Joe Sandbox Cloud Basic Analysis Report

Loading Joe Sandbox Report ...

Edit tour

Windows Analysis Report
dipwo1iToJ.exe

Overview

General Information

Sample name:dipwo1iToJ.exe
renamed because original name is a hash value
Original sample name:f40d72b602d086c3724048c5df9cc6f0.exe
Analysis ID:1570259
MD5:f40d72b602d086c3724048c5df9cc6f0
SHA1:1cb21b5dda39cc0101e3a140701a670981e562be
SHA256:d86949ec11d850f940b1ce58eb7a32f1381401fbb27137b6736345ce07ce4501
Tags:exeuser-abuse_ch
Infos:

Detection

Python Stealer
Score:52
Range:0 - 100
Whitelisted:false
Confidence:100%

Signatures

Multi AV Scanner detection for submitted file
Yara detected Generic Python Stealer
Contains functionality to check if a debugger is running (IsDebuggerPresent)
Contains functionality to query CPU information (cpuid)
Contains functionality which may be used to detect a debugger (GetProcessHeap)
Creates a process in suspended mode (likely to inject code)
Detected potential crypto function
Drops PE files
Enables debug privileges
Extensive use of GetProcAddress (often used to hide API calls)
Found dropped PE file which has not been started or loaded
Found evasive API chain checking for process token information
Found large amount of non-executed APIs
Found potential string decryption / allocating functions
PE file contains executable resources (Code or Archives)
PE file contains sections with non-standard names
PE file does not import any functions
Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)
Queries the volume information (name, serial number etc) of a device
Sample file is different than original file name gathered from version info

Classification

Process Tree

  • System is w10x64
  • dipwo1iToJ.exe (PID: 6864 cmdline: "C:\Users\user\Desktop\dipwo1iToJ.exe" MD5: F40D72B602D086C3724048C5DF9CC6F0)
    • dipwo1iToJ.exe (PID: 792 cmdline: "C:\Users\user\Desktop\dipwo1iToJ.exe" MD5: F40D72B602D086C3724048C5DF9CC6F0)
  • cleanup

Malware Configuration

⊘No configs have been found

Yara Signatures

Memory Dumps

SourceRuleDescriptionAuthorStrings
Process Memory Space: dipwo1iToJ.exe PID: 792JoeSecurity_GenericPythonStealerYara detected Generic Python StealerJoe Security

