF670A72030 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 120COMMON
                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 00000019.00000002.2211089282.00007FF670A71000.00000020.00000001.01000000.0000003F.sdmp, Offset: 00007FF670A70000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 00000019.00000002.2211012606.00007FF670A70000.00000002.00000001.01000000.0000003F.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000019.00000002.2211171848.00007FF670A9A000.00000002.00000001.01000000.0000003F.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000019.00000002.2211223436.00007FF670AAD000.00000004.00000001.01000000.0000003F.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000019.00000002.2211223436.00007FF670ABC000.00000004.00000001.01000000.0000003F.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000019.00000002.2211367389.00007FF670ABE000.00000002.00000001.01000000.0000003F.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_25_2_7ff670a70000_dat.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: MoveWindow$ObjectSelect$DrawReleaseText
                                                                                                                                                                                                                                              • String ID: P%
                                                                                                                                                                                                                                              • API String ID: 2147705588-2959514604
                                                                                                                                                                                                                                              • Opcode ID: 6cf46cb85abbdff361c8f4f8800dc6b6c327d34febef624f12cf28668e06a053
                                                                                                                                                                                                                                              • Instruction ID: 92630de5289b973f02755a398e57306577c79962e29868faafd00b7fa21102d0
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 6cf46cb85abbdff361c8f4f8800dc6b6c327d34febef624f12cf28668e06a053
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 8F51E7276247A186D6349F26E4181BAB7A1F798B65F004125EBCFC3795DF3CD045DB20
                                                                                                                                                                                                                                              Function 00007FF670A77410 Relevance: 15.8, APIs: 3, Strings: 6, Instructions: 52windowCOMMON
                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                              • GetLastError.KERNEL32(00000000,00007FF670A726A0), ref: 00007FF670A77437
                                                                                                                                                                                                                                              • FormatMessageW.KERNEL32(00000000,00007FF670A726A0), ref: 00007FF670A77466
                                                                                                                                                                                                                                              • WideCharToMultiByte.KERNEL32 ref: 00007FF670A774BC
                                                                                                                                                                                                                                                • Part of subcall function 00007FF670A72620: GetLastError.KERNEL32(00000000,00000000,00000000,00007FF670A776A4,?,?,?,?,?,?,?,?,?,?,?,00007FF670A7101D), ref: 00007FF670A72654
                                                                                                                                                                                                                                                • Part of subcall function 00007FF670A72620: MessageBoxW.USER32 ref: 00007FF670A7272C
                                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 00000019.00000002.2211089282.00007FF670A71000.00000020.00000001.01000000.0000003F.sdmp, Offset: 00007FF670A70000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 00000019.00000002.2211012606.00007FF670A70000.00000002.00000001.01000000.0000003F.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000019.00000002.2211171848.00007FF670A9A000.00000002.00000001.01000000.0000003F.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000019.00000002.2211223436.00007FF670AAD000.00000004.00000001.01000000.0000003F.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000019.00000002.2211223436.00007FF670ABC000.00000004.00000001.01000000.0000003F.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000019.00000002.2211367389.00007FF670ABE000.00000002.00000001.01000000.0000003F.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_25_2_7ff670a70000_dat.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: ErrorLastMessage$ByteCharFormatMultiWide
                                                                                                                                                                                                                                              • String ID: Failed to encode wchar_t as UTF-8.$FormatMessageW$No error messages generated.$PyInstaller: FormatMessageW failed.$PyInstaller: pyi_win32_utils_to_utf8 failed.$WideCharToMultiByte
                                                                                                                                                                                                                                              • API String ID: 2920928814-2573406579
                                                                                                                                                                                                                                              • Opcode ID: 904cea7669a0d8d992d4f9b78dda1624a08753575e193a6c14212660532e3fc7
                                                                                                                                                                                                                                              • Instruction ID: 4306eddf96c57f8dfdfb35475cf7df2b7d3b7e9e7a36476b45a54d187c1637f7
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 904cea7669a0d8d992d4f9b78dda1624a08753575e193a6c14212660532e3fc7
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 39217133B38A42A2F760DB10E84426A6761FF98384F845135D58DC27AAEF3CD145CB20
                                                                                                                                                                                                                                              Function 00007FF670A712B0 Relevance: 14.1, APIs: 1, Strings: 7, Instructions: 106COMMON
                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 00000019.00000002.2211089282.00007FF670A71000.00000020.00000001.01000000.0000003F.sdmp, Offset: 00007FF670A70000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 00000019.00000002.2211012606.00007FF670A70000.00000002.00000001.01000000.0000003F.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000019.00000002.2211171848.00007FF670A9A000.00000002.00000001.01000000.0000003F.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000019.00000002.2211223436.00007FF670AAD000.00000004.00000001.01000000.0000003F.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000019.00000002.2211223436.00007FF670ABC000.00000004.00000001.01000000.0000003F.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000019.00000002.2211367389.00007FF670ABE000.00000002.00000001.01000000.0000003F.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_25_2_7ff670a70000_dat.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: Message
                                                                                                                                                                                                                                              • String ID: Failed to extract %s: failed to allocate data buffer (%u bytes)!$Failed to extract %s: failed to open archive file!$Failed to extract %s: failed to read data chunk!$Failed to extract %s: failed to seek to the entry's data!$fread$fseek$malloc
                                                                                                                                                                                                                                              • API String ID: 2030045667-3659356012
                                                                                                                                                                                                                                              • Opcode ID: 757c4927ad03c06b9baf48761ea5de48c70365b256c7959639b0b9da23b47071
                                                                                                                                                                                                                                              • Instruction ID: 82beab20923f3d148001abe1010caf669fffd6dcd89ffe1cad35c30da1259a5b
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 757c4927ad03c06b9baf48761ea5de48c70365b256c7959639b0b9da23b47071
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: E6418F63B28643A1EA24DB15E4412AA63E0FF54794F44A432DE8DC7B5BEF3DE542C360
                                                                                                                                                                                                                                              Function 00007FF670A895C4 Relevance: 12.7, APIs: 3, Strings: 4, Instructions: 489COMMON
                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 00000019.00000002.2211089282.00007FF670A71000.00000020.00000001.01000000.0000003F.sdmp, Offset: 00007FF670A70000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 00000019.00000002.2211012606.00007FF670A70000.00000002.00000001.01000000.0000003F.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000019.00000002.2211171848.00007FF670A9A000.00000002.00000001.01000000.0000003F.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000019.00000002.2211223436.00007FF670AAD000.00000004.00000001.01000000.0000003F.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000019.00000002.2211223436.00007FF670ABC000.00000004.00000001.01000000.0000003F.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000019.00000002.2211367389.00007FF670ABE000.00000002.00000001.01000000.0000003F.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_25_2_7ff670a70000_dat.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: _invalid_parameter_noinfo
                                                                                                                                                                                                                                              • String ID: 0$f$p$p
                                                                                                                                                                                                                                              • API String ID: 3215553584-1202675169
                                                                                                                                                                                                                                              • Opcode ID: 216f111ad4c5b66b884b0df32855d232c2f88c8bc1f49e6a12dd5780390dcc5b
                                                                                                                                                                                                                                              • Instruction ID: 6c331e6b86f1c08e3216be50edf30c4a925eb5abc0aa2ec153fe3ba43ef46cdc
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 216f111ad4c5b66b884b0df32855d232c2f88c8bc1f49e6a12dd5780390dcc5b
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: A1129063E2C1C3AAFB265E15E044AB97691FB40754F8C4135E69AC67C6DF3CF5808B24
                                                                                                                                                                                                                                              Function 00007FF670A7DB60 Relevance: 12.6, APIs: 4, Strings: 3, Instructions: 317COMMON
                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 00000019.00000002.2211089282.00007FF670A71000.00000020.00000001.01000000.0000003F.sdmp, Offset: 00007FF670A70000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 00000019.00000002.2211012606.00007FF670A70000.00000002.00000001.01000000.0000003F.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000019.00000002.2211171848.00007FF670A9A000.00000002.00000001.01000000.0000003F.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000019.00000002.2211223436.00007FF670AAD000.00000004.00000001.01000000.0000003F.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000019.00000002.2211223436.00007FF670ABC000.00000004.00000001.01000000.0000003F.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000019.00000002.2211367389.00007FF670ABE000.00000002.00000001.01000000.0000003F.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_25_2_7ff670a70000_dat.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: BlockFrameHandler3::Unwind$CatchExecutionHandlerIs_bad_exception_allowedSearchStatestd::bad_alloc::bad_alloc
                                                                                                                                                                                                                                              • String ID: csm$csm$csm
                                                                                                                                                                                                                                              • API String ID: 849930591-393685449
                                                                                                                                                                                                                                              • Opcode ID: 7137a45c87a1c42c9297b97288d1de501ad69753d3396f0e1b378e006ad8aaa6
                                                                                                                                                                                                                                              • Instruction ID: a314df02e0adaf75d9c31140e3400c8e8518adb77e306624c4c97095835f5c5a
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 7137a45c87a1c42c9297b97288d1de501ad69753d3396f0e1b378e006ad8aaa6
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: B9E18C33A287419AEB21DF6594402AD77B0FB54798F10A135EE8DDBB9ACF38E481C710
                                                                                                                                                                                                                                              Function 00007FF670A77560 Relevance: 12.4, APIs: 2, Strings: 5, Instructions: 104COMMON
                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                              • WideCharToMultiByte.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00007FF670A7101D), ref: 00007FF670A775FF