    Sigma Signatures

    ⊘No Sigma rule has matched

    Suricata Signatures

    ⊘No Suricata rule has matched

    Joe Sandbox Signatures

    Click to jump to signature section

    Show All Signature Results

    AV Detection

    barindex
    Multi AV Scanner detection for submitted file
    Source: dipwo1iToJ.exeReversingLabs: Detection: 52%
    Source: C:\Users\user\Desktop\dipwo1iToJ.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI68642\setuptools\_vendor\wheel-0.43.0.dist-info\LICENSE.txtJump to behavior
    Source: dipwo1iToJ.exeStatic PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, GUARD_CF, TERMINAL_SERVER_AWARE
    Source: Binary string: D:\a\1\b\bin\amd64\python312.pdb source: dipwo1iToJ.exe, 00000001.00000002.1797680341.00007FFDFB5F4000.00000002.00000001.01000000.00000004.sdmp
    Source: Binary string: D:\a\1\b\bin\amd64\unicodedata.pdb source: dipwo1iToJ.exe, 00000001.00000002.1790259151.00007FFDFAA9F000.00000002.00000001.01000000.0000001A.sdmp
    Source: Binary string: cryptography_rust.pdbc source: dipwo1iToJ.exe, 00000001.00000002.1789007887.00007FFDFA7AA000.00000002.00000001.01000000.00000029.sdmp
    Source: Binary string: @ compiler: cl /Zi /Fdossl_static.pdb /Gs0 /GF /Gy /MD /W3 /wd4090 /nologo /O2 -DL_ENDIAN -DOPENSSL_PICOpenSSL 3.0.11 19 Sep 20233.0.11built on: Wed Sep 27 22:33:28 2023 UTCplatform: VC-WIN64A-masmOPENSSLDIR: "C:\Program Files\Common Files\SSL"ENGINESDIR: "C:\Program Files\OpenSSL\lib\engines-3"MODULESDIR: "C:\Program Files\OpenSSL\lib\ossl-modules"CPUINFO: N/Anot availableget_and_lock..\s\crypto\ex_data.cossl_crypto_get_ex_new_index_exossl_crypto_new_ex_data_exCRYPTO_dup_ex_dataCRYPTO_set_ex_dataOPENSSL_WIN32_UTF8..\s\crypto\getenv.ccompiler: cl /Zi /Fdossl_static.pdb /Gs0 /GF /Gy /MD /W3 /wd4090 /nologo /O2 -DL_ENDIAN -DOPENSSL_PIC;CPUINFO: OPENSSL_ia32cap=0x%llx:0x%llxOPENSSL_ia32cap env:%sos-specificC:\Program Files\Common Files\SSLC:\Program Files\OpenSSL\lib\ossl-modules.dllCPUINFO: ..\s\crypto\init.cOPENSSL_init_cryptoOPENSSL_atexit..\s\crypto\initthread.c..\s\crypto\mem_sec.cassertion failed: (bit & 1) == 0assertion failed: list >= 0 && list < sh.freelist_sizeassertion failed: ((ptr - sh.arena) & ((sh.arena_size >> list) - 1)) == 0assertion failed: bit > 0 && bit < sh.bittable_sizeassertion failed: TESTBIT(table, bit)assertion failed: !TESTBIT(table, bit)assertion failed: WITHIN_FREELIST(list)assertion failed: WITHIN_ARENA(ptr)assertion failed: temp->next == NULL || WITHIN_ARENA(temp->next)assertion failed: (char **)temp->next->p_next == listassertion failed: WITHIN_FREELIST(temp2->p_next) || WITHIN_ARENA(temp2->p_next)assertion failed: size > 0assertion failed: (size & (size - 1)) == 0assertion failed: (minsize & (minsize - 1)) == 0assertion failed: sh.freelist != NULLassertion failed: sh.bittable != NULLassertion failed: sh.bitmalloc != NULLassertion failed: !sh_testbit(temp, slist, sh.bitmalloc)assertion failed: temp != sh.freelist[slist]assertion failed: sh.freelist[slist] == tempassertion failed: temp-(sh.arena_size >> slist) == sh_find_my_buddy(temp, slist)assertion failed: sh_testbit(chunk, list, sh.bittable)assertion failed: WITHIN_ARENA(chunk)assertion failed: sh_testbit(ptr, list, sh.bittable)assertion failed: ptr == sh_find_my_buddy(buddy, list)assertion failed: ptr != NULLassertion failed: !sh_testbit(ptr, list, sh.bitmalloc)assertion failed: sh.freelist[list] == ptr/*0123456789ABCDEFCRYPTO_memdup..\s\crypto\o_str.chexstr2buf_sepossl_hexstr2buf_sepbuf2hexstr_sepossl_buf2hexstr_sep..\s\crypto\packet.cwpacket_intern_init_lenWPACKET_start_sub_packet_len__..\s\crypto\param_build.cparam_pushparam_push_numOSSL_PARAM_BLD_push_BN_padNegative big numbers are unsupported for OSSL_PARAMOSSL_PARAM_BLD_push_utf8_stringOSSL_PARAM_BLD_push_utf8_ptrOSSL_PARAM_BLD_push_octet_stringOSSL_PARAM_BLD_push_octet_ptrOSSL_PARAM_BLD_to_param..\s\crypto\params.c source: dipwo1iToJ.exe, 00000001.00000002.1796919404.00007FFDFB092000.00000002.00000001.01000000.0000000C.sdmp
    Source: Binary string: D:\a\1\b\bin\amd64\_decimal.pdb source: _decimal.pyd.0.dr
    Source: Binary string: compiler: cl /Zi /Fdossl_static.pdb /Gs0 /GF /Gy /MD /W3 /wd4090 /nologo /O2 -DL_ENDIAN -DOPENSSL_PIC source: dipwo1iToJ.exe, 00000001.00000002.1796919404.00007FFDFB092000.00000002.00000001.01000000.0000000C.sdmp
    Source: Binary string: crypto\bn\bn_ctx.cBN_CTX_startBN_CTX_getossl_ec_group_new_excrypto\ec\ec_lib.cEC_GROUP_copyEC_GROUP_set_generatorEC_GROUP_set_curveEC_GROUP_get_curveEC_GROUP_get_degreeEC_GROUP_check_discriminantEC_POINT_newEC_POINT_copyEC_POINT_set_to_infinityEC_POINT_set_Jprojective_coordinates_GFpEC_POINT_set_affine_coordinatesEC_POINT_get_affine_coordinatesEC_POINT_addEC_POINT_dblEC_POINT_invertEC_POINT_is_at_infinityEC_POINT_is_on_curveEC_POINT_cmpEC_POINT_mulEC_GROUP_get_trinomial_basisEC_GROUP_get_pentanomial_basisgroup_new_from_nameossl_ec_group_set_paramsencodingdecoded-from-explicitEC_GROUP_new_from_paramsgeneratorcrypto\evp\digest.cevp_md_ctx_new_exevp_md_ctx_free_algctxevp_md_init_internalEVP_DigestUpdatesizeEVP_DigestFinal_exassertion failed: mdsize <= EVP_MAX_MD_SIZEEVP_DigestFinalXOFxoflenEVP_MD_CTX_copy_exEVP_MD_CTX_ctrlmicalgssl3-msblocksizexofalgid-absentevp_md_from_algorithmupdatecrypto\evp\m_sigver.cUNDEFdo_sigver_initEVP_DigestSignUpdateEVP_DigestVerifyUpdateEVP_DigestSignFinalEVP_DigestSignEVP_DigestVerifyFinalEVP_DigestVerifycompiler: cl /Zi /Fdossl_static.pdb /MT /Zl /Gs0 /GF /Gy /W3 /wd4090 /nologo /O2 -DL_ENDIAN -DOPENSSL_PIC -D"OPENSSL_BUILDING_OPENSSL" -D"OPENSSL_SYS_WIN32" -D"WIN32_LEAN_AND_MEAN" -D"UNICODE" -D"_UNICODE" -D"_CRT_SECURE_NO_DEPRECATE" -D"_WINSOCK_DEPRECATED_NO_WARNINGS" -D"NDEBUG"3.3.2built on: Fri Oct 18 00:15:00 2024 UTCplatform: VC-WIN64AOPENSSLDIR: "C:\Program Files\Common Files\SSL"ENGINESDIR: "C:\Program Files\OpenSSL\lib\engines-3"MODULESDIR: "C:\Program Files\OpenSSL\lib\ossl-modules"CPUINFO: N/Anot availablecrypto\init.cOPENSSL_init_cryptocrypto\bio\bio_lib.cBIO_new_exbio_read_internbio_write_internBIO_sendmmsgBIO_recvmmsgBIO_putsBIO_getsBIO_get_line BIO_ctrlBIO_callback_ctrlBIO_find_type source: dipwo1iToJ.exe, 00000001.00000002.1789007887.00007FFDFA7AA000.00000002.00000001.01000000.00000029.sdmp
    Source: Binary string: D:\a\1\b\bin\amd64\_overlapped.pdb source: dipwo1iToJ.exe, 00000001.00000002.1804397735.00007FFE120C6000.00000002.00000001.01000000.00000015.sdmp
    Source: Binary string: ossl_ec_GFp_simple_group_set_curvecrypto\ec\ecp_smpl.cossl_ec_GFp_simple_group_check_discriminantossl_ec_GFp_simple_point_set_affine_coordinatesossl_ec_GFp_simple_point_get_affine_coordinatesossl_ec_GFp_simple_make_affineossl_ec_GFp_simple_points_make_affineossl_ec_GFp_simple_field_invossl_ec_GFp_simple_blind_coordinatescrypto\engine\tb_digest.cENGINE_get_digestcompiler: cl /Zi /Fdossl_static.pdb /MT /Zl /Gs0 /GF /Gy /W3 /wd4090 /nologo /O2 -DL_ENDIAN -DOPENSSL_PIC -D"OPENSSL_BUILDING_OPENSSL" -D"OPENSSL_SYS_WIN32" -D"WIN32_LEAN_AND_MEAN" -D"UNICODE" -D"_UNICODE" -D"_CRT_SECURE_NO_DEPRECATE" -D"_WINSOCK_DEPRECATED_NO_WARNINGS" -D"NDEBUG";CPUINFO: OPENSSL_ia32cap=0x%llx:0x%llxOPENSSL_ia32cap env:%sos-specific.dllCPUINFO: crypto\initthread.cOPENSSL_ia32cap source: dipwo1iToJ.exe, 00000001.00000002.1789007887.00007FFDFA7AA000.00000002.00000001.01000000.00000029.sdmp
    Source: Binary string: D:\a\_work\1\s\binaries\amd64ret\bin\amd64\\vcruntime140.amd64.pdb source: dipwo1iToJ.exe, 00000000.00000003.1684977147.000001ECBC747000.00000004.00000020.00020000.00000000.sdmp, dipwo1iToJ.exe, 00000001.00000002.1804789057.00007FFE13221000.00000002.00000001.01000000.00000005.sdmp, VCRUNTIME140.dll.0.dr
    Source: Binary string: D:\a\_work\1\s\binaries\amd64ret\bin\amd64\\vcruntime140.amd64.pdbGCTL source: dipwo1iToJ.exe, 00000000.00000003.1684977147.000001ECBC747000.00000004.00000020.00020000.00000000.sdmp, dipwo1iToJ.exe, 00000001.00000002.1804789057.00007FFE13221000.00000002.00000001.01000000.00000005.sdmp, VCRUNTIME140.dll.0.dr
    Source: Binary string: D:\a\1\b\bin\amd64\sqlite3.pdb source: dipwo1iToJ.exe, 00000001.00000002.1791797724.00007FFDFABDE000.00000002.00000001.01000000.00000017.sdmp
    Source: Binary string: D:\a\pywin32\pywin32\build\temp.win-amd64-cpython-312\Release\pywintypes.pdb source: dipwo1iToJ.exe, 00000001.00000002.1799830423.00007FFE00011000.00000002.00000001.01000000.00000027.sdmp, pywintypes312.dll.0.dr
    Source: Binary string: D:\a\pywin32\pywin32\build\temp.win-amd64-cpython-312\Release\pywintypes.pdb** source: dipwo1iToJ.exe, 00000001.00000002.1799830423.00007FFE00011000.00000002.00000001.01000000.00000027.sdmp, pywintypes312.dll.0.dr
    Source: Binary string: D:\a\1\b\bin\amd64\_multiprocessing.pdb source: _multiprocessing.pyd.0.dr
    Source: Binary string: compiler: cl /Zi /Fdossl_static.pdb /MT /Zl /Gs0 /GF /Gy /W3 /wd4090 /nologo /O2 -DL_ENDIAN -DOPENSSL_PIC -D"OPENSSL_BUILDING_OPENSSL" -D"OPENSSL_SYS_WIN32" -D"WIN32_LEAN_AND_MEAN" -D"UNICODE" -D"_UNICODE" -D"_CRT_SECURE_NO_DEPRECATE" -D"_WINSOCK_DEPRECATED_NO_WARNINGS" -D"NDEBUG" source: dipwo1iToJ.exe, 00000001.00000002.1789007887.00007FFDFA7AA000.00000002.00000001.01000000.00000029.sdmp
    Source: Binary string: D:\a\_work\1\s\binaries\amd64ret\bin\amd64\\vcruntime140_1.amd64.pdb source: dipwo1iToJ.exe, 00000000.00000003.1685298094.000001ECBC747000.00000004.00000020.00020000.00000000.sdmp, dipwo1iToJ.exe, 00000001.00000002.1803196864.00007FFE11075000.00000002.00000001.01000000.00000028.sdmp, VCRUNTIME140_1.dll.0.dr
    Source: Binary string: D:\a\1\b\bin\amd64\select.pdb source: dipwo1iToJ.exe, 00000001.00000002.1804676413.00007FFE13203000.00000002.00000001.01000000.0000000E.sdmp, select.pyd.0.dr
    Source: Binary string: D:\a\1\b\bin\amd64\_ctypes.pdb source: dipwo1iToJ.exe, 00000001.00000002.1804294901.00007FFE11EE1000.00000002.00000001.01000000.00000007.sdmp, _ctypes.pyd.0.dr
    Source: Binary string: D:\a\1\b\bin\amd64\_hashlib.pdb source: dipwo1iToJ.exe, 00000001.00000002.1803442290.00007FFE11507000.00000002.00000001.01000000.0000000B.sdmp, _hashlib.pyd.0.dr
    Source: Binary string: D:\a\1\b\bin\amd64\_decimal.pdb$$ source: _decimal.pyd.0.dr
    Source: Binary string: D:\a\1\b\libssl-3.pdbEE source: dipwo1iToJ.exe, 00000001.00000002.1793377703.00007FFDFACA5000.00000002.00000001.01000000.00000013.sdmp
    Source: Binary string: D:\a\1\b\bin\amd64\_lzma.pdbNN source: dipwo1iToJ.exe, 00000001.00000002.1803578810.00007FFE1153C000.00000002.00000001.01000000.0000000A.sdmp
    Source: Binary string: D:\a\1\b\bin\amd64\_uuid.pdb source: dipwo1iToJ.exe, 00000001.00000002.1803322459.00007FFE110F2000.00000002.00000001.01000000.00000023.sdmp, _uuid.pyd.0.dr
    Source: Binary string: D:\a\1\b\bin\amd64\_asyncio.pdb source: dipwo1iToJ.exe, 00000000.00000003.1685437325.000001ECBC747000.00000004.00000020.00020000.00000000.sdmp, dipwo1iToJ.exe, 00000001.00000002.1802758529.00007FFE101D8000.00000002.00000001.01000000.00000014.sdmp, _asyncio.pyd.0.dr
    Source: Binary string: D:\a\1\b\bin\amd64\pyexpat.pdb source: dipwo1iToJ.exe, 00000001.00000002.1802907428.00007FFE10252000.00000002.00000001.01000000.00000010.sdmp, pyexpat.pyd.0.dr
    Source: Binary string: D:\a\1\b\bin\amd64\_queue.pdb source: dipwo1iToJ.exe, 00000001.00000002.1804490140.00007FFE12E13000.00000002.00000001.01000000.00000011.sdmp
    Source: Binary string: D:\a\1\b\bin\amd64\_lzma.pdb source: dipwo1iToJ.exe, 00000001.00000002.1803578810.00007FFE1153C000.00000002.00000001.01000000.0000000A.sdmp
    Source: Binary string: D:\a\1\b\bin\amd64\_bz2.pdb source: dipwo1iToJ.exe, 00000000.00000003.1685593932.000001ECBC747000.00000004.00000020.00020000.00000000.sdmp, dipwo1iToJ.exe, 00000001.00000002.1804189678.00007FFE11EBD000.00000002.00000001.01000000.00000009.sdmp
    Source: Binary string: D:\a\1\b\bin\amd64\_wmi.pdb source: dipwo1iToJ.exe, 00000001.00000002.1804584285.00007FFE130C4000.00000002.00000001.01000000.0000000F.sdmp, _wmi.pyd.0.dr
    Source: Binary string: D:\a\pywin32\pywin32\build\temp.win-amd64-cpython-312\Release\win32api.pdb!! source: dipwo1iToJ.exe, 00000001.00000002.1799958060.00007FFE00743000.00000002.00000001.01000000.00000026.sdmp, win32api.pyd.0.dr
    Source: Binary string: D:\a\pywin32\pywin32\build\temp.win-amd64-cpython-312\Release\win32api.pdb source: dipwo1iToJ.exe, 00000001.00000002.1799958060.00007FFE00743000.00000002.00000001.01000000.00000026.sdmp, win32api.pyd.0.dr
    Source: Binary string: D:\a\1\b\bin\amd64\_socket.pdb source: dipwo1iToJ.exe, 00000001.00000002.1803074322.00007FFE10309000.00000002.00000001.01000000.0000000D.sdmp, _socket.pyd.0.dr
    Source: Binary string: cryptography_rust.pdb source: dipwo1iToJ.exe, 00000001.00000002.1789007887.00007FFDFA7AA000.00000002.00000001.01000000.00000029.sdmp
    Source: Binary string: D:\a\1\b\bin\amd64\_wmi.pdb''&GCTL source: dipwo1iToJ.exe, 00000001.00000002.1804584285.00007FFE130C4000.00000002.00000001.01000000.0000000F.sdmp, _wmi.pyd.0.dr
    Source: Binary string: D:\a\1\b\bin\amd64\_sqlite3.pdb source: dipwo1iToJ.exe, 00000001.00000002.1802335498.00007FFE0EB2F000.00000002.00000001.01000000.00000016.sdmp
    Source: Binary string: D:\a\1\b\bin\amd64\python3.pdb source: dipwo1iToJ.exe, 00000001.00000002.1783720389.0000017A60550000.00000002.00000001.01000000.00000006.sdmp
    Source: Binary string: D:\a\_work\1\s\binaries\amd64ret\bin\amd64\\vcruntime140_1.amd64.pdbGCTL source: dipwo1iToJ.exe, 00000000.00000003.1685298094.000001ECBC747000.00000004.00000020.00020000.00000000.sdmp, dipwo1iToJ.exe, 00000001.00000002.1803196864.00007FFE11075000.00000002.00000001.01000000.00000028.sdmp, VCRUNTIME140_1.dll.0.dr
    Source: Binary string: D:\a\1\b\libssl-3.pdb source: dipwo1iToJ.exe, 00000001.00000002.1793377703.00007FFDFACA5000.00000002.00000001.01000000.00000013.sdmp
    Source: Binary string: D:\a\1\b\bin\amd64\_ssl.pdb source: dipwo1iToJ.exe, 00000001.00000002.1802493358.00007FFE0EB4D000.00000002.00000001.01000000.00000012.sdmp, _ssl.pyd.0.dr
    Source: C:\Users\user\Desktop\dipwo1iToJ.exeCode function: 0_2_00007FF6F8FC92F0 FindFirstFileExW,FindClose,0_2_00007FF6F8FC92F0
    Source: C:\Users\user\Desktop\dipwo1iToJ.exeCode function: 0_2_00007FF6F8FC83B0 FindFirstFileW,RemoveDirectoryW,DeleteFileW,FindNextFileW,FindClose,RemoveDirectoryW,0_2_00007FF6F8FC83B0
    Source: C:\Users\user\Desktop\dipwo1iToJ.exeCode function: 0_2_00007FF6F8FE18E4 _invalid_parameter_noinfo,FindFirstFileExW,FindNextFileW,FindClose,FindClose,0_2_00007FF6F8FE18E4
    Source: unknownTCP traffic detected without corresponding DNS query: 163.5.242.208
    Source: unknownTCP traffic detected without corresponding DNS query: 163.5.242.208
    Source: unknownTCP traffic detected without corresponding DNS query: 163.5.242.208
    Source: unknownTCP traffic detected without corresponding DNS query: 163.5.242.208
    Source: unknownTCP traffic detected without corresponding DNS query: 163.5.242.208
    Source: unknownTCP traffic detected without corresponding DNS query: 163.5.242.208
    Source: unknownTCP traffic detected without corresponding DNS query: 163.5.242.208
    Source: unknownTCP traffic detected without corresponding DNS query: 163.5.242.208
    Source: unknownTCP traffic detected without corresponding DNS query: 163.5.242.208
    Source: unknownTCP traffic detected without corresponding DNS query: 163.5.242.208
    Source: global trafficHTTP traffic detected: GET /bababa31692_token.txt HTTP/1.1Host: 163.5.242.208User-Agent: python-requests/2.32.3Accept-Encoding: gzip, deflateAccept: */*Connection: keep-alive
    Source: global trafficHTTP traffic detected: GET /7236785358_chat.txt HTTP/1.1Host: 163.5.242.208User-Agent: python-requests/2.32.3Accept-Encoding: gzip, deflateAccept: */*Connection: keep-alive
    Source: dipwo1iToJ.exe, 00000001.00000002.1785618265.0000017A61410000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: - https://www.facebook.com/groups/ equals www.facebook.com (Facebook)
    Source: dipwo1iToJ.exe, 00000001.00000002.1785618265.0000017A61410000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: d- https://www.facebook.com/groups/ equals www.facebook.com (Facebook)
    Source: dipwo1iToJ.exe, 00000001.00000003.1724114185.0000017A60DC4000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: member_countz"- https://www.facebook.com/groups/z equals www.facebook.com (Facebook)
    Source: dipwo1iToJ.exe, 00000001.00000002.1785999287.0000017A61630000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://.../back.jpeg
    Source: dipwo1iToJ.exe, 00000001.00000002.1785216227.0000017A61210000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://163.5.242.208/7236785358_chat.txt
    Source: dipwo1iToJ.exe, 00000001.00000002.1787594884.0000017A628F0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://163.5.242.208/7236785358_chat.txtPn
    Source: dipwo1iToJ.exe, 00000001.00000002.1787594884.0000017A628F0000.00000004.00001000.00020000.00000000.sdmp, dipwo1iToJ.exe, 00000001.00000002.1785216227.0000017A61210000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://163.5.242.208/bababa31692_token.txt