                                                                                                                                                                                                                                              • WideCharToMultiByte.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00007FF670A7101D), ref: 00007FF670A7764F
                                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 00000019.00000002.2211089282.00007FF670A71000.00000020.00000001.01000000.0000003F.sdmp, Offset: 00007FF670A70000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 00000019.00000002.2211012606.00007FF670A70000.00000002.00000001.01000000.0000003F.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000019.00000002.2211171848.00007FF670A9A000.00000002.00000001.01000000.0000003F.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000019.00000002.2211223436.00007FF670AAD000.00000004.00000001.01000000.0000003F.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000019.00000002.2211223436.00007FF670ABC000.00000004.00000001.01000000.0000003F.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000019.00000002.2211367389.00007FF670ABE000.00000002.00000001.01000000.0000003F.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_25_2_7ff670a70000_dat.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: ByteCharMultiWide
                                                                                                                                                                                                                                              • String ID: Failed to encode wchar_t as UTF-8.$Failed to get UTF-8 buffer size.$Out of memory.$WideCharToMultiByte$win32_utils_to_utf8
                                                                                                                                                                                                                                              • API String ID: 626452242-27947307
                                                                                                                                                                                                                                              • Opcode ID: 44bd59f9cbd0c1bab7727675d44fbf1c519c8e5a350bb71af5096b05f54b9704
                                                                                                                                                                                                                                              • Instruction ID: 4b66d2325278a61600b3516ba4bdaa4c7313111472b786e9183a73f444f5ee00
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 44bd59f9cbd0c1bab7727675d44fbf1c519c8e5a350bb71af5096b05f54b9704
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: CD419233A28F82A6D620DF15B44016AB7A5FB84B90F589135DA8DC7BAADF3CD451C710
                                                                                                                                                                                                                                              Function 00007FF670A77AA0 Relevance: 12.3, APIs: 2, Strings: 5, Instructions: 63COMMON
                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                              • WideCharToMultiByte.KERNEL32(?,00007FF670A73679), ref: 00007FF670A77AE1
                                                                                                                                                                                                                                                • Part of subcall function 00007FF670A72620: GetLastError.KERNEL32(00000000,00000000,00000000,00007FF670A776A4,?,?,?,?,?,?,?,?,?,?,?,00007FF670A7101D), ref: 00007FF670A72654
                                                                                                                                                                                                                                                • Part of subcall function 00007FF670A72620: MessageBoxW.USER32 ref: 00007FF670A7272C
                                                                                                                                                                                                                                              • WideCharToMultiByte.KERNEL32(?,00007FF670A73679), ref: 00007FF670A77B55
                                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 00000019.00000002.2211089282.00007FF670A71000.00000020.00000001.01000000.0000003F.sdmp, Offset: 00007FF670A70000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 00000019.00000002.2211012606.00007FF670A70000.00000002.00000001.01000000.0000003F.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000019.00000002.2211171848.00007FF670A9A000.00000002.00000001.01000000.0000003F.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000019.00000002.2211223436.00007FF670AAD000.00000004.00000001.01000000.0000003F.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000019.00000002.2211223436.00007FF670ABC000.00000004.00000001.01000000.0000003F.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000019.00000002.2211367389.00007FF670ABE000.00000002.00000001.01000000.0000003F.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_25_2_7ff670a70000_dat.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: ByteCharMultiWide$ErrorLastMessage
                                                                                                                                                                                                                                              • String ID: Failed to encode wchar_t as UTF-8.$Failed to get UTF-8 buffer size.$Out of memory.$WideCharToMultiByte$win32_utils_to_utf8
                                                                                                                                                                                                                                              • API String ID: 3723044601-27947307
                                                                                                                                                                                                                                              • Opcode ID: b11e43d7c6d1527cb9d332ac96d423ab1dd5107057e4ee7710d1ce1ad2b4adc8
                                                                                                                                                                                                                                              • Instruction ID: 87a4151ccc7b254e6b11d9e9b58dd5382e4d2ccc39f4c0e6e0a49579eb44e355
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: b11e43d7c6d1527cb9d332ac96d423ab1dd5107057e4ee7710d1ce1ad2b4adc8
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 8A218033B38B42A5EA10DF25E84007973A1EB94B90F549136CA4EC37AAEF7CE450C750
                                                                                                                                                                                                                                              Function 00007FF670A8010C Relevance: 11.0, APIs: 3, Strings: 3, Instructions: 475COMMON
                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 00000019.00000002.2211089282.00007FF670A71000.00000020.00000001.01000000.0000003F.sdmp, Offset: 00007FF670A70000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 00000019.00000002.2211012606.00007FF670A70000.00000002.00000001.01000000.0000003F.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000019.00000002.2211171848.00007FF670A9A000.00000002.00000001.01000000.0000003F.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000019.00000002.2211223436.00007FF670AAD000.00000004.00000001.01000000.0000003F.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000019.00000002.2211223436.00007FF670ABC000.00000004.00000001.01000000.0000003F.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000019.00000002.2211367389.00007FF670ABE000.00000002.00000001.01000000.0000003F.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_25_2_7ff670a70000_dat.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: _invalid_parameter_noinfo
                                                                                                                                                                                                                                              • String ID: f$p$p
                                                                                                                                                                                                                                              • API String ID: 3215553584-1995029353
                                                                                                                                                                                                                                              • Opcode ID: e564e9ffa487f496332ad79a12679e83e89e7590c537cca4c07bc5f1831f7133
                                                                                                                                                                                                                                              • Instruction ID: 2e964f037e7c8a07ca8c7711010befca88e303810a16fe15574538d57f844c3c
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: e564e9ffa487f496332ad79a12679e83e89e7590c537cca4c07bc5f1831f7133
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: E612B223E2C1C3A6FBA69A14E054ABA76D2FB50750F844135E7D9C67C6DF7CE4808B60
                                                                                                                                                                                                                                              Function 00007FF670A77B90 Relevance: 10.6, APIs: 2, Strings: 5, Instructions: 99COMMON
                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 00000019.00000002.2211089282.00007FF670A71000.00000020.00000001.01000000.0000003F.sdmp, Offset: 00007FF670A70000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 00000019.00000002.2211012606.00007FF670A70000.00000002.00000001.01000000.0000003F.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000019.00000002.2211171848.00007FF670A9A000.00000002.00000001.01000000.0000003F.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000019.00000002.2211223436.00007FF670AAD000.00000004.00000001.01000000.0000003F.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000019.00000002.2211223436.00007FF670ABC000.00000004.00000001.01000000.0000003F.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000019.00000002.2211367389.00007FF670ABE000.00000002.00000001.01000000.0000003F.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_25_2_7ff670a70000_dat.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: ByteCharMultiWide
                                                                                                                                                                                                                                              • String ID: Failed to decode wchar_t from UTF-8$Failed to get wchar_t buffer size.$MultiByteToWideChar$Out of memory.$win32_utils_from_utf8
                                                                                                                                                                                                                                              • API String ID: 626452242-876015163
                                                                                                                                                                                                                                              • Opcode ID: a181c4653b270c240a20b71774802f78ed29fd61c7b1d57222845c1f55e9839c
                                                                                                                                                                                                                                              • Instruction ID: bd3e382267104d4c02b445e63abd85116cd653d73ad641b22a9d04f7285cdc58
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: a181c4653b270c240a20b71774802f78ed29fd61c7b1d57222845c1f55e9839c
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 2441C333B28F42A6E621DF15A84017A72A5FB48B90F549135DE8DC7BAADF3CD412C710
                                                                                                                                                                                                                                              Function 00007FF670A76440 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 88COMMON
                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                                • Part of subcall function 00007FF670A77990: MultiByteToWideChar.KERNEL32 ref: 00007FF670A779CA
                                                                                                                                                                                                                                              • ExpandEnvironmentStringsW.KERNEL32(00000000,00007FF670A7678F,?,00000000,?,TokenIntegrityLevel), ref: 00007FF670A7649F
                                                                                                                                                                                                                                                • Part of subcall function 00007FF670A72770: MessageBoxW.USER32 ref: 00007FF670A72841
                                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                                              • LOADER: Failed to expand environment variables in the runtime-tmpdir., xrefs: 00007FF670A764B3
                                                                                                                                                                                                                                              • LOADER: Failed to obtain the absolute path of the runtime-tmpdir., xrefs: 00007FF670A764FA
                                                                                                                                                                                                                                              • LOADER: Failed to convert runtime-tmpdir to a wide string., xrefs: 00007FF670A76476
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 00000019.00000002.2211089282.00007FF670A71000.00000020.00000001.01000000.0000003F.sdmp, Offset: 00007FF670A70000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 00000019.00000002.2211012606.00007FF670A70000.00000002.00000001.01000000.0000003F.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000019.00000002.2211171848.00007FF670A9A000.00000002.00000001.01000000.0000003F.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000019.00000002.2211223436.00007FF670AAD000.00000004.00000001.01000000.0000003F.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000019.00000002.2211223436.00007FF670ABC000.00000004.00000001.01000000.0000003F.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000019.00000002.2211367389.00007FF670ABE000.00000002.00000001.01000000.0000003F.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_25_2_7ff670a70000_dat.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: ByteCharEnvironmentExpandMessageMultiStringsWide
                                                                                                                                                                                                                                              • String ID: LOADER: Failed to convert runtime-tmpdir to a wide string.$LOADER: Failed to expand environment variables in the runtime-tmpdir.$LOADER: Failed to obtain the absolute path of the runtime-tmpdir.