    Source: dipwo1iToJ.exe, 00000001.00000002.1785216227.0000017A61210000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://163.5.242.208/bababa31692_token.txtsl-modulesd
    Source: dipwo1iToJ.exe, 00000001.00000003.1724378756.0000017A60DC1000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://163.5.242.208/bababa31692_token.txtz(http://163.5.242.208/7236785358_chat.txtc
    Source: dipwo1iToJ.exe, 00000001.00000002.1786434698.0000017A61A00000.00000004.00000020.00020000.00000000.sdmp, dipwo1iToJ.exe, 00000001.00000002.1786434698.0000017A61B3A000.00000004.00000020.00020000.00000000.sdmp, dipwo1iToJ.exe, 00000001.00000002.1786218480.0000017A618FE000.00000004.00000020.00020000.00000000.sdmp, dipwo1iToJ.exe, 00000001.00000002.1784723256.0000017A60E9F000.00000004.00000020.00020000.00000000.sdmp, dipwo1iToJ.exe, 00000001.00000002.1786434698.0000017A619AE000.00000004.00000020.00020000.00000000.sdmp, dipwo1iToJ.exe, 00000001.00000002.1786607711.0000017A61B7E000.00000004.00000020.00020000.00000000.sdmp, dipwo1iToJ.exe, 00000001.00000002.1783821326.0000017A606CD000.00000004.00000020.00020000.00000000.sdmp, dipwo1iToJ.exe, 00000001.00000002.1784723256.0000017A60E63000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://blog.cryptographyengineering.com/2012/05/how-to-choose-authenticated-encryption.html
    Source: dipwo1iToJ.exe, 00000000.00000003.1685437325.000001ECBC747000.00000004.00000020.00020000.00000000.sdmp, dipwo1iToJ.exe, 00000000.00000003.1685593932.000001ECBC747000.00000004.00000020.00020000.00000000.sdmp, select.pyd.0.dr, _wmi.pyd.0.dr, _uuid.pyd.0.dr, _decimal.pyd.0.dr, libffi-8.dll.0.dr, _socket.pyd.0.dr, _ssl.pyd.0.dr, pyexpat.pyd.0.dr, _ctypes.pyd.0.dr, _multiprocessing.pyd.0.dr, _hashlib.pyd.0.dr, _asyncio.pyd.0.drString found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E
    Source: dipwo1iToJ.exe, 00000000.00000003.1685437325.000001ECBC747000.00000004.00000020.00020000.00000000.sdmp, dipwo1iToJ.exe, 00000000.00000003.1685593932.000001ECBC747000.00000004.00000020.00020000.00000000.sdmp, select.pyd.0.dr, _wmi.pyd.0.dr, _uuid.pyd.0.dr, _decimal.pyd.0.dr, libffi-8.dll.0.dr, _socket.pyd.0.dr, _ssl.pyd.0.dr, pyexpat.pyd.0.dr, _ctypes.pyd.0.dr, _multiprocessing.pyd.0.dr, _hashlib.pyd.0.dr, _asyncio.pyd.0.drString found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crt0
    Source: dipwo1iToJ.exe, 00000000.00000003.1685437325.000001ECBC747000.00000004.00000020.00020000.00000000.sdmp, dipwo1iToJ.exe, 00000000.00000003.1685593932.000001ECBC747000.00000004.00000020.00020000.00000000.sdmp, select.pyd.0.dr, _wmi.pyd.0.dr, _uuid.pyd.0.dr, _decimal.pyd.0.dr, libffi-8.dll.0.dr, _socket.pyd.0.dr, _ssl.pyd.0.dr, pyexpat.pyd.0.dr, _ctypes.pyd.0.dr, _multiprocessing.pyd.0.dr, _hashlib.pyd.0.dr, _asyncio.pyd.0.drString found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0
    Source: dipwo1iToJ.exe, 00000000.00000003.1685437325.000001ECBC747000.00000004.00000020.00020000.00000000.sdmp, dipwo1iToJ.exe, 00000000.00000003.1685593932.000001ECBC747000.00000004.00000020.00020000.00000000.sdmp, select.pyd.0.dr, _wmi.pyd.0.dr, _uuid.pyd.0.dr, _decimal.pyd.0.dr, libffi-8.dll.0.dr, _socket.pyd.0.dr, _ssl.pyd.0.dr, pyexpat.pyd.0.dr, _ctypes.pyd.0.dr, _multiprocessing.pyd.0.dr, _hashlib.pyd.0.dr, _asyncio.pyd.0.drString found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
    Source: dipwo1iToJ.exe, 00000001.00000002.1784330278.0000017A60BB5000.00000004.00000020.00020000.00000000.sdmp, dipwo1iToJ.exe, 00000001.00000002.1784232573.0000017A60AD0000.00000004.00000020.00020000.00000000.sdmp, dipwo1iToJ.exe, 00000001.00000003.1720406212.0000017A6071E000.00000004.00000020.00020000.00000000.sdmp, dipwo1iToJ.exe, 00000001.00000003.1722143244.0000017A6071E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://code.activestate.com/recipes/577452-a-memoize-decorator-for-instance-methods/
    Source: dipwo1iToJ.exe, 00000001.00000003.1720054100.0000017A60C27000.00000004.00000020.00020000.00000000.sdmp, dipwo1iToJ.exe, 00000001.00000002.1784232573.0000017A60AD0000.00000004.00000020.00020000.00000000.sdmp, dipwo1iToJ.exe, 00000001.00000003.1719700729.0000017A60BBD000.00000004.00000020.00020000.00000000.sdmp, dipwo1iToJ.exe, 00000001.00000003.1719700729.0000017A60C0D000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://code.activestate.com/recipes/577916/
    Source: dipwo1iToJ.exe, 00000001.00000002.1786218480.0000017A618FE000.00000004.00000020.00020000.00000000.sdmp, dipwo1iToJ.exe, 00000001.00000002.1784330278.0000017A60C65000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl.certigna.fr/certignarootca.crl01
    Source: dipwo1iToJ.exe, 00000001.00000002.1784330278.0000017A60C65000.00000004.00000020.00020000.00000000.sdmp, dipwo1iToJ.exe, 00000001.00000002.1783601146.0000017A60450000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl.comodoca.com/AAACertificateServices.crl06
    Source: dipwo1iToJ.exe, 00000001.00000002.1784330278.0000017A60D81000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl.comodoca.com/COMODOCertificationAuthority.crl
    Source: dipwo1iToJ.exe, 00000001.00000002.1786218480.0000017A618FE000.00000004.00000020.00020000.00000000.sdmp, dipwo1iToJ.exe, 00000001.00000002.1784330278.0000017A60C65000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl.dhimyotis.com/certignarootca.crl
    Source: dipwo1iToJ.exe, 00000001.00000002.1786218480.0000017A618A8000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl.securetrust.com/SGCA.crl
    Source: dipwo1iToJ.exe, 00000001.00000002.1784232573.0000017A60AD0000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl.securetrust.com/SGCA.crl0
    Source: dipwo1iToJ.exe, 00000001.00000002.1786218480.0000017A618A8000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl.securetrust.com/STCA.crl
    Source: dipwo1iToJ.exe, 00000001.00000002.1784232573.0000017A60AD0000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl.securetrust.com/STCA.crl0
    Source: dipwo1iToJ.exe, 00000001.00000002.1786218480.0000017A618A8000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl.xrampsecurity.com/XGCA.crl
    Source: dipwo1iToJ.exe, 00000001.00000002.1784330278.0000017A60C65000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl.xrampsecurity.com/XGCA.crl0
    Source: dipwo1iToJ.exe, 00000000.00000003.1685437325.000001ECBC747000.00000004.00000020.00020000.00000000.sdmp, dipwo1iToJ.exe, 00000000.00000003.1685593932.000001ECBC747000.00000004.00000020.00020000.00000000.sdmp, select.pyd.0.dr, _wmi.pyd.0.dr, _uuid.pyd.0.dr, _decimal.pyd.0.dr, libffi-8.dll.0.dr, _socket.pyd.0.dr, _ssl.pyd.0.dr, pyexpat.pyd.0.dr, _ctypes.pyd.0.dr, _multiprocessing.pyd.0.dr, _hashlib.pyd.0.dr, _asyncio.pyd.0.drString found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0
    Source: dipwo1iToJ.exe, 00000000.00000003.1685437325.000001ECBC747000.00000004.00000020.00020000.00000000.sdmp, dipwo1iToJ.exe, 00000000.00000003.1685593932.000001ECBC747000.00000004.00000020.00020000.00000000.sdmp, select.pyd.0.dr, _wmi.pyd.0.dr, _uuid.pyd.0.dr, _decimal.pyd.0.dr, libffi-8.dll.0.dr, _socket.pyd.0.dr, _ssl.pyd.0.dr, pyexpat.pyd.0.dr, _ctypes.pyd.0.dr, _multiprocessing.pyd.0.dr, _hashlib.pyd.0.dr, _asyncio.pyd.0.drString found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0S
    Source: dipwo1iToJ.exe, 00000000.00000003.1685437325.000001ECBC747000.00000004.00000020.00020000.00000000.sdmp, dipwo1iToJ.exe, 00000000.00000003.1685593932.000001ECBC747000.00000004.00000020.00020000.00000000.sdmp, select.pyd.0.dr, _wmi.pyd.0.dr, _uuid.pyd.0.dr, _decimal.pyd.0.dr, libffi-8.dll.0.dr, _socket.pyd.0.dr, _ssl.pyd.0.dr, pyexpat.pyd.0.dr, _ctypes.pyd.0.dr, _multiprocessing.pyd.0.dr, _hashlib.pyd.0.dr, _asyncio.pyd.0.drString found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0
    Source: _asyncio.pyd.0.drString found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
    Source: dipwo1iToJ.exe, 00000000.00000003.1685437325.000001ECBC747000.00000004.00000020.00020000.00000000.sdmp, dipwo1iToJ.exe, 00000000.00000003.1685593932.000001ECBC747000.00000004.00000020.00020000.00000000.sdmp, select.pyd.0.dr, _wmi.pyd.0.dr, _uuid.pyd.0.dr, _decimal.pyd.0.dr, libffi-8.dll.0.dr, _socket.pyd.0.dr, _ssl.pyd.0.dr, pyexpat.pyd.0.dr, _ctypes.pyd.0.dr, _multiprocessing.pyd.0.dr, _hashlib.pyd.0.dr, _asyncio.pyd.0.drString found in binary or memory: http://crl4.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0