                                                                                                                                                                                                                                              • API String ID: 1662231829-3498232454
                                                                                                                                                                                                                                              • Opcode ID: 1a78d63db9e5c5418a60acc91ec9d4210b790a3baa2768e8ac1cd5e3290d3fb6
                                                                                                                                                                                                                                              • Instruction ID: 911ea285eab520322750d61b34cfdca6b7986311b37a7f3eee5afdd9b75c9b65
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 1a78d63db9e5c5418a60acc91ec9d4210b790a3baa2768e8ac1cd5e3290d3fb6
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: F431C353B3C78271FA65A721E9153BA5291AF987C0F849036CA4EC27DFEF2CE1048720
                                                                                                                                                                                                                                              Function 00007FF670A7CE18 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 88libraryloaderCOMMONLIBRARYCODE
                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                              • LoadLibraryExW.KERNEL32(?,?,?,00007FF670A7D0CA,?,?,?,00007FF670A7CDBC,?,?,00000001,00007FF670A7C9D9), ref: 00007FF670A7CE9D
                                                                                                                                                                                                                                              • GetLastError.KERNEL32(?,?,?,00007FF670A7D0CA,?,?,?,00007FF670A7CDBC,?,?,00000001,00007FF670A7C9D9), ref: 00007FF670A7CEAB
                                                                                                                                                                                                                                              • LoadLibraryExW.KERNEL32(?,?,?,00007FF670A7D0CA,?,?,?,00007FF670A7CDBC,?,?,00000001,00007FF670A7C9D9), ref: 00007FF670A7CED5
                                                                                                                                                                                                                                              • FreeLibrary.KERNEL32(?,?,?,00007FF670A7D0CA,?,?,?,00007FF670A7CDBC,?,?,00000001,00007FF670A7C9D9), ref: 00007FF670A7CF1B
                                                                                                                                                                                                                                              • GetProcAddress.KERNEL32(?,?,?,00007FF670A7D0CA,?,?,?,00007FF670A7CDBC,?,?,00000001,00007FF670A7C9D9), ref: 00007FF670A7CF27
                                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 00000019.00000002.2211089282.00007FF670A71000.00000020.00000001.01000000.0000003F.sdmp, Offset: 00007FF670A70000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 00000019.00000002.2211012606.00007FF670A70000.00000002.00000001.01000000.0000003F.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000019.00000002.2211171848.00007FF670A9A000.00000002.00000001.01000000.0000003F.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000019.00000002.2211223436.00007FF670AAD000.00000004.00000001.01000000.0000003F.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000019.00000002.2211223436.00007FF670ABC000.00000004.00000001.01000000.0000003F.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000019.00000002.2211367389.00007FF670ABE000.00000002.00000001.01000000.0000003F.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_25_2_7ff670a70000_dat.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: Library$Load$AddressErrorFreeLastProc
                                                                                                                                                                                                                                              • String ID: api-ms-
                                                                                                                                                                                                                                              • API String ID: 2559590344-2084034818
                                                                                                                                                                                                                                              • Opcode ID: 498a46deb9e57335d1de5ef4a955cc682f3fb4b8c547d247cdb2efba5821273f
                                                                                                                                                                                                                                              • Instruction ID: 1bd39d9bb406799fc5438b73bd7263cbc8a53f5168a4c12046c724c6110b0fc6
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 498a46deb9e57335d1de5ef4a955cc682f3fb4b8c547d247cdb2efba5821273f
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: A031C823B3AB42B1EE519B06A8005752294BF08BB0F599539DD1DC7346DF3CE4418720
                                                                                                                                                                                                                                              Function 00007FF670A77990 Relevance: 10.6, APIs: 2, Strings: 5, Instructions: 68COMMON
                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                              • MultiByteToWideChar.KERNEL32 ref: 00007FF670A779CA
                                                                                                                                                                                                                                                • Part of subcall function 00007FF670A72620: GetLastError.KERNEL32(00000000,00000000,00000000,00007FF670A776A4,?,?,?,?,?,?,?,?,?,?,?,00007FF670A7101D), ref: 00007FF670A72654
                                                                                                                                                                                                                                                • Part of subcall function 00007FF670A72620: MessageBoxW.USER32 ref: 00007FF670A7272C
                                                                                                                                                                                                                                              • MultiByteToWideChar.KERNEL32 ref: 00007FF670A77A50
                                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 00000019.00000002.2211089282.00007FF670A71000.00000020.00000001.01000000.0000003F.sdmp, Offset: 00007FF670A70000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 00000019.00000002.2211012606.00007FF670A70000.00000002.00000001.01000000.0000003F.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000019.00000002.2211171848.00007FF670A9A000.00000002.00000001.01000000.0000003F.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000019.00000002.2211223436.00007FF670AAD000.00000004.00000001.01000000.0000003F.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000019.00000002.2211223436.00007FF670ABC000.00000004.00000001.01000000.0000003F.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000019.00000002.2211367389.00007FF670ABE000.00000002.00000001.01000000.0000003F.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_25_2_7ff670a70000_dat.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: ByteCharMultiWide$ErrorLastMessage
                                                                                                                                                                                                                                              • String ID: Failed to decode wchar_t from UTF-8$Failed to get wchar_t buffer size.$MultiByteToWideChar$Out of memory.$win32_utils_from_utf8
                                                                                                                                                                                                                                              • API String ID: 3723044601-876015163
                                                                                                                                                                                                                                              • Opcode ID: e4b57f199998f7b1657d81dc8f37c951294af66f0894a5466f77556df0e946e9
                                                                                                                                                                                                                                              • Instruction ID: d1097c09b221c73d949f143102512321600d846d60aa7c5374834c2245df9353
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: e4b57f199998f7b1657d81dc8f37c951294af66f0894a5466f77556df0e946e9
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 96219A23B28A4251EB50DB15F440179A3A1FF957D4F588132DB4DC3B6EEF6DD5418B10
                                                                                                                                                                                                                                              Function 00007FF670A8A960 Relevance: 10.6, APIs: 7, Instructions: 62COMMONLIBRARYCODE
                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                              • GetLastError.KERNEL32(?,?,?,00007FF670A92747,?,?,?,00007FF670A8CF10,?,?,00000000,00007FF670A8380F,?,?,?,00007FF670A89674), ref: 00007FF670A8A96F
                                                                                                                                                                                                                                              • FlsGetValue.KERNEL32(?,?,?,00007FF670A92747,?,?,?,00007FF670A8CF10,?,?,00000000,00007FF670A8380F,?,?,?,00007FF670A89674), ref: 00007FF670A8A984
                                                                                                                                                                                                                                              • FlsSetValue.KERNEL32(?,?,?,00007FF670A92747,?,?,?,00007FF670A8CF10,?,?,00000000,00007FF670A8380F,?,?,?,00007FF670A89674), ref: 00007FF670A8A9A5
                                                                                                                                                                                                                                              • FlsSetValue.KERNEL32(?,?,?,00007FF670A92747,?,?,?,00007FF670A8CF10,?,?,00000000,00007FF670A8380F,?,?,?,00007FF670A89674), ref: 00007FF670A8A9D2
                                                                                                                                                                                                                                              • FlsSetValue.KERNEL32(?,?,?,00007FF670A92747,?,?,?,00007FF670A8CF10,?,?,00000000,00007FF670A8380F,?,?,?,00007FF670A89674), ref: 00007FF670A8A9E3
                                                                                                                                                                                                                                              • FlsSetValue.KERNEL32(?,?,?,00007FF670A92747,?,?,?,00007FF670A8CF10,?,?,00000000,00007FF670A8380F,?,?,?,00007FF670A89674), ref: 00007FF670A8A9F4
                                                                                                                                                                                                                                              • SetLastError.KERNEL32(?,?,?,00007FF670A92747,?,?,?,00007FF670A8CF10,?,?,00000000,00007FF670A8380F,?,?,?,00007FF670A89674), ref: 00007FF670A8AA0F
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 00000019.00000002.2211089282.00007FF670A71000.00000020.00000001.01000000.0000003F.sdmp, Offset: 00007FF670A70000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 00000019.00000002.2211012606.00007FF670A70000.00000002.00000001.01000000.0000003F.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000019.00000002.2211171848.00007FF670A9A000.00000002.00000001.01000000.0000003F.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000019.00000002.2211223436.00007FF670AAD000.00000004.00000001.01000000.0000003F.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000019.00000002.2211223436.00007FF670ABC000.00000004.00000001.01000000.0000003F.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000019.00000002.2211367389.00007FF670ABE000.00000002.00000001.01000000.0000003F.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_25_2_7ff670a70000_dat.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: Value$ErrorLast
                                                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                                                              • API String ID: 2506987500-0
                                                                                                                                                                                                                                              • Opcode ID: 82491ca02f49234ec1e26b247981f906afbb8406f8092f357683c8b46e638aa2
                                                                                                                                                                                                                                              • Instruction ID: f4d91486e4275171706d7f4df27e6c6943b7ac13f382e0a9bdac1f26ac3becf6
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 82491ca02f49234ec1e26b247981f906afbb8406f8092f357683c8b46e638aa2
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 5E219D23F2C2C2A1FA5AA321564513962424FA87F4F140B39E97EC7BC7EF2CB4418320
                                                                                                                                                                                                                                              Function 00007FF670A96F7C Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 48fileCOMMON
                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 00000019.00000002.2211089282.00007FF670A71000.00000020.00000001.01000000.0000003F.sdmp, Offset: 00007FF670A70000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 00000019.00000002.2211012606.00007FF670A70000.00000002.00000001.01000000.0000003F.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000019.00000002.2211171848.00007FF670A9A000.00000002.00000001.01000000.0000003F.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000019.00000002.2211223436.00007FF670AAD000.00000004.00000001.01000000.0000003F.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000019.00000002.2211223436.00007FF670ABC000.00000004.00000001.01000000.0000003F.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000019.00000002.2211367389.00007FF670ABE000.00000002.00000001.01000000.0000003F.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_25_2_7ff670a70000_dat.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: ConsoleWrite$CloseCreateErrorFileHandleLast
                                                                                                                                                                                                                                              • String ID: CONOUT$
                                                                                                                                                                                                                                              • API String ID: 3230265001-3130406586
                                                                                                                                                                                                                                              • Opcode ID: 9b0c467059450527019a7bcd7e40657f3b8ea03f40c84b5b8d47b747d07757bb
                                                                                                                                                                                                                                              • Instruction ID: 3643c474133eaca636d9bf559c03a636bdd99d57b42752f0c8d237e0cdb82384
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 9b0c467059450527019a7bcd7e40657f3b8ea03f40c84b5b8d47b747d07757bb
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 46119023B38B4196E3508B06F854329A2A0FB98BE4F104235EA9DC77A5CF3DD8448760
                                                                                                                                                                                                                                              Function 00007FF670A8AAD8 Relevance: 9.1, APIs: 6, Instructions: 57COMMONLIBRARYCODE
                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                              • GetLastError.KERNEL32(?,?,?,00007FF670A841FD,?,?,?,?,00007FF670A8E147,?,?,00000000,00007FF670A8ABF6,?,?,?), ref: 00007FF670A8AAE7