    Source: dipwo1iToJ.exe, 00000001.00000002.1786607711.0000017A61B7E000.00000004.00000020.00020000.00000000.sdmp, dipwo1iToJ.exe, 00000001.00000002.1783821326.0000017A606CD000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://csrc.nist.gov/groups/ST/toolkit/BCM/documents/proposedmodes/eax/eax-spec.pdf
    Source: dipwo1iToJ.exe, 00000001.00000002.1786434698.0000017A61A00000.00000004.00000020.00020000.00000000.sdmp, dipwo1iToJ.exe, 00000001.00000002.1784723256.0000017A60E9F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://csrc.nist.gov/publications/nistpubs/800-38C/SP800-38C.pdf
    Source: dipwo1iToJ.exe, 00000001.00000002.1786218480.0000017A618FE000.00000004.00000020.00020000.00000000.sdmp, dipwo1iToJ.exe, 00000001.00000002.1784723256.0000017A60E63000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://csrc.nist.gov/publications/nistpubs/800-38D/SP-800-38D.pdf
    Source: dipwo1iToJ.exe, 00000001.00000002.1786434698.0000017A61A00000.00000004.00000020.00020000.00000000.sdmp, dipwo1iToJ.exe, 00000001.00000002.1786434698.0000017A61B3A000.00000004.00000020.00020000.00000000.sdmp, dipwo1iToJ.exe, 00000001.00000002.1784330278.0000017A60D81000.00000004.00000020.00020000.00000000.sdmp, dipwo1iToJ.exe, 00000001.00000002.1787439688.0000017A622D0000.00000004.00001000.00020000.00000000.sdmp, dipwo1iToJ.exe, 00000001.00000002.1787297845.0000017A62090000.00000004.00001000.00020000.00000000.sdmp, dipwo1iToJ.exe, 00000001.00000002.1786434698.0000017A619AE000.00000004.00000020.00020000.00000000.sdmp, dipwo1iToJ.exe, 00000001.00000002.1785999287.0000017A61630000.00000004.00001000.00020000.00000000.sdmp, dipwo1iToJ.exe, 00000001.00000002.1784330278.0000017A60C65000.00000004.00000020.00020000.00000000.sdmp, dipwo1iToJ.exe, 00000001.00000002.1787515881.0000017A62710000.00000004.00001000.00020000.00000000.sdmp, dipwo1iToJ.exe, 00000001.00000002.1786607711.0000017A61B7E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://csrc.nist.gov/publications/nistpubs/800-38a/sp800-38a.pdf
    Source: dipwo1iToJ.exe, 00000001.00000002.1785999287.0000017A61630000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://curl.haxx.se/rfc/cookie_spec.html
    Source: dipwo1iToJ.exe, 00000001.00000002.1785801228.0000017A61510000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://docs.python.org/3/library/subprocess#subprocess.Popen.kill
    Source: dipwo1iToJ.exe, 00000001.00000002.1785618265.0000017A61410000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://docs.python.org/3/library/subprocess#subprocess.Popen.returncode
    Source: dipwo1iToJ.exe, 00000001.00000002.1785618265.0000017A61410000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://docs.python.org/3/library/subprocess#subprocess.Popen.terminate
    Source: dipwo1iToJ.exe, 00000001.00000002.1784965590.0000017A60FF0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://docs.python.org/library/itertools.html#recipes
    Source: dipwo1iToJ.exe, 00000001.00000002.1784965590.0000017A60FF0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://foo/bar.tar.gz
    Source: dipwo1iToJ.exe, 00000001.00000002.1784965590.0000017A60FF0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://foo/bar.tgz
    Source: dipwo1iToJ.exe, 00000001.00000002.1787439688.0000017A622D0000.00000004.00001000.00020000.00000000.sdmp, dipwo1iToJ.exe, 00000001.00000002.1784723256.0000017A60E9F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://goo.gl/zeJZl.
    Source: dipwo1iToJ.exe, 00000001.00000002.1784330278.0000017A60C65000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://google.com/
    Source: dipwo1iToJ.exe, 00000001.00000002.1783821326.0000017A6071E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://google.com/mail/
    Source: dipwo1iToJ.exe, 00000001.00000002.1784330278.0000017A60D81000.00000004.00000020.00020000.00000000.sdmp, dipwo1iToJ.exe, 00000001.00000002.1784330278.0000017A60C65000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://hg.python.org/cpython/file/603b4d593758/Lib/socket.py#l535
    Source: dipwo1iToJ.exe, 00000001.00000002.1786434698.0000017A61A00000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://httpbin.org/post
    Source: dipwo1iToJ.exe, 00000001.00000002.1785618265.0000017A61410000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://ip-api.com/json
    Source: dipwo1iToJ.exe, 00000001.00000003.1724114185.0000017A60DC4000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://ip-api.com/jsonr
    Source: dipwo1iToJ.exe, 00000001.00000002.1786434698.0000017A61A00000.00000004.00000020.00020000.00000000.sdmp, dipwo1iToJ.exe, 00000001.00000002.1787439688.0000017A622D0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://mail.python.org/pipermail/python-dev/2012-June/120787.html.
    Source: dipwo1iToJ.exe, 00000001.00000002.1786218480.0000017A618FE000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://ocsp.accv.es
    Source: dipwo1iToJ.exe, 00000001.00000002.1786218480.0000017A618A8000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://ocsp.accv.es0
    Source: dipwo1iToJ.exe, 00000000.00000003.1685437325.000001ECBC747000.00000004.00000020.00020000.00000000.sdmp, dipwo1iToJ.exe, 00000000.00000003.1685593932.000001ECBC747000.00000004.00000020.00020000.00000000.sdmp, select.pyd.0.dr, _wmi.pyd.0.dr, _uuid.pyd.0.dr, _decimal.pyd.0.dr, libffi-8.dll.0.dr, _socket.pyd.0.dr, _ssl.pyd.0.dr, pyexpat.pyd.0.dr, _ctypes.pyd.0.dr, _multiprocessing.pyd.0.dr, _hashlib.pyd.0.dr, _asyncio.pyd.0.drString found in binary or memory: http://ocsp.digicert.com0
    Source: dipwo1iToJ.exe, 00000000.00000003.1685437325.000001ECBC747000.00000004.00000020.00020000.00000000.sdmp, dipwo1iToJ.exe, 00000000.00000003.1685593932.000001ECBC747000.00000004.00000020.00020000.00000000.sdmp, select.pyd.0.dr, _wmi.pyd.0.dr, _uuid.pyd.0.dr, _decimal.pyd.0.dr, libffi-8.dll.0.dr, _socket.pyd.0.dr, _ssl.pyd.0.dr, pyexpat.pyd.0.dr, _ctypes.pyd.0.dr, _multiprocessing.pyd.0.dr, _hashlib.pyd.0.dr, _asyncio.pyd.0.drString found in binary or memory: http://ocsp.digicert.com0A
    Source: dipwo1iToJ.exe, 00000000.00000003.1685437325.000001ECBC747000.00000004.00000020.00020000.00000000.sdmp, dipwo1iToJ.exe, 00000000.00000003.1685593932.000001ECBC747000.00000004.00000020.00020000.00000000.sdmp, select.pyd.0.dr, _wmi.pyd.0.dr, _uuid.pyd.0.dr, _decimal.pyd.0.dr, libffi-8.dll.0.dr, _socket.pyd.0.dr, _ssl.pyd.0.dr, pyexpat.pyd.0.dr, _ctypes.pyd.0.dr, _multiprocessing.pyd.0.dr, _hashlib.pyd.0.dr, _asyncio.pyd.0.drString found in binary or memory: http://ocsp.digicert.com0C
    Source: dipwo1iToJ.exe, 00000000.00000003.1685437325.000001ECBC747000.00000004.00000020.00020000.00000000.sdmp, dipwo1iToJ.exe, 00000000.00000003.1685593932.000001ECBC747000.00000004.00000020.00020000.00000000.sdmp, select.pyd.0.dr, _wmi.pyd.0.dr, _uuid.pyd.0.dr, _decimal.pyd.0.dr, libffi-8.dll.0.dr, _socket.pyd.0.dr, _ssl.pyd.0.dr, pyexpat.pyd.0.dr, _ctypes.pyd.0.dr, _multiprocessing.pyd.0.dr, _hashlib.pyd.0.dr, _asyncio.pyd.0.drString found in binary or memory: http://ocsp.digicert.com0X
    Source: dipwo1iToJ.exe, 00000001.00000002.1784148989.0000017A609A0000.00000004.00001000.00020000.00000000.sdmp, dipwo1iToJ.exe, 00000001.00000002.1784874976.0000017A60ED0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://opensource.apple.com/source/CF/CF-744.18/CFBinaryPList.c
    Source: dipwo1iToJ.exe, 00000001.00000002.1786135596.0000017A61780000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://python.org
    Source: dipwo1iToJ.exe, 00000001.00000002.1786434698.0000017A619AE000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://python.org/
    Source: dipwo1iToJ.exe, 00000001.00000002.1786135596.0000017A61780000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://python.org:80
    Source: dipwo1iToJ.exe, 00000001.00000002.1783821326.0000017A6071E000.00000004.00000020.00020000.00000000.sdmp, dipwo1iToJ.exe, 00000001.00000002.1784330278.0000017A60D81000.00000004.00000020.00020000.00000000.sdmp, dipwo1iToJ.exe, 00000001.00000002.1784330278.0000017A60BB5000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://repository.swisssign.com/
    Source: dipwo1iToJ.exe, 00000001.00000002.1784330278.0000017A60D81000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://repository.swisssign.com/0
    Source: dipwo1iToJ.exe, 00000001.00000002.1786434698.0000017A61A00000.00000004.00000020.00020000.00000000.sdmp, dipwo1iToJ.exe, 00000001.00000002.1786434698.0000017A61B3A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://tools.ietf.org/html/rfc4880
    Source: dipwo1iToJ.exe, 00000001.00000002.1787515881.0000017A62710000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://tools.ietf.org/html/rfc5297
    Source: dipwo1iToJ.exe, 00000001.00000002.1784330278.0000017A60C65000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://tools.ietf.org/html/rfc5869
    Source: dipwo1iToJ.exe, 00000001.00000002.1785999287.0000017A61630000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://tools.ietf.org/html/rfc6125#section-6.4.3
    Source: dipwo1iToJ.exe, 00000001.00000002.1786434698.0000017A61B3A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://web.cs.ucdavis.edu/~rogaway/ocb/license.htm
    Source: dipwo1iToJ.exe, 00000001.00000002.1786218480.0000017A618FE000.00000004.00000020.00020000.00000000.sdmp, dipwo1iToJ.exe, 00000001.00000002.1786218480.0000017A618A8000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.accv.es/fileadmin/Archivos/certificados/raizaccv1.crt0
    Source: dipwo1iToJ.exe, 00000001.00000002.1786218480.0000017A618A8000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.accv.es/fileadmin/Archivos/certificados/raizaccv1_der.crl
    Source: dipwo1iToJ.exe, 00000001.00000002.1786218480.0000017A618A8000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.accv.es/fileadmin/Archivos/certificados/raizaccv1_der.crl0
    Source: dipwo1iToJ.exe, 00000001.00000002.1786218480.0000017A618A8000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.accv.es/fileadmin/Archivos/certificados/raizaccv1_der.crlS
    Source: dipwo1iToJ.exe, 00000001.00000002.1786218480.0000017A618FE000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.accv.es/legislacion_c.htm
    Source: dipwo1iToJ.exe, 00000001.00000002.1786218480.0000017A618A8000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.accv.es/legislacion_c.htm0U
    Source: dipwo1iToJ.exe, 00000001.00000002.1786218480.0000017A618FE000.00000004.00000020.00020000.00000000.sdmp, dipwo1iToJ.exe, 00000001.00000002.1786218480.0000017A618A8000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.accv.es00
    Source: dipwo1iToJ.exe, 00000001.00000002.1784874976.0000017A60ED0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://www.apple.com/DTDs/PropertyList-1.0.dtd
    Source: dipwo1iToJ.exe, 00000001.00000002.1784330278.0000017A60D81000.00000004.00000020.00020000.00000000.sdmp, dipwo1iToJ.exe, 00000001.00000002.1786218480.0000017A618FE000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.cert.fnmt.es/dpcs/
    Source: dipwo1iToJ.exe, 00000001.00000002.1786218480.0000017A618FE000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.cert.fnmt.es/dpcs/LuvN
    Source: dipwo1iToJ.exe, 00000001.00000002.1786434698.0000017A61B3A000.00000004.00000020.00020000.00000000.sdmp, dipwo1iToJ.exe, 00000001.00000002.1786434698.0000017A619AE000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.cs.ucdavis.edu/~rogaway/papers/keywrap.pdf
    Source: dipwo1iToJ.exe, 00000000.00000003.1685437325.000001ECBC747000.00000004.00000020.00020000.00000000.sdmp, dipwo1iToJ.exe, 00000000.00000003.1685593932.000001ECBC747000.00000004.00000020.00020000.00000000.sdmp, select.pyd.0.dr, _wmi.pyd.0.dr, _uuid.pyd.0.dr, _decimal.pyd.0.dr, libffi-8.dll.0.dr, _socket.pyd.0.dr, _ssl.pyd.0.dr, pyexpat.pyd.0.dr, _ctypes.pyd.0.dr, _multiprocessing.pyd.0.dr, _hashlib.pyd.0.dr, _asyncio.pyd.0.drString found in binary or memory: http://www.digicert.com/CPS0
    Source: dipwo1iToJ.exe, 00000001.00000002.1786218480.0000017A618FE000.00000004.00000020.00020000.00000000.sdmp, dipwo1iToJ.exe, 00000001.00000002.1783821326.0000017A606CD000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.firmaprofesional.com/cps0
    Source: dipwo1iToJ.exe, 00000001.00000003.1727487193.0000017A6086F000.00000004.00000020.00020000.00000000.sdmp, dipwo1iToJ.exe, 00000001.00000002.1783821326.0000017A6084A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.iana.org/assignments/tls-parameters/tls-parameters.xml#tls-parameters-6
    Source: dipwo1iToJ.exe, 00000001.00000002.1786218480.0000017A618A8000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.quovadisglobal.com/cps
    Source: dipwo1iToJ.exe, 00000001.00000002.1784330278.0000017A60D81000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.quovadisglobal.com/cps0
    Source: dipwo1iToJ.exe, 00000001.00000002.1786434698.0000017A61B3A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.rfc-editor.org/info/rfc7253
    Source: dipwo1iToJ.exe, 00000001.00000002.1786434698.0000017A61B3A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.tarsnap.com/scrypt/scrypt-slides.pdf
    Source: dipwo1iToJ.exe, 00000001.00000002.1784330278.0000017A60D81000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://wwwsearch.sf.net/):
    Source: dipwo1iToJ.exe, 00000001.00000002.1786218480.0000017A618FE000.00000004.00000020.00020000.00000000.sdmp, dipwo1iToJ.exe, 00000001.00000002.1786135596.0000017A61780000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://127.0.0.1:8443
    Source: dipwo1iToJ.exe, 00000001.00000002.1785618265.0000017A61410000.00000004.00001000.00020000.00000000.sdmp, dipwo1iToJ.exe, 00000001.00000003.1724114185.0000017A60DC4000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://account.riotgames.com/api/account/v1/user
    Source: dipwo1iToJ.exe, 00000001.00000002.1785618265.0000017A61410000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://accounts.reddit.com/api/access_token
    Source: dipwo1iToJ.exe, 00000001.00000003.1724114185.0000017A60DC4000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://accounts.reddit.com/api/access_tokenz
    Source: dipwo1iToJ.exe, 00000001.00000002.1785618265.0000017A61410000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://api.gofile.io/getServer
    Source: dipwo1iToJ.exe, 00000001.00000003.1724114185.0000017A60DC4000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://api.gofile.io/getServerrt
    Source: dipwo1iToJ.exe, 00000001.00000002.1785618265.0000017A61410000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://api.hypixel.net/player?key=aa5d84c7-f617-4069-9e64-ae177cd7b869&uuid=
    Source: dipwo1iToJ.exe, 00000001.00000003.1724114185.0000017A60DC4000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://api.hypixel.net/player?key=aa5d84c7-f617-4069-9e64-ae177cd7b869&uuid=r
    Source: dipwo1iToJ.exe, 00000001.00000002.1785618265.0000017A61410000.00000004.00001000.00020000.00000000.sdmp, dipwo1iToJ.exe, 00000001.00000003.1724114185.0000017A60DC4000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://api.namemc.com/profile/
    Source: dipwo1iToJ.exe, 00000001.00000002.1785618265.0000017A61410000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://api.steampowered.com/IPlayerService/GetOwnedGames/v0001/?key=440D7F4D810EF9298D25EDDF37C1F90
    Source: dipwo1iToJ.exe, 00000001.00000002.1785618265.0000017A61410000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://api.steampowered.com/IPlayerService/GetSteamLevel/v1/?key=440D7F4D810EF9298D25EDDF37C1F902&s
    Source: dipwo1iToJ.exe, 00000001.00000002.1785618265.0000017A61410000.00000004.00001000.00020000.00000000.sdmp, dipwo1iToJ.exe, 00000001.00000003.1724114185.0000017A60DC4000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://api.steampowered.com/ISteamUser/GetPlayerSummaries/v0002/?key=440D7F4D810EF9298D25EDDF37C1F9
    Source: dipwo1iToJ.exe, 00000001.00000002.1785618265.0000017A61410000.00000004.00001000.00020000.00000000.sdmp, dipwo1iToJ.exe, 00000001.00000003.1724114185.0000017A60DC4000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://api.telegram.org/bot
    Source: dipwo1iToJ.exe, 00000001.00000002.1785618265.0000017A61410000.00000004.00001000.00020000.00000000.sdmp, dipwo1iToJ.exe, 00000001.00000003.1724114185.0000017A60DC4000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://battle.net
    Source: METADATA.0.drString found in binary or memory: https://blog.jaraco.com/skeleton
    Source: dipwo1iToJ.exe, 00000001.00000002.1787439688.0000017A622D0000.00000004.00001000.00020000.00000000.sdmp, dipwo1iToJ.exe, 00000001.00000002.1786607711.0000017A61B7E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://bugs.python.org/issue37179
    Source: dipwo1iToJ.exe, 00000001.00000002.1785102451.0000017A610F0000.00000004.00001000.00020000.00000000.sdmp, dipwo1iToJ.exe, 00000001.00000002.1785216227.0000017A61210000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://bugs.python.org/issue44497.
    Source: dipwo1iToJ.exe, 00000001.00000002.1785618265.0000017A61410000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://catbox.moe/user/api.php