                                                                                                                                                                                                                                              • FlsSetValue.KERNEL32(?,?,?,00007FF670A841FD,?,?,?,?,00007FF670A8E147,?,?,00000000,00007FF670A8ABF6,?,?,?), ref: 00007FF670A8AB1D
                                                                                                                                                                                                                                              • FlsSetValue.KERNEL32(?,?,?,00007FF670A841FD,?,?,?,?,00007FF670A8E147,?,?,00000000,00007FF670A8ABF6,?,?,?), ref: 00007FF670A8AB4A
                                                                                                                                                                                                                                              • FlsSetValue.KERNEL32(?,?,?,00007FF670A841FD,?,?,?,?,00007FF670A8E147,?,?,00000000,00007FF670A8ABF6,?,?,?), ref: 00007FF670A8AB5B
                                                                                                                                                                                                                                              • FlsSetValue.KERNEL32(?,?,?,00007FF670A841FD,?,?,?,?,00007FF670A8E147,?,?,00000000,00007FF670A8ABF6,?,?,?), ref: 00007FF670A8AB6C
                                                                                                                                                                                                                                              • SetLastError.KERNEL32(?,?,?,00007FF670A841FD,?,?,?,?,00007FF670A8E147,?,?,00000000,00007FF670A8ABF6,?,?,?), ref: 00007FF670A8AB87
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 00000019.00000002.2211089282.00007FF670A71000.00000020.00000001.01000000.0000003F.sdmp, Offset: 00007FF670A70000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 00000019.00000002.2211012606.00007FF670A70000.00000002.00000001.01000000.0000003F.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000019.00000002.2211171848.00007FF670A9A000.00000002.00000001.01000000.0000003F.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000019.00000002.2211223436.00007FF670AAD000.00000004.00000001.01000000.0000003F.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000019.00000002.2211223436.00007FF670ABC000.00000004.00000001.01000000.0000003F.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000019.00000002.2211367389.00007FF670ABE000.00000002.00000001.01000000.0000003F.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_25_2_7ff670a70000_dat.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: Value$ErrorLast
                                                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                                                              • API String ID: 2506987500-0
                                                                                                                                                                                                                                              • Opcode ID: a1c7565a82b12080a7e4a6293aba57bcc0a0246c19bd776823cb351104546e5d
                                                                                                                                                                                                                                              • Instruction ID: d3fa477beb193b3d2a80b5be8d7fe8d38d0a9d442abd27e995372aa4fb70132e
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: a1c7565a82b12080a7e4a6293aba57bcc0a0246c19bd776823cb351104546e5d
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: BE11A223B2C6C2A2FA56A321565903922425FA87B4F144734D97EC77D7DF2CF8018330
                                                                                                                                                                                                                                              Function 00007FF670A7E394 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 162COMMON
                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 00000019.00000002.2211089282.00007FF670A71000.00000020.00000001.01000000.0000003F.sdmp, Offset: 00007FF670A70000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 00000019.00000002.2211012606.00007FF670A70000.00000002.00000001.01000000.0000003F.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000019.00000002.2211171848.00007FF670A9A000.00000002.00000001.01000000.0000003F.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000019.00000002.2211223436.00007FF670AAD000.00000004.00000001.01000000.0000003F.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000019.00000002.2211223436.00007FF670ABC000.00000004.00000001.01000000.0000003F.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000019.00000002.2211367389.00007FF670ABE000.00000002.00000001.01000000.0000003F.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_25_2_7ff670a70000_dat.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: Frame$EmptyHandler3::StateUnwind__except_validate_context_record__std_exception_copy
                                                                                                                                                                                                                                              • String ID: csm$csm
                                                                                                                                                                                                                                              • API String ID: 851805269-3733052814
                                                                                                                                                                                                                                              • Opcode ID: 299de1fc68536281d3fe39e191cf3aad2c95231a45bdf52044d673f3605024c1
                                                                                                                                                                                                                                              • Instruction ID: e4464fa89648a6df01bcc986c7b7032938ea02526ca4246ddb86f12ea83407d7
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 299de1fc68536281d3fe39e191cf3aad2c95231a45bdf52044d673f3605024c1
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: E561A033928686A6EB24CF15944427977A0FB68B9CF14E135DA5CC7B9ADF3CE4A0C710
                                                                                                                                                                                                                                              Function 00007FF670A7C7D8 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 144COMMON
                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 00000019.00000002.2211089282.00007FF670A71000.00000020.00000001.01000000.0000003F.sdmp, Offset: 00007FF670A70000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 00000019.00000002.2211012606.00007FF670A70000.00000002.00000001.01000000.0000003F.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000019.00000002.2211171848.00007FF670A9A000.00000002.00000001.01000000.0000003F.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000019.00000002.2211223436.00007FF670AAD000.00000004.00000001.01000000.0000003F.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000019.00000002.2211223436.00007FF670ABC000.00000004.00000001.01000000.0000003F.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000019.00000002.2211367389.00007FF670ABE000.00000002.00000001.01000000.0000003F.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_25_2_7ff670a70000_dat.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: CurrentImageNonwritableUnwind__except_validate_context_record
                                                                                                                                                                                                                                              • String ID: csm$f
                                                                                                                                                                                                                                              • API String ID: 2395640692-629598281
                                                                                                                                                                                                                                              • Opcode ID: 2a60e48d34e2d081a64a19c3087b12e76bb296e8dfc97340c1001bb2fa126da7
                                                                                                                                                                                                                                              • Instruction ID: 1b80bb8b3695504b59afdad19468e19d443a8461f1a03383529cc61585f2c3a1
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 2a60e48d34e2d081a64a19c3087b12e76bb296e8dfc97340c1001bb2fa126da7
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 7D51D233B29602A6DB94CB15E404A293795FB84BA8F10D138DA5ED778EDF38E841C714
                                                                                                                                                                                                                                              Function 00007FF670A72240 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 81windowCOMMON
                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 00000019.00000002.2211089282.00007FF670A71000.00000020.00000001.01000000.0000003F.sdmp, Offset: 00007FF670A70000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 00000019.00000002.2211012606.00007FF670A70000.00000002.00000001.01000000.0000003F.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000019.00000002.2211171848.00007FF670A9A000.00000002.00000001.01000000.0000003F.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000019.00000002.2211223436.00007FF670AAD000.00000004.00000001.01000000.0000003F.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000019.00000002.2211223436.00007FF670ABC000.00000004.00000001.01000000.0000003F.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000019.00000002.2211367389.00007FF670ABE000.00000002.00000001.01000000.0000003F.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_25_2_7ff670a70000_dat.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: DeleteDestroyDialogHandleIconIndirectModuleObjectParam
                                                                                                                                                                                                                                              • String ID: Unhandled exception in script
                                                                                                                                                                                                                                              • API String ID: 3081866767-2699770090
                                                                                                                                                                                                                                              • Opcode ID: d06fa68a38a4eb8fcc30f5dbe48dceb4872e6e84d86a46026ce11bd39583f372
                                                                                                                                                                                                                                              • Instruction ID: 9fde94f3fdf71166cae3be14e60a77a39f560a55db0f7eb648b4ca1f5711418f
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: d06fa68a38a4eb8fcc30f5dbe48dceb4872e6e84d86a46026ce11bd39583f372
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 4C316077A28A82A9EB20DF21E8551E963A0FF88784F404135EA4DCBB9ADF3CD145C710
                                                                                                                                                                                                                                              Function 00007FF670A72620 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 67windowCOMMON
                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                              • GetLastError.KERNEL32(00000000,00000000,00000000,00007FF670A776A4,?,?,?,?,?,?,?,?,?,?,?,00007FF670A7101D), ref: 00007FF670A72654
                                                                                                                                                                                                                                                • Part of subcall function 00007FF670A77410: GetLastError.KERNEL32(00000000,00007FF670A726A0), ref: 00007FF670A77437
                                                                                                                                                                                                                                                • Part of subcall function 00007FF670A77410: FormatMessageW.KERNEL32(00000000,00007FF670A726A0), ref: 00007FF670A77466
                                                                                                                                                                                                                                                • Part of subcall function 00007FF670A77990: MultiByteToWideChar.KERNEL32 ref: 00007FF670A779CA
                                                                                                                                                                                                                                              • MessageBoxW.USER32 ref: 00007FF670A7272C
                                                                                                                                                                                                                                              • MessageBoxA.USER32 ref: 00007FF670A72748
                                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 00000019.00000002.2211089282.00007FF670A71000.00000020.00000001.01000000.0000003F.sdmp, Offset: 00007FF670A70000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 00000019.00000002.2211012606.00007FF670A70000.00000002.00000001.01000000.0000003F.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000019.00000002.2211171848.00007FF670A9A000.00000002.00000001.01000000.0000003F.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000019.00000002.2211223436.00007FF670AAD000.00000004.00000001.01000000.0000003F.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000019.00000002.2211223436.00007FF670ABC000.00000004.00000001.01000000.0000003F.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000019.00000002.2211367389.00007FF670ABE000.00000002.00000001.01000000.0000003F.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_25_2_7ff670a70000_dat.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: Message$ErrorLast$ByteCharFormatMultiWide
                                                                                                                                                                                                                                              • String ID: %s%s: %s$Fatal error detected
                                                                                                                                                                                                                                              • API String ID: 2806210788-2410924014
                                                                                                                                                                                                                                              • Opcode ID: 06cd5466942112b508e396ea70b9586e8f0482aad08493747faa49d6edf4eebc
                                                                                                                                                                                                                                              • Instruction ID: 3f644fbe743f1d4518c64a259fa96deff229a98e706d138aa2382424255e0932
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 06cd5466942112b508e396ea70b9586e8f0482aad08493747faa49d6edf4eebc
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: BE312173738682A1E620DB10E4517EA63A4FB94784F409036EA8DC7B9EDF3CD645CB50
                                                                                                                                                                                                                                              Function 00007FF670A88C44 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 27libraryloaderCOMMON
                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 00000019.00000002.2211089282.00007FF670A71000.00000020.00000001.01000000.0000003F.sdmp, Offset: 00007FF670A70000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 00000019.00000002.2211012606.00007FF670A70000.00000002.00000001.01000000.0000003F.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000019.00000002.2211171848.00007FF670A9A000.00000002.00000001.01000000.0000003F.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000019.00000002.2211223436.00007FF670AAD000.00000004.00000001.01000000.0000003F.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000019.00000002.2211223436.00007FF670ABC000.00000004.00000001.01000000.0000003F.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000019.00000002.2211367389.00007FF670ABE000.00000002.00000001.01000000.0000003F.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_25_2_7ff670a70000_dat.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: AddressFreeHandleLibraryModuleProc
                                                                                                                                                                                                                                              • String ID: CorExitProcess$mscoree.dll
                                                                                                                                                                                                                                              • API String ID: 4061214504-1276376045
                                                                                                                                                                                                                                              • Opcode ID: ff0f43bb8c2651fc19042a00c2a68c9718d43f98581b66faf951866b22fbabd4
                                                                                                                                                                                                                                              • Instruction ID: c611c2a2853651657df85d5bf52a850326a59ede3ea5301016ea36e331d2e888
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: ff0f43bb8c2651fc19042a00c2a68c9718d43f98581b66faf951866b22fbabd4
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 52F062A3B3A642A1EB108B24E85433A6320BF99761F540736CAAEC63F5CF2DD445C360
                                                                                                                                                                                                                                              Function 00007FF670A986CC Relevance: 7.6, APIs: 5, Instructions: 56COMMONLIBRARYCODE
                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 00000019.00000002.2211089282.00007FF670A71000.00000020.00000001.01000000.0000003F.sdmp, Offset: 00007FF670A70000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 00000019.00000002.2211012606.00007FF670A70000.00000002.00000001.01000000.0000003F.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000019.00000002.2211171848.00007FF670A9A000.00000002.00000001.01000000.0000003F.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000019.00000002.2211223436.00007FF670AAD000.00000004.00000001.01000000.0000003F.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000019.00000002.2211223436.00007FF670ABC000.00000004.00000001.01000000.0000003F.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000019.00000002.2211367389.00007FF670ABE000.00000002.00000001.01000000.0000003F.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_25_2_7ff670a70000_dat.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: _set_statfp
                                                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                                                              • API String ID: 1156100317-0
                                                                                                                                                                                                                                              • Opcode ID: 69d38c35bd33e64192705e47d806ebaffe6519085bb8d16871af39b095092657
                                                                                                                                                                                                                                              • Instruction ID: 755074efc04ec0cb07fd6cab3692982246a8ed6bca8221a467819cf0f9c11fea
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 69d38c35bd33e64192705e47d806ebaffe6519085bb8d16871af39b095092657
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: CC11C6B7F3CB032AFB6411A8E55237510416F54374F680A34EA7ECA7DB9F1EE8414124
                                                                                                                                                                                                                                              Function 00007FF670A8ABA0 Relevance: 7.6, APIs: 5, Instructions: 54COMMONLIBRARYCODE
                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                              • FlsGetValue.KERNEL32(?,?,?,00007FF670A89DBF,?,?,00000000,00007FF670A8A05A,?,?,?,?,?,00007FF670A8201E), ref: 00007FF670A8ABBF
                                                                                                                                                                                                                                              • FlsSetValue.KERNEL32(?,?,?,00007FF670A89DBF,?,?,00000000,00007FF670A8A05A,?,?,?,?,?,00007FF670A8201E), ref: 00007FF670A8ABDE
                                                                                                                                                                                                                                              • FlsSetValue.KERNEL32(?,?,?,00007FF670A89DBF,?,?,00000000,00007FF670A8A05A,?,?,?,?,?,00007FF670A8201E), ref: 00007FF670A8AC06
                                                                                                                                                                                                                                              • FlsSetValue.KERNEL32(?,?,?,00007FF670A89DBF,?,?,00000000,00007FF670A8A05A,?,?,?,?,?,00007FF670A8201E), ref: 00007FF670A8AC17
                                                                                                                                                                                                                                              • FlsSetValue.KERNEL32(?,?,?,00007FF670A89DBF,?,?,00000000,00007FF670A8A05A,?,?,?,?,?,00007FF670A8201E), ref: 00007FF670A8AC28
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 00000019.00000002.2211089282.00007FF670A71000.00000020.00000001.01000000.0000003F.sdmp, Offset: 00007FF670A70000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 00000019.00000002.2211012606.00007FF670A70000.00000002.00000001.01000000.0000003F.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000019.00000002.2211171848.00007FF670A9A000.00000002.00000001.01000000.0000003F.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000019.00000002.2211223436.00007FF670AAD000.00000004.00000001.01000000.0000003F.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000019.00000002.2211223436.00007FF670ABC000.00000004.00000001.01000000.0000003F.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000019.00000002.2211367389.00007FF670ABE000.00000002.00000001.01000000.0000003F.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_25_2_7ff670a70000_dat.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: Value
                                                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                                                              • API String ID: 3702945584-0
                                                                                                                                                                                                                                              • Opcode ID: 94380f9ab8d251d95a8d8ea79ebe565fb33a59bb6cd24ec569ad17321942cf24
                                                                                                                                                                                                                                              • Instruction ID: 7342c3a9b7ce5413b6cda4cea94780939c94aacc55222bbe49d2a33034c9c6c7
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 94380f9ab8d251d95a8d8ea79ebe565fb33a59bb6cd24ec569ad17321942cf24
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 9911B263F2D282A2FA5AA361564513A12416FB43B4F544738E87EC67C7DF2CF8028330
                                                                                                                                                                                                                                              Function 00007FF670A8AA34 Relevance: 7.6, APIs: 5, Instructions: 50COMMON
                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                              • FlsGetValue.KERNEL32(?,?,?,?,?,?,?,00007FF670A92747,?,?,?,00007FF670A8CF10,?,?,00000000,00007FF670A8380F), ref: 00007FF670A8AA45
                                                                                                                                                                                                                                              • FlsSetValue.KERNEL32(?,?,?,?,?,?,?,00007FF670A92747,?,?,?,00007FF670A8CF10,?,?,00000000,00007FF670A8380F), ref: 00007FF670A8AA64
                                                                                                                                                                                                                                              • FlsSetValue.KERNEL32(?,?,?,?,?,?,?,00007FF670A92747,?,?,?,00007FF670A8CF10,?,?,00000000,00007FF670A8380F), ref: 00007FF670A8AA8C
                                                                                                                                                                                                                                              • FlsSetValue.KERNEL32(?,?,?,?,?,?,?,00007FF670A92747,?,?,?,00007FF670A8CF10,?,?,00000000,00007FF670A8380F), ref: 00007FF670A8AA9D
                                                                                                                                                                                                                                              • FlsSetValue.KERNEL32(?,?,?,?,?,?,?,00007FF670A92747,?,?,?,00007FF670A8CF10,?,?,00000000,00007FF670A8380F), ref: 00007FF670A8AAAE
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 00000019.00000002.2211089282.00007FF670A71000.00000020.00000001.01000000.0000003F.sdmp, Offset: 00007FF670A70000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 00000019.00000002.2211012606.00007FF670A70000.00000002.00000001.01000000.0000003F.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000019.00000002.2211171848.00007FF670A9A000.00000002.00000001.01000000.0000003F.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000019.00000002.2211223436.00007FF670AAD000.00000004.00000001.01000000.0000003F.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000019.00000002.2211223436.00007FF670ABC000.00000004.00000001.01000000.0000003F.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000019.00000002.2211367389.00007FF670ABE000.00000002.00000001.01000000.0000003F.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_25_2_7ff670a70000_dat.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: Value
                                                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                                                              • API String ID: 3702945584-0
                                                                                                                                                                                                                                              • Opcode ID: 02e010e6fc15830288cb7bd3570cb8411669fc634165f0cae0ca52d8b326d335
                                                                                                                                                                                                                                              • Instruction ID: cb3732336f0ded3ed82aef03f10a0d3fc920a7e85c7bc616762146e54179c79a
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 02e010e6fc15830288cb7bd3570cb8411669fc634165f0cae0ca52d8b326d335
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: A9113923F28283A1FA5FA271595517A52814FA53B4F584B38D97ECA7C3EF2CB841D270
                                                                                                                                                                                                                                              Function 00007FF670A8F4D4 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 219COMMON
                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 00000019.00000002.2211089282.00007FF670A71000.00000020.00000001.01000000.0000003F.sdmp, Offset: 00007FF670A70000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 00000019.00000002.2211012606.00007FF670A70000.00000002.00000001.01000000.0000003F.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000019.00000002.2211171848.00007FF670A9A000.00000002.00000001.01000000.0000003F.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000019.00000002.2211223436.00007FF670AAD000.00000004.00000001.01000000.0000003F.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000019.00000002.2211223436.00007FF670ABC000.00000004.00000001.01000000.0000003F.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000019.00000002.2211367389.00007FF670ABE000.00000002.00000001.01000000.0000003F.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_25_2_7ff670a70000_dat.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: _invalid_parameter_noinfo
                                                                                                                                                                                                                                              • String ID: UTF-16LEUNICODE$UTF-8$ccs
                                                                                                                                                                                                                                              • API String ID: 3215553584-1196891531
                                                                                                                                                                                                                                              • Opcode ID: 0616ab0422fa9c9da61e7b81d7bd0815e3234bc6ac49e26cf25c718118b1d5e3
                                                                                                                                                                                                                                              • Instruction ID: 1026add078aef5aadf576de0e120324b3a114386865f550be2d964c9a1e3ea25
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 0616ab0422fa9c9da61e7b81d7bd0815e3234bc6ac49e26cf25c718118b1d5e3
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: FA81A473E2C2C3A5FB664F25D15027827A0EB31B48F658135DA09D73E6DF2DE9019721
                                                                                                                                                                                                                                              Function 00007FF670A7E038 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 147COMMON
                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 00000019.00000002.2211089282.00007FF670A71000.00000020.00000001.01000000.0000003F.sdmp, Offset: 00007FF670A70000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 00000019.00000002.2211012606.00007FF670A70000.00000002.00000001.01000000.0000003F.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000019.00000002.2211171848.00007FF670A9A000.00000002.00000001.01000000.0000003F.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000019.00000002.2211223436.00007FF670AAD000.00000004.00000001.01000000.0000003F.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000019.00000002.2211223436.00007FF670ABC000.00000004.00000001.01000000.0000003F.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000019.00000002.2211367389.00007FF670ABE000.00000002.00000001.01000000.0000003F.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_25_2_7ff670a70000_dat.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: CallEncodePointerTranslator
                                                                                                                                                                                                                                              • String ID: MOC$RCC
                                                                                                                                                                                                                                              • API String ID: 3544855599-2084237596
                                                                                                                                                                                                                                              • Opcode ID: 7879004664854e12467c2bd0163f26a934bd251a603f79bfcf6fe9940e12b56f
                                                                                                                                                                                                                                              • Instruction ID: f5e1104bbf505ffc2fd74468292d2b26de3bde2bff62dcda29b110839d06a1b4
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 7879004664854e12467c2bd0163f26a934bd251a603f79bfcf6fe9940e12b56f
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 6F617A33A18B859AEB10CF65D0803AD77A0FB58B8CF049225EE4D97B9ACF78E055C710
                                                                                                                                                                                                                                              Function 00007FF670A724D0 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 67windowCOMMON