    Source: dipwo1iToJ.exe, 00000001.00000003.1724114185.0000017A60DC4000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://catbox.moe/user/api.phpr
    Source: dipwo1iToJ.exe, 00000001.00000002.1799219482.00007FFDFF6CC000.00000002.00000001.01000000.0000002A.sdmpString found in binary or memory: https://cffi.readthedocs.io/en/latest/using.html#callbacks
    Source: dipwo1iToJ.exe, 00000001.00000002.1785618265.0000017A61410000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://crafatar.com/skins/
    Source: dipwo1iToJ.exe, 00000001.00000003.1724114185.0000017A60DC4000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://crafatar.com/skins/z1.png
    Source: dipwo1iToJ.exe, 00000001.00000002.1789007887.00007FFDFA7AA000.00000002.00000001.01000000.00000029.sdmpString found in binary or memory: https://cryptography.io/en/latest/faq/#why-can-t-i-import-my-pem-file
    Source: dipwo1iToJ.exe, 00000001.00000002.1786218480.0000017A618FE000.00000004.00000020.00020000.00000000.sdmp, dipwo1iToJ.exe, 00000001.00000002.1786135596.0000017A61780000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://datatracker.ietf.org/doc/html/rfc3986#section-3.2.2
    Source: dipwo1iToJ.exe, 00000001.00000002.1786218480.0000017A618FE000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://datatracker.ietf.org/doc/html/rfc3986#section-3.2.3
    Source: dipwo1iToJ.exe, 00000001.00000002.1785618265.0000017A61410000.00000004.00001000.00020000.00000000.sdmp, dipwo1iToJ.exe, 00000001.00000003.1724114185.0000017A60DC4000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://discord.com/api/users/
    Source: dipwo1iToJ.exe, 00000001.00000002.1785618265.0000017A61410000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://discord.com/api/v6/guilds/
    Source: dipwo1iToJ.exe, 00000001.00000003.1724114185.0000017A60DC4000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://discord.com/api/v6/guilds/r
    Source: dipwo1iToJ.exe, 00000001.00000003.1724114185.0000017A60DC4000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://discord.com/api/v6/users/
    Source: dipwo1iToJ.exe, 00000001.00000003.1724114185.0000017A60DC4000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://discord.com/api/v9/users/
    Source: dipwo1iToJ.exe, 00000001.00000002.1785618265.0000017A61410000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://discord.gg/
    Source: dipwo1iToJ.exe, 00000001.00000003.1724114185.0000017A60DC4000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://discord.gg/r
    Source: dipwo1iToJ.exe, 00000001.00000002.1787439688.0000017A622D0000.00000004.00001000.00020000.00000000.sdmp, dipwo1iToJ.exe, 00000001.00000002.1786607711.0000017A61B7E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://docs.aiohttp.org/en/stable/client_advanced.html#proxy-support
    Source: METADATA0.0.drString found in binary or memory: https://docs.github.com/en/account-and-profile/setting-up-and-managing-your-github-profile/customizi
    Source: dipwo1iToJ.exe, 00000001.00000003.1719042544.0000017A60817000.00000004.00000020.00020000.00000000.sdmp, dipwo1iToJ.exe, 00000001.00000003.1718206364.0000017A60815000.00000004.00000020.00020000.00000000.sdmp, dipwo1iToJ.exe, 00000001.00000003.1715349063.0000017A60815000.00000004.00000020.00020000.00000000.sdmp, dipwo1iToJ.exe, 00000001.00000002.1783821326.0000017A6084A000.00000004.00000020.00020000.00000000.sdmp, dipwo1iToJ.exe, 00000001.00000003.1720080418.0000017A60817000.00000004.00000020.00020000.00000000.sdmp, dipwo1iToJ.exe, 00000001.00000003.1719985872.0000017A60815000.00000004.00000020.00020000.00000000.sdmp, dipwo1iToJ.exe, 00000001.00000003.1715319594.0000017A60823000.00000004.00000020.00020000.00000000.sdmp, dipwo1iToJ.exe, 00000001.00000003.1716039388.0000017A6081F000.00000004.00000020.00020000.00000000.sdmp, dipwo1iToJ.exe, 00000001.00000003.1727487193.0000017A607FA000.00000004.00000020.00020000.00000000.sdmp, dipwo1iToJ.exe, 00000001.00000003.1720015694.0000017A6081B000.00000004.00000020.00020000.00000000.sdmp, dipwo1iToJ.exe, 00000001.00000003.1721263504.0000017A60812000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://docs.python.org/3.11/library/binascii.html#binascii.a2b_base64
    Source: dipwo1iToJ.exe, 00000001.00000002.1786434698.0000017A619AE000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://docs.python.org/3/howto/mro.html
    Source: dipwo1iToJ.exe, 00000001.00000002.1787439688.0000017A622D0000.00000004.00001000.00020000.00000000.sdmp, dipwo1iToJ.exe, 00000001.00000002.1784330278.0000017A60C65000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://docs.python.org/3/library/asyncio-eventloop.html
    Source: dipwo1iToJ.exe, 00000001.00000003.1710250517.0000017A6045F000.00000004.00000020.00020000.00000000.sdmp, dipwo1iToJ.exe, 00000001.00000003.1710274832.0000017A60456000.00000004.00000020.00020000.00000000.sdmp, dipwo1iToJ.exe, 00000001.00000002.1783399636.0000017A60100000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://docs.python.org/3/library/importlib.html#importlib.abc.ExecutionLoader.get_filename
    Source: dipwo1iToJ.exe, 00000001.00000002.1783399636.0000017A6017C000.00000004.00001000.00020000.00000000.sdmp, dipwo1iToJ.exe, 00000001.00000003.1710250517.0000017A6045F000.00000004.00000020.00020000.00000000.sdmp, dipwo1iToJ.exe, 00000001.00000003.1710274832.0000017A60456000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://docs.python.org/3/library/importlib.html#importlib.abc.InspectLoader.get_code
    Source: dipwo1iToJ.exe, 00000001.00000002.1783399636.0000017A6017C000.00000004.00001000.00020000.00000000.sdmp, dipwo1iToJ.exe, 00000001.00000003.1710250517.0000017A6045F000.00000004.00000020.00020000.00000000.sdmp, dipwo1iToJ.exe, 00000001.00000003.1710274832.0000017A60456000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://docs.python.org/3/library/importlib.html#importlib.abc.InspectLoader.get_source
    Source: dipwo1iToJ.exe, 00000001.00000002.1783399636.0000017A6017C000.00000004.00001000.00020000.00000000.sdmp, dipwo1iToJ.exe, 00000001.00000003.1710250517.0000017A6045F000.00000004.00000020.00020000.00000000.sdmp, dipwo1iToJ.exe, 00000001.00000003.1710274832.0000017A60456000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://docs.python.org/3/library/importlib.html#importlib.abc.InspectLoader.is_package
    Source: dipwo1iToJ.exe, 00000001.00000002.1783399636.0000017A6017C000.00000004.00001000.00020000.00000000.sdmp, dipwo1iToJ.exe, 00000001.00000003.1710250517.0000017A6045F000.00000004.00000020.00020000.00000000.sdmp, dipwo1iToJ.exe, 00000001.00000003.1710274832.0000017A60456000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://docs.python.org/3/library/importlib.html#importlib.abc.Loader.create_module
    Source: dipwo1iToJ.exe, 00000001.00000003.1710250517.0000017A6045F000.00000004.00000020.00020000.00000000.sdmp, dipwo1iToJ.exe, 00000001.00000003.1710274832.0000017A60456000.00000004.00000020.00020000.00000000.sdmp, dipwo1iToJ.exe, 00000001.00000002.1783520183.0000017A60350000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://docs.python.org/3/library/importlib.html#importlib.abc.Loader.exec_module
    Source: dipwo1iToJ.exe, 00000001.00000003.1710250517.0000017A6045F000.00000004.00000020.00020000.00000000.sdmp, dipwo1iToJ.exe, 00000001.00000003.1710274832.0000017A60456000.00000004.00000020.00020000.00000000.sdmp, dipwo1iToJ.exe, 00000001.00000002.1783520183.0000017A60350000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://docs.python.org/3/library/importlib.html#importlib.abc.MetaPathFinder.invalidate_caches
    Source: dipwo1iToJ.exe, 00000001.00000002.1783399636.0000017A6017C000.00000004.00001000.00020000.00000000.sdmp, dipwo1iToJ.exe, 00000001.00000003.1710250517.0000017A6045F000.00000004.00000020.00020000.00000000.sdmp, dipwo1iToJ.exe, 00000001.00000003.1710274832.0000017A60456000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://docs.python.org/3/library/importlib.html#importlib.abc.PathEntryFinder.find_spec
    Source: dipwo1iToJ.exe, 00000001.00000002.1783280394.0000017A5E940000.00000004.00000020.00020000.00000000.sdmp, dipwo1iToJ.exe, 00000001.00000003.1710250517.0000017A6045F000.00000004.00000020.00020000.00000000.sdmp, dipwo1iToJ.exe, 00000001.00000003.1717300666.0000017A5E940000.00000004.00000020.00020000.00000000.sdmp, dipwo1iToJ.exe, 00000001.00000003.1710274832.0000017A60456000.00000004.00000020.00020000.00000000.sdmp, dipwo1iToJ.exe, 00000001.00000003.1713302317.0000017A5E940000.00000004.00000020.00020000.00000000.sdmp, dipwo1iToJ.exe, 00000001.00000003.1712793220.0000017A5E940000.00000004.00000020.00020000.00000000.sdmp, dipwo1iToJ.exe, 00000001.00000003.1713862624.0000017A5E940000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://docs.python.org/3/library/importlib.html#importlib.abc.ResourceLoader.get_data