                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 00000019.00000002.2211089282.00007FF670A71000.00000020.00000001.01000000.0000003F.sdmp, Offset: 00007FF670A70000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 00000019.00000002.2211012606.00007FF670A70000.00000002.00000001.01000000.0000003F.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000019.00000002.2211171848.00007FF670A9A000.00000002.00000001.01000000.0000003F.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000019.00000002.2211223436.00007FF670AAD000.00000004.00000001.01000000.0000003F.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000019.00000002.2211223436.00007FF670ABC000.00000004.00000001.01000000.0000003F.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000019.00000002.2211367389.00007FF670ABE000.00000002.00000001.01000000.0000003F.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_25_2_7ff670a70000_dat.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: Message$ByteCharMultiWide
                                                                                                                                                                                                                                              • String ID: %s%s: %s$Fatal error detected
                                                                                                                                                                                                                                              • API String ID: 1878133881-2410924014
                                                                                                                                                                                                                                              • Opcode ID: 3c570bcd5f93380f8cf11f8fb0abc6b872d4b8d8cf7d568423a648373884b94f
                                                                                                                                                                                                                                              • Instruction ID: 6df370a1daba6476afe4386597fe4ec853820980c04bba685d0e1ca14e1f3c82
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 3c570bcd5f93380f8cf11f8fb0abc6b872d4b8d8cf7d568423a648373884b94f
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: F9314F73638682A1E620E710E4517EA63A4FB94784F809036EA8DC7B9ADF3CD645CB50
                                                                                                                                                                                                                                              Function 00007FF670A73B80 Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 36COMMON
                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                              • GetModuleFileNameW.KERNEL32(?,00007FF670A73679), ref: 00007FF670A73BB1
                                                                                                                                                                                                                                                • Part of subcall function 00007FF670A72620: GetLastError.KERNEL32(00000000,00000000,00000000,00007FF670A776A4,?,?,?,?,?,?,?,?,?,?,?,00007FF670A7101D), ref: 00007FF670A72654
                                                                                                                                                                                                                                                • Part of subcall function 00007FF670A72620: MessageBoxW.USER32 ref: 00007FF670A7272C
                                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 00000019.00000002.2211089282.00007FF670A71000.00000020.00000001.01000000.0000003F.sdmp, Offset: 00007FF670A70000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 00000019.00000002.2211012606.00007FF670A70000.00000002.00000001.01000000.0000003F.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000019.00000002.2211171848.00007FF670A9A000.00000002.00000001.01000000.0000003F.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000019.00000002.2211223436.00007FF670AAD000.00000004.00000001.01000000.0000003F.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000019.00000002.2211223436.00007FF670ABC000.00000004.00000001.01000000.0000003F.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000019.00000002.2211367389.00007FF670ABE000.00000002.00000001.01000000.0000003F.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_25_2_7ff670a70000_dat.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: ErrorFileLastMessageModuleName
                                                                                                                                                                                                                                              • String ID: Failed to convert executable path to UTF-8.$Failed to get executable path.$GetModuleFileNameW
                                                                                                                                                                                                                                              • API String ID: 2581892565-1977442011
                                                                                                                                                                                                                                              • Opcode ID: f8ba9f07eefac00cb7b5b0959671e8cba28b74ac583d28598444145a4f5a2d24
                                                                                                                                                                                                                                              • Instruction ID: 74008f8a59ffc98dd09cafc681ed9a6f97690c202c7a9c99f1323bbefdcbf95a
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: f8ba9f07eefac00cb7b5b0959671e8cba28b74ac583d28598444145a4f5a2d24
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: A7014423F3D643B1FA619724D8063B91351EF98784F41A032D84EC679BEF5DE5458720
                                                                                                                                                                                                                                              Function 00007FF670A8BDE0 Relevance: 6.3, APIs: 4, Instructions: 305fileCOMMON
                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 00000019.00000002.2211089282.00007FF670A71000.00000020.00000001.01000000.0000003F.sdmp, Offset: 00007FF670A70000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 00000019.00000002.2211012606.00007FF670A70000.00000002.00000001.01000000.0000003F.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000019.00000002.2211171848.00007FF670A9A000.00000002.00000001.01000000.0000003F.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000019.00000002.2211223436.00007FF670AAD000.00000004.00000001.01000000.0000003F.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000019.00000002.2211223436.00007FF670ABC000.00000004.00000001.01000000.0000003F.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000019.00000002.2211367389.00007FF670ABE000.00000002.00000001.01000000.0000003F.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_25_2_7ff670a70000_dat.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: FileWrite$ConsoleErrorLastOutput
                                                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                                                              • API String ID: 2718003287-0
                                                                                                                                                                                                                                              • Opcode ID: 1b79c134a33bd4231d66c587d2526c3880ce128d08015e7c63db30693dd1efe9
                                                                                                                                                                                                                                              • Instruction ID: c138ce18ef262ed8548c90597a0d8582af4c253648a104f26c6781459409997b
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 1b79c134a33bd4231d66c587d2526c3880ce128d08015e7c63db30693dd1efe9
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 27D1BD23B28A85AAE712CBA9D4402AC37B1FB54798F104222DA4DD7BDADF38D456C750
                                                                                                                                                                                                                                              Function 00007FF670A959B8 Relevance: 6.2, APIs: 4, Instructions: 159COMMON
                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 00000019.00000002.2211089282.00007FF670A71000.00000020.00000001.01000000.0000003F.sdmp, Offset: 00007FF670A70000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 00000019.00000002.2211012606.00007FF670A70000.00000002.00000001.01000000.0000003F.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000019.00000002.2211171848.00007FF670A9A000.00000002.00000001.01000000.0000003F.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000019.00000002.2211223436.00007FF670AAD000.00000004.00000001.01000000.0000003F.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000019.00000002.2211223436.00007FF670ABC000.00000004.00000001.01000000.0000003F.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000019.00000002.2211367389.00007FF670ABE000.00000002.00000001.01000000.0000003F.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_25_2_7ff670a70000_dat.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: _invalid_parameter_noinfo$_get_daylight
                                                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                                                              • API String ID: 72036449-0
                                                                                                                                                                                                                                              • Opcode ID: 142d09892d70a128fabe7da41fc771e354b7d6daf49b9f9834e29c658f9ef022
                                                                                                                                                                                                                                              • Instruction ID: 084f57bb57f2800ca61780b24a31808539b375590ab560dad460ac4f64d88e7a
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 142d09892d70a128fabe7da41fc771e354b7d6daf49b9f9834e29c658f9ef022
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 7251D233F382526AFB294A38958A3796680EF40794F194235CA09C77C7DF6EE8408765
                                                                                                                                                                                                                                              Function 00007FF670A71F70 Relevance: 6.1, APIs: 4, Instructions: 52COMMON
                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 00000019.00000002.2211089282.00007FF670A71000.00000020.00000001.01000000.0000003F.sdmp, Offset: 00007FF670A70000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 00000019.00000002.2211012606.00007FF670A70000.00000002.00000001.01000000.0000003F.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000019.00000002.2211171848.00007FF670A9A000.00000002.00000001.01000000.0000003F.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000019.00000002.2211223436.00007FF670AAD000.00000004.00000001.01000000.0000003F.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000019.00000002.2211223436.00007FF670ABC000.00000004.00000001.01000000.0000003F.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000019.00000002.2211367389.00007FF670ABE000.00000002.00000001.01000000.0000003F.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_25_2_7ff670a70000_dat.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: LongWindow$DialogInvalidateRect
                                                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                                                              • API String ID: 1956198572-0
                                                                                                                                                                                                                                              • Opcode ID: 162ef6909b0da24e61350fefbcaa0130b5f771c4d53ef42d88aea1c24daf7f6c
                                                                                                                                                                                                                                              • Instruction ID: a9a6edf69499b36460bd446da5086d27624c46fbd232be35e2fdf34dec1dc614
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 162ef6909b0da24e61350fefbcaa0130b5f771c4d53ef42d88aea1c24daf7f6c
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 7111E923F3814252F650976DE5442BA1292EF99B80F44D132E949C6B8FCF2DD4C58210
                                                                                                                                                                                                                                              Function 00007FF670A94C64 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 121COMMON
                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 00000019.00000002.2211089282.00007FF670A71000.00000020.00000001.01000000.0000003F.sdmp, Offset: 00007FF670A70000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 00000019.00000002.2211012606.00007FF670A70000.00000002.00000001.01000000.0000003F.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000019.00000002.2211171848.00007FF670A9A000.00000002.00000001.01000000.0000003F.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000019.00000002.2211223436.00007FF670AAD000.00000004.00000001.01000000.0000003F.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000019.00000002.2211223436.00007FF670ABC000.00000004.00000001.01000000.0000003F.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000019.00000002.2211367389.00007FF670ABE000.00000002.00000001.01000000.0000003F.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_25_2_7ff670a70000_dat.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: _get_daylight$_invalid_parameter_noinfo
                                                                                                                                                                                                                                              • String ID: ?
                                                                                                                                                                                                                                              • API String ID: 1286766494-1684325040
                                                                                                                                                                                                                                              • Opcode ID: 69f73b520b21b0f9adcb6a2582fe92c3a8c1df3c3bf5317e1890c6602cce7a7a
                                                                                                                                                                                                                                              • Instruction ID: fa72021a3db68e440b341da1c732d1a68d9a5dfbb3239fc97120f454b24dc8db
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 69f73b520b21b0f9adcb6a2582fe92c3a8c1df3c3bf5317e1890c6602cce7a7a
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: F141F623B3868266FB219B25A40177A6790EB91BA8F104235EF5CC6BD7EF7DD4418710
                                                                                                                                                                                                                                              Function 00007FF670A881C4 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 111COMMON
                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                              • _invalid_parameter_noinfo.LIBCMT ref: 00007FF670A881F6
                                                                                                                                                                                                                                                • Part of subcall function 00007FF670A8A168: RtlFreeHeap.NTDLL(?,?,?,00007FF670A9214A,?,?,?,00007FF670A92187,?,?,00000000,00007FF670A92658,?,?,?,00007FF670A9258B), ref: 00007FF670A8A17E
                                                                                                                                                                                                                                                • Part of subcall function 00007FF670A8A168: GetLastError.KERNEL32(?,?,?,00007FF670A9214A,?,?,?,00007FF670A92187,?,?,00000000,00007FF670A92658,?,?,?,00007FF670A9258B), ref: 00007FF670A8A188
                                                                                                                                                                                                                                              • GetModuleFileNameW.KERNEL32(?,?,?,?,?,00007FF670A7AD95), ref: 00007FF670A88214
                                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 00000019.00000002.2211089282.00007FF670A71000.00000020.00000001.01000000.0000003F.sdmp, Offset: 00007FF670A70000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 00000019.00000002.2211012606.00007FF670A70000.00000002.00000001.01000000.0000003F.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000019.00000002.2211171848.00007FF670A9A000.00000002.00000001.01000000.0000003F.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000019.00000002.2211223436.00007FF670AAD000.00000004.00000001.01000000.0000003F.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000019.00000002.2211223436.00007FF670ABC000.00000004.00000001.01000000.0000003F.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000019.00000002.2211367389.00007FF670ABE000.00000002.00000001.01000000.0000003F.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_25_2_7ff670a70000_dat.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: ErrorFileFreeHeapLastModuleName_invalid_parameter_noinfo
                                                                                                                                                                                                                                              • String ID: C:\Users\user\AppData\Roaming\empyrean\dat.txt
                                                                                                                                                                                                                                              • API String ID: 3580290477-2036117455
                                                                                                                                                                                                                                              • Opcode ID: a176173fef0ccbd4d4bed4da712cca46ab69a23226048f5ac1d1c883bcbfc120
                                                                                                                                                                                                                                              • Instruction ID: b4f6b031942c78b4c6feadd5fc675a3024192edc361dadff4ce4de3a166ab179
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: a176173fef0ccbd4d4bed4da712cca46ab69a23226048f5ac1d1c883bcbfc120
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 95416F33A28B92A6EB16DF25A8400BD27A4EF45BD4F544035EA4DC7BD6DF3CE4818720
                                                                                                                                                                                                                                              Function 00007FF670A8C48C Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 100fileCOMMON
                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 00000019.00000002.2211089282.00007FF670A71000.00000020.00000001.01000000.0000003F.sdmp, Offset: 00007FF670A70000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 00000019.00000002.2211012606.00007FF670A70000.00000002.00000001.01000000.0000003F.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000019.00000002.2211171848.00007FF670A9A000.00000002.00000001.01000000.0000003F.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000019.00000002.2211223436.00007FF670AAD000.00000004.00000001.01000000.0000003F.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000019.00000002.2211223436.00007FF670ABC000.00000004.00000001.01000000.0000003F.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000019.00000002.2211367389.00007FF670ABE000.00000002.00000001.01000000.0000003F.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_25_2_7ff670a70000_dat.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: ErrorFileLastWrite
                                                                                                                                                                                                                                              • String ID: U
                                                                                                                                                                                                                                              • API String ID: 442123175-4171548499
                                                                                                                                                                                                                                              • Opcode ID: 67252725bafe0fa8bf31364f03df59fb9b2e68de5134f9a7070a1cd20fbc7f94
                                                                                                                                                                                                                                              • Instruction ID: 6449b03c510a5514b212e2f4a7403414a6d8b44243345cb48f965325055611f7
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 67252725bafe0fa8bf31364f03df59fb9b2e68de5134f9a7070a1cd20fbc7f94
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 92419323B28B81A2DB218F65E4443AA77A0FB98794F804031EE4EC7799DF3CE441CB50
                                                                                                                                                                                                                                              Function 00007FF670A8E8A8 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 66COMMON
                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 00000019.00000002.2211089282.00007FF670A71000.00000020.00000001.01000000.0000003F.sdmp, Offset: 00007FF670A70000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 00000019.00000002.2211012606.00007FF670A70000.00000002.00000001.01000000.0000003F.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000019.00000002.2211171848.00007FF670A9A000.00000002.00000001.01000000.0000003F.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000019.00000002.2211223436.00007FF670AAD000.00000004.00000001.01000000.0000003F.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000019.00000002.2211223436.00007FF670ABC000.00000004.00000001.01000000.0000003F.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000019.00000002.2211367389.00007FF670ABE000.00000002.00000001.01000000.0000003F.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_25_2_7ff670a70000_dat.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: CurrentDirectory
                                                                                                                                                                                                                                              • String ID: :
                                                                                                                                                                                                                                              • API String ID: 1611563598-336475711
                                                                                                                                                                                                                                              • Opcode ID: 16cf962f557399a5b9a88750217ef475d70c6cb8f93fcbd39997db375700c90f
                                                                                                                                                                                                                                              • Instruction ID: d8919900563090ca2563d670176005365808dc21ba883f283e4d8afbb683dbc5
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 16cf962f557399a5b9a88750217ef475d70c6cb8f93fcbd39997db375700c90f
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 3221DF33B2828291EB61DF15944426DB3A1FB94B48F458036DA8DC33C6CFBCE9458760
                                                                                                                                                                                                                                              Function 00007FF670A72770 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 55windowCOMMON
                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 00000019.00000002.2211089282.00007FF670A71000.00000020.00000001.01000000.0000003F.sdmp, Offset: 00007FF670A70000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 00000019.00000002.2211012606.00007FF670A70000.00000002.00000001.01000000.0000003F.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000019.00000002.2211171848.00007FF670A9A000.00000002.00000001.01000000.0000003F.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000019.00000002.2211223436.00007FF670AAD000.00000004.00000001.01000000.0000003F.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000019.00000002.2211223436.00007FF670ABC000.00000004.00000001.01000000.0000003F.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000019.00000002.2211367389.00007FF670ABE000.00000002.00000001.01000000.0000003F.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_25_2_7ff670a70000_dat.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: Message$ByteCharMultiWide
                                                                                                                                                                                                                                              • String ID: Fatal error detected
                                                                                                                                                                                                                                              • API String ID: 1878133881-4025702859
                                                                                                                                                                                                                                              • Opcode ID: ac47e685d134c055f7f1d81993406eeced8960994c7a98791e9bcb406dc1c58f
                                                                                                                                                                                                                                              • Instruction ID: 62aa9d2a1bb041c2289ace34006c74a64c83e144516c2a94f6e05933a7f81552
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: ac47e685d134c055f7f1d81993406eeced8960994c7a98791e9bcb406dc1c58f
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: A3218173738682A1E7609710E4517EA6354FB94788F809136EA8DC7B9ADF3CD205CB60
                                                                                                                                                                                                                                              Function 00007FF670A72880 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 55windowCOMMON
                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 00000019.00000002.2211089282.00007FF670A71000.00000020.00000001.01000000.0000003F.sdmp, Offset: 00007FF670A70000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 00000019.00000002.2211012606.00007FF670A70000.00000002.00000001.01000000.0000003F.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000019.00000002.2211171848.00007FF670A9A000.00000002.00000001.01000000.0000003F.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000019.00000002.2211223436.00007FF670AAD000.00000004.00000001.01000000.0000003F.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000019.00000002.2211223436.00007FF670ABC000.00000004.00000001.01000000.0000003F.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000019.00000002.2211367389.00007FF670ABE000.00000002.00000001.01000000.0000003F.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_25_2_7ff670a70000_dat.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: Message$ByteCharMultiWide
                                                                                                                                                                                                                                              • String ID: Error detected
                                                                                                                                                                                                                                              • API String ID: 1878133881-3513342764
                                                                                                                                                                                                                                              • Opcode ID: 18eadb67fbb2c3cbef872a99c290c15a109ae082efd03a83ae2dadf328579188
                                                                                                                                                                                                                                              • Instruction ID: 3c4f0bcf4bc2f64d21c40f48938ae41ff699e7c6013fa0a351b1b3dbf62623f8
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 18eadb67fbb2c3cbef872a99c290c15a109ae082efd03a83ae2dadf328579188
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 5F215173738682A1E7609710E4517EA6354FB94788F809136EA8DC779ADF3CD205CB60
                                                                                                                                                                                                                                              Function 00007FF670A7EED0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 42COMMON
                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 00000019.00000002.2211089282.00007FF670A71000.00000020.00000001.01000000.0000003F.sdmp, Offset: 00007FF670A70000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 00000019.00000002.2211012606.00007FF670A70000.00000002.00000001.01000000.0000003F.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000019.00000002.2211171848.00007FF670A9A000.00000002.00000001.01000000.0000003F.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000019.00000002.2211223436.00007FF670AAD000.00000004.00000001.01000000.0000003F.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000019.00000002.2211223436.00007FF670ABC000.00000004.00000001.01000000.0000003F.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000019.00000002.2211367389.00007FF670ABE000.00000002.00000001.01000000.0000003F.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_25_2_7ff670a70000_dat.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: ExceptionFileHeaderRaise
                                                                                                                                                                                                                                              • String ID: csm
                                                                                                                                                                                                                                              • API String ID: 2573137834-1018135373
                                                                                                                                                                                                                                              • Opcode ID: f2f421f33013e271a98c8c3cf8ccb065ddc751b20d67eed513ec00e007a6c83c
                                                                                                                                                                                                                                              • Instruction ID: b20752b25b1e8ceb77bef68630504a997b0a68aa61ace3f7cd6dc1543d613289
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: f2f421f33013e271a98c8c3cf8ccb065ddc751b20d67eed513ec00e007a6c83c
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: F4114F33628B4192EB118F15E44026977A4FB98B98F188231EE8D87B69DF3DD951C700
                                                                                                                                                                                                                                              Function 00007FF670A8F37C Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 34COMMON
                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 00000019.00000002.2211089282.00007FF670A71000.00000020.00000001.01000000.0000003F.sdmp, Offset: 00007FF670A70000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 00000019.00000002.2211012606.00007FF670A70000.00000002.00000001.01000000.0000003F.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000019.00000002.2211171848.00007FF670A9A000.00000002.00000001.01000000.0000003F.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000019.00000002.2211223436.00007FF670AAD000.00000004.00000001.01000000.0000003F.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000019.00000002.2211223436.00007FF670ABC000.00000004.00000001.01000000.0000003F.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000019.00000002.2211367389.00007FF670ABE000.00000002.00000001.01000000.0000003F.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_25_2_7ff670a70000_dat.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: _invalid_parameter_noinfo
                                                                                                                                                                                                                                              • String ID: :
                                                                                                                                                                                                                                              • API String ID: 3215553584-336475711
                                                                                                                                                                                                                                              • Opcode ID: b117a36f57bb58375fdb7b4df102a580f1cf3bacb37996ca0fb675bd0c3d3589
                                                                                                                                                                                                                                              • Instruction ID: 65a70ad78a3ca6e94aa168615381e1df40f909271d82d788a0e290588d6dac6b