    Source: METADATA.0.drString found in binary or memory: https://docs.python.org/3/library/importlib.metadata.html
    Source: dipwo1iToJ.exe, 00000001.00000002.1784330278.0000017A60BB5000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://docs.python.org/3/library/multiprocessing.html
    Source: METADATA.0.drString found in binary or memory: https://docs.python.org/3/reference/import.html#finders-and-loaders
    Source: dipwo1iToJ.exe, 00000001.00000002.1785618265.0000017A61410000.00000004.00001000.00020000.00000000.sdmp, dipwo1iToJ.exe, 00000001.00000003.1724114185.0000017A60DC4000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://ebay.com
    Source: dipwo1iToJ.exe, 00000001.00000002.1785618265.0000017A61410000.00000004.00001000.00020000.00000000.sdmp, dipwo1iToJ.exe, 00000001.00000003.1724114185.0000017A60DC4000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://epicgames.com
    Source: dipwo1iToJ.exe, 00000001.00000002.1785618265.0000017A61410000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://file.io/
    Source: dipwo1iToJ.exe, 00000001.00000003.1724114185.0000017A60DC4000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://file.io/r
    Source: METADATA0.0.drString found in binary or memory: https://filepreviews.io/
    Source: dipwo1iToJ.exe, 00000001.00000002.1785618265.0000017A61410000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://foss.heptapod.net/pypy/pypy/-/issues/3539
    Source: dipwo1iToJ.exe, 00000001.00000002.1785618265.0000017A61410000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://friends.roblox.com/v1/users/
    Source: dipwo1iToJ.exe, 00000001.00000003.1724114185.0000017A60DC4000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://friends.roblox.com/v1/users/rP
    Source: dipwo1iToJ.exe, 00000001.00000002.1784965590.0000017A60FF0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://gist.github.com/lyssdod/f51579ae8d93c8657a5564aefc2ffbca
    Source: dipwo1iToJ.exe, 00000001.00000002.1785618265.0000017A61410000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com
    Source: dipwo1iToJ.exe, 00000001.00000002.1784330278.0000017A60C65000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/Ousret/charset_normalizer
    Source: dipwo1iToJ.exe, 00000001.00000002.1783280394.0000017A5E940000.00000004.00000020.00020000.00000000.sdmp, dipwo1iToJ.exe, 00000001.00000003.1710250517.0000017A6045F000.00000004.00000020.00020000.00000000.sdmp, dipwo1iToJ.exe, 00000001.00000003.1717300666.0000017A5E940000.00000004.00000020.00020000.00000000.sdmp, dipwo1iToJ.exe, 00000001.00000003.1710274832.0000017A60456000.00000004.00000020.00020000.00000000.sdmp, dipwo1iToJ.exe, 00000001.00000003.1713302317.0000017A5E940000.00000004.00000020.00020000.00000000.sdmp, dipwo1iToJ.exe, 00000001.00000003.1712793220.0000017A5E940000.00000004.00000020.00020000.00000000.sdmp, dipwo1iToJ.exe, 00000001.00000003.1713862624.0000017A5E940000.00000004.00000020.00020000.00000000.sdmp, dipwo1iToJ.exe, 00000001.00000002.1783601146.0000017A60450000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/Unidata/MetPy/blob/a3424de66a44bf3a92b0dcacf4dff82ad7b86712/src/metpy/plots/wx_sy
    Source: dipwo1iToJ.exe, 00000001.00000002.1787439688.0000017A622D0000.00000004.00001000.00020000.00000000.sdmp, dipwo1iToJ.exe, 00000001.00000002.1786607711.0000017A61B7E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/aio-libs/aiohttp/discussions/6044
    Source: METADATA.0.drString found in binary or memory: https://github.com/astral-sh/ruff
    Source: dipwo1iToJ.exe, 00000001.00000002.1787515881.0000017A62710000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/giampaolo/psutil/issues/875.
    Source: dipwo1iToJ.exe, 00000001.00000002.1784965590.0000017A60FF0000.00000004.00001000.00020000.00000000.sdmp, dipwo1iToJ.exe, 00000001.00000003.1720406212.0000017A6071E000.00000004.00000020.00020000.00000000.sdmp, dipwo1iToJ.exe, 00000001.00000003.1722143244.0000017A6071E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/jaraco/jaraco.functools/issues/5
    Source: dipwo1iToJ.exe, 00000001.00000002.1799878580.00007FFE00022000.00000002.00000001.01000000.00000027.sdmp, dipwo1iToJ.exe, 00000001.00000002.1800009311.00007FFE00751000.00000002.00000001.01000000.00000026.sdmp, win32api.pyd.0.dr, pywintypes312.dll.0.drString found in binary or memory: https://github.com/mhammond/pywin32
    Source: dipwo1iToJ.exe, 00000001.00000002.1784965590.0000017A60FF0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/platformdirs/platformdirs
    Source: dipwo1iToJ.exe, 00000001.00000002.1786135596.0000017A61780000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/psf/requests/pull/6710
    Source: dipwo1iToJ.exe, 00000001.00000002.1789007887.00007FFDFA7AA000.00000002.00000001.01000000.00000029.sdmpString found in binary or memory: https://github.com/pyca/cryptography/issues
    Source: dipwo1iToJ.exe, 00000001.00000002.1789007887.00007FFDFA7AA000.00000002.00000001.01000000.00000029.sdmpString found in binary or memory: https://github.com/pyca/cryptography/issues/8996
    Source: dipwo1iToJ.exe, 00000001.00000002.1789007887.00007FFDFA7AA000.00000002.00000001.01000000.00000029.sdmpString found in binary or memory: https://github.com/pyca/cryptography/issues/9253
    Source: METADATA2.0.drString found in binary or memory: https://github.com/pypa/.github/blob/main/CODE_OF_CONDUCT.md
    Source: dipwo1iToJ.exe, 00000001.00000002.1784874976.0000017A60ED0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/pypa/packaging
    Source: dipwo1iToJ.exe, 00000001.00000002.1785418273.0000017A61310000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/pypa/setuptools/issues/1024.
    Source: dipwo1iToJ.exe, 00000001.00000002.1785102451.0000017A610F0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/pypa/setuptools/issues/417#issuecomment-392298401
    Source: dipwo1iToJ.exe, 00000001.00000002.1785216227.0000017A61210000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/pypa/setuptools/issues/new?template=distutils-deprecation.yml
    Source: METADATA2.0.drString found in binary or memory: https://github.com/pypa/wheel
    Source: METADATA2.0.drString found in binary or memory: https://github.com/pypa/wheel/issues
    Source: METADATA0.0.drString found in binary or memory: https://github.com/python-attrs/attrs
    Source: METADATA0.0.drString found in binary or memory: https://github.com/python-attrs/attrs)
    Source: METADATA0.0.drString found in binary or memory: https://github.com/python-attrs/attrs/blob/main/.github/CONTRIBUTING.md)
    Source: METADATA0.0.drString found in binary or memory: https://github.com/python-attrs/attrs/issues/1328)
    Source: METADATA0.0.drString found in binary or memory: https://github.com/python-attrs/attrs/issues/1329)
    Source: METADATA0.0.drString found in binary or memory: https://github.com/python-attrs/attrs/issues/1330)
    Source: dipwo1iToJ.exe, 00000001.00000002.1786434698.0000017A619AE000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/python-attrs/attrs/issues/136
    Source: dipwo1iToJ.exe, 00000001.00000002.1783821326.0000017A606CD000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/python-attrs/attrs/issues/251
    Source: dipwo1iToJ.exe, 00000001.00000002.1786434698.0000017A619AE000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/python-attrs/attrs/issues/428
    Source: METADATA0.0.drString found in binary or memory: https://github.com/python-attrs/attrs/wiki/Extensions-to-attrs)
    Source: dipwo1iToJ.exe, 00000001.00000002.1783399636.0000017A6017C000.00000004.00001000.00020000.00000000.sdmp, dipwo1iToJ.exe, 00000001.00000003.1710250517.0000017A6045F000.00000004.00000020.00020000.00000000.sdmp, dipwo1iToJ.exe, 00000001.00000003.1710274832.0000017A60456000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/python/cpython/blob/3.9/Lib/importlib/_bootstrap_external.py#L679-L688
    Source: dipwo1iToJ.exe, 00000001.00000002.1783601146.0000017A60450000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/python/cpython/blob/839d7893943782ee803536a47f1d4de160314f85/Lib/importlib/abc