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: b117a36f57bb58375fdb7b4df102a580f1cf3bacb37996ca0fb675bd0c3d3589
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 3001A26392C283A6F722AB60A45627E6360EF64704F801135D55EC67D6DF2CE1048B24

                                                                                                                                                                                                                                              Executed Functions

                                                                                                                                                                                                                                              Function 00007FFDFB00ED10 Relevance: 7.4, APIs: 1, Strings: 3, Instructions: 358COMMON
                                                                                                                                                                                                                                              Download Yara Rule

                                                                                                                                                                                                                                              Control-flow Graph

                                                                                                                                                                                                                                              • Executed
                                                                                                                                                                                                                                              • Not Executed
                                                                                                                                                                                                                                              control_flow_graph 1244 7ffdfb00ed10-7ffdfb00ede1 00007FFE1A4519C0 1245 7ffdfb00ede3-7ffdfb00edef call 7ffdfaf99310 1244->1245 1246 7ffdfb00edf4-7ffdfb00edfa 1244->1246 1245->1246 1248 7ffdfb00ee0d-7ffdfb00ee1c 1246->1248 1249 7ffdfb00edfc-7ffdfb00ee06 1246->1249 1250 7ffdfb00eef2-7ffdfb00eefd call 7ffdfb026d40 1248->1250 1251 7ffdfb00ee22-7ffdfb00ee28 1248->1251 1249->1248 1257 7ffdfb00ef03-7ffdfb00ef06 1250->1257 1258 7ffdfb00efa4-7ffdfb00efac call 7ffdfb047890 1250->1258 1253 7ffdfb00eeed 1251->1253 1254 7ffdfb00ee2e 1251->1254 1253->1250 1256 7ffdfb00ee31-7ffdfb00ee3d 1254->1256 1259 7ffdfb00eeaf-7ffdfb00eeba 1256->1259 1260 7ffdfb00ee3f-7ffdfb00ee43 1256->1260 1261 7ffdfb00ef14-7ffdfb00ef1b 1257->1261 1262 7ffdfb00ef08-7ffdfb00ef0e 1257->1262 1270 7ffdfb00efb1-7ffdfb00efb4 1258->1270 1266 7ffdfb00eee8 1259->1266 1267 7ffdfb00eebc-7ffdfb00eebe 1259->1267 1263 7ffdfb00ee45-7ffdfb00ee4c 1260->1263 1264 7ffdfb00ee58-7ffdfb00ee60 1260->1264 1268 7ffdfb00ef1d-7ffdfb00ef40 call 7ffdfaf991f0 call 7ffdfaf95ec0 1261->1268 1269 7ffdfb00ef45-7ffdfb00ef48 1261->1269 1262->1258 1262->1261 1263->1264 1271 7ffdfb00ee4e-7ffdfb00ee56 call 7ffdfafadc00 1263->1271 1264->1259 1272 7ffdfb00ee62-7ffdfb00ee69 1264->1272 1266->1253 1267->1256 1314 7ffdfb00f24c-7ffdfb00f27a call 7ffdfb00ea50 call 7ffdfb0b6490 1268->1314 1279 7ffdfb00ef97-7ffdfb00efa2 1269->1279 1280 7ffdfb00ef4a-7ffdfb00ef5c call 7ffdfaf95a20 1269->1280 1275 7ffdfb00efc0-7ffdfb00efcc 1270->1275 1276 7ffdfb00efb6-7ffdfb00efbd 1270->1276 1271->1264 1277 7ffdfb00ee78-7ffdfb00ee7f 1272->1277 1278 7ffdfb00ee6b-7ffdfb00ee6f 1272->1278 1287 7ffdfb00efce-7ffdfb00efda 1275->1287 1288 7ffdfb00f031-7ffdfb00f035 1275->1288 1276->1275 1282 7ffdfb00ee81-7ffdfb00ee84 1277->1282 1283 7ffdfb00ee9b 1277->1283 1278->1277 1281 7ffdfb00ee71-7ffdfb00ee76 1278->1281 1279->1270 1280->1279 1297 7ffdfb00ef5e-7ffdfb00ef95 call 7ffdfb0b7444 call 7ffdfb047890 call 7ffdfaf95600 1280->1297 1289 7ffdfb00ee9d-7ffdfb00eea1 1281->1289 1291 7ffdfb00ee92-7ffdfb00ee99 1282->1291 1292 7ffdfb00ee86-7ffdfb00ee8a 1282->1292 1283->1289 1287->1288 1296 7ffdfb00efdc-7ffdfb00efe6 1287->1296 1294 7ffdfb00f037-7ffdfb00f044 1288->1294 1295 7ffdfb00f049-7ffdfb00f04f 1288->1295 1301 7ffdfb00eea3-7ffdfb00eea6 call 7ffdfafadbd0 1289->1301 1302 7ffdfb00eeab-7ffdfb00eead 1289->1302 1291->1282 1291->1283 1292->1291 1300 7ffdfb00ee8c-7ffdfb00ee90 1292->1300 1306 7ffdfb00f166-7ffdfb00f169 1294->1306 1303 7ffdfb00f1e3-7ffdfb00f201 1295->1303 1304 7ffdfb00f055-7ffdfb00f058 1295->1304 1298 7ffdfb00eff2-7ffdfb00eff8 1296->1298 1299 7ffdfb00efe8 1296->1299 1297->1270 1308 7ffdfb00f023 1298->1308 1309 7ffdfb00effa-7ffdfb00f00c call 7ffdfaf95a20 1298->1309 1299->1298 1300->1281 1300->1291 1301->1302 1302->1259 1313 7ffdfb00eec3-7ffdfb00eee3 call 7ffdfaf991f0 1302->1313 1310 7ffdfb00f221-7ffdfb00f228 1303->1310 1311 7ffdfb00f203-7ffdfb00f20c 1303->1311 1304->1303 1317 7ffdfb00f05e-7ffdfb00f063 1304->1317 1315 7ffdfb00f184-7ffdfb00f190 1306->1315 1316 7ffdfb00f16b-7ffdfb00f172 1306->1316 1326 7ffdfb00f025-7ffdfb00f02c 1308->1326 1309->1326 1345 7ffdfb00f00e-7ffdfb00f021 call 7ffdfb0b7444 1309->1345 1310->1314 1327 7ffdfb00f22a 1310->1327 1322 7ffdfb00f20e-7ffdfb00f216 call 7ffdfafbd7a0 1311->1322 1323 7ffdfb00f218-7ffdfb00f21d 1311->1323 1313->1314 1324 7ffdfb00f192-7ffdfb00f1ab call 7ffdfaf991f0 1315->1324 1325 7ffdfb00f1b7-7ffdfb00f1c0 1315->1325 1318 7ffdfb00f174-7ffdfb00f177 call 7ffdfafc2830 1316->1318 1319 7ffdfb00f17c-7ffdfb00f17f call 7ffdfafc29a0 1316->1319 1317->1306 1329 7ffdfb00f069-7ffdfb00f070 1317->1329 1318->1319 1319->1315 1322->1310 1323->1310 1324->1310 1355 7ffdfb00f1ad-7ffdfb00f1b5 call 7ffdfaf95600 1324->1355 1336 7ffdfb00f1c2-7ffdfb00f1ca 1325->1336 1337 7ffdfb00f1d5-7ffdfb00f1e1 call 7ffdfaf99110 1325->1337 1326->1288 1341 7ffdfb00f230-7ffdfb00f24a call 7ffdfaf95600 1327->1341 1329->1306 1332 7ffdfb00f076-7ffdfb00f082 1329->1332 1332->1306 1343 7ffdfb00f088-7ffdfb00f08b 1332->1343 1336->1337 1349 7ffdfb00f1cc-7ffdfb00f1d3 1336->1349 1337->1310 1341->1314 1353 7ffdfb00f090-7ffdfb00f09f 1343->1353 1345->1326 1349->1310 1359 7ffdfb00f150-7ffdfb00f15b 1353->1359 1360 7ffdfb00f0a5-7ffdfb00f0a9 1353->1360 1355->1310 1359->1353 1367 7ffdfb00f161 1359->1367 1364 7ffdfb00f0e4-7ffdfb00f0ec 1360->1364 1365 7ffdfb00f0ab-7ffdfb00f0be call 7ffdfafb1510 1360->1365 1369 7ffdfb00f0ee-7ffdfb00f0f5 1364->1369 1370 7ffdfb00f0ff-7ffdfb00f112 1364->1370 1377 7ffdfb00f0c0-7ffdfb00f0c5 1365->1377 1378 7ffdfb00f0c7-7ffdfb00f0cf call 7ffdfaf95de0 1365->1378 1367->1306 1369->1370 1372 7ffdfb00f0f7-7ffdfb00f0fa call 7ffdfafadc00 1369->1372 1373 7ffdfb00f122-7ffdfb00f12e 1370->1373 1374 7ffdfb00f114-7ffdfb00f118 1370->1374 1372->1370 1379 7ffdfb00f130-7ffdfb00f13b call 7ffdfafec550 1373->1379 1380 7ffdfb00f143-7ffdfb00f146 1373->1380 1374->1373 1376 7ffdfb00f11a-7ffdfb00f11d call 7ffdfafadbd0 1374->1376 1376->1373 1377->1378 1382 7ffdfb00f0d7-7ffdfb00f0da 1377->1382 1378->1382 1379->1380 1380->1359 1385 7ffdfb00f148-7ffdfb00f14b call 7ffdfafb2850 1380->1385 1382->1367 1389 7ffdfb00f0e0 1382->1389 1385->1359 1389->1364
                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 0000001A.00000002.2178664284.00007FFDFAF91000.00000040.00000001.01000000.0000005A.sdmp, Offset: 00007FFDFAF90000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 0000001A.00000002.2178598986.00007FFDFAF90000.00000002.00000001.01000000.0000005A.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 0000001A.00000002.2178664284.00007FFDFB0E3000.00000040.00000001.01000000.0000005A.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 0000001A.00000002.2178664284.00007FFDFB0E5000.00000040.00000001.01000000.0000005A.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 0000001A.00000002.2178664284.00007FFDFB0FA000.00000040.00000001.01000000.0000005A.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 0000001A.00000002.2179256628.00007FFDFB0FC000.00000080.00000001.01000000.0000005A.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 0000001A.00000002.2179324969.00007FFDFB0FE000.00000004.00000001.01000000.0000005A.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_26_2_7ffdfaf90000_dat.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: 00007A4519
                                                                                                                                                                                                                                              • String ID: database schema is locked: %s$out of memory$statement too long
                                                                                                                                                                                                                                              • API String ID: 817585512-1046679716
                                                                                                                                                                                                                                              • Opcode ID: dec4629377cf51e239b68fa44690e9fead2a1752a12f013213c103b39c179074
                                                                                                                                                                                                                                              • Instruction ID: bbbe15e7bb2ab1096c4ef72cf95d6c65bf5d966ceeda55231f1f59c9eed64012
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: dec4629377cf51e239b68fa44690e9fead2a1752a12f013213c103b39c179074
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: E9F18222B0D68785FB648F219464BBA67A0FF56B98F084135DAAD077E9CF7CE441A300
                                                                                                                                                                                                                                              Function 00007FFDFAFAFF20 Relevance: 4.1, APIs: 1, Strings: 1, Instructions: 590COMMON
                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 0000001A.00000002.2178664284.00007FFDFAF91000.00000040.00000001.01000000.0000005A.sdmp, Offset: 00007FFDFAF90000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 0000001A.00000002.2178598986.00007FFDFAF90000.00000002.00000001.01000000.0000005A.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 0000001A.00000002.2178664284.00007FFDFB0E3000.00000040.00000001.01000000.0000005A.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 0000001A.00000002.2178664284.00007FFDFB0E5000.00000040.00000001.01000000.0000005A.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 0000001A.00000002.2178664284.00007FFDFB0FA000.00000040.00000001.01000000.0000005A.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 0000001A.00000002.2179256628.00007FFDFB0FC000.00000080.00000001.01000000.0000005A.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 0000001A.00000002.2179324969.00007FFDFB0FE000.00000004.00000001.01000000.0000005A.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_26_2_7ffdfaf90000_dat.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: 00007B5630
                                                                                                                                                                                                                                              • String ID: :memory:
                                                                                                                                                                                                                                              • API String ID: 2248877218-2920599690
                                                                                                                                                                                                                                              • Opcode ID: 143b806c0c83d26fe958636cc3ff90d9e8b65579401ef3cfe2339439d0e5ea09
                                                                                                                                                                                                                                              • Instruction ID: 4548f5772e420804300c780d98630b1c1e798266d526c44cc9016db3e835ce2c
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 143b806c0c83d26fe958636cc3ff90d9e8b65579401ef3cfe2339439d0e5ea09
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 1A427122B0978386EB688B259474B7927B0FF85BD4F144676EA6D4B7E8DF3CE4448700
                                                                                                                                                                                                                                              Function 00007FFDFAF9C000 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 110fileCOMMON
                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 0000001A.00000002.2178664284.00007FFDFAF91000.00000040.00000001.01000000.0000005A.sdmp, Offset: 00007FFDFAF90000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 0000001A.00000002.2178598986.00007FFDFAF90000.00000002.00000001.01000000.0000005A.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 0000001A.00000002.2178664284.00007FFDFB0E3000.00000040.00000001.01000000.0000005A.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 0000001A.00000002.2178664284.00007FFDFB0E5000.00000040.00000001.01000000.0000005A.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 0000001A.00000002.2178664284.00007FFDFB0FA000.00000040.00000001.01000000.0000005A.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 0000001A.00000002.2179256628.00007FFDFB0FC000.00000080.00000001.01000000.0000005A.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 0000001A.00000002.2179324969.00007FFDFB0FE000.00000004.00000001.01000000.0000005A.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_26_2_7ffdfaf90000_dat.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: 00007A4519FileRead
                                                                                                                                                                                                                                              • String ID: delayed %dms for lock/sharing conflict at line %d$winRead
                                                                                                                                                                                                                                              • API String ID: 857436965-1843600136
                                                                                                                                                                                                                                              • Opcode ID: c42462ee678e96c825723e9381acb87a1b22cd2c90639cf46ca189585d33ef91
                                                                                                                                                                                                                                              • Instruction ID: ef58a294a2cf593d14fb772fc2561e0e7b8bd6baf2cafdb1e1039f50ea0e23fa
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: c42462ee678e96c825723e9381acb87a1b22cd2c90639cf46ca189585d33ef91
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 68412532B09A0345E3149F25E850DA9B765FF89B98F404232FA6D877E8DF3CE8468740
                                                                                                                                                                                                                                              Function 00007FFDFAF94FB2 Relevance: 1.5, APIs: 1, Instructions: 31COMMON
                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 0000001A.00000002.2178664284.00007FFDFAF91000.00000040.00000001.01000000.0000005A.sdmp, Offset: 00007FFDFAF90000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 0000001A.00000002.2178598986.00007FFDFAF90000.00000002.00000001.01000000.0000005A.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 0000001A.00000002.2178664284.00007FFDFB0E3000.00000040.00000001.01000000.0000005A.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 0000001A.00000002.2178664284.00007FFDFB0E5000.00000040.00000001.01000000.0000005A.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 0000001A.00000002.2178664284.00007FFDFB0FA000.00000040.00000001.01000000.0000005A.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 0000001A.00000002.2179256628.00007FFDFB0FC000.00000080.00000001.01000000.0000005A.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 0000001A.00000002.2179324969.00007FFDFB0FE000.00000004.00000001.01000000.0000005A.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_26_2_7ffdfaf90000_dat.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: CriticalDeleteSection
                                                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                                                              • API String ID: 166494926-0
                                                                                                                                                                                                                                              • Opcode ID: 1081d1b58d3c0ce8abaef0f18ac1f9813f928bf0b2129ed88e879e6146ba6e88
                                                                                                                                                                                                                                              • Instruction ID: 429230af53a0dd6a5d9954176b6358e68f33b494b9db7399a86bab937703c5f4
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 1081d1b58d3c0ce8abaef0f18ac1f9813f928bf0b2129ed88e879e6146ba6e88
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 2E01CD65F0BA03C5FB599B91A874D742360BF4AB99F080A75D93E052F89F3CA4D5E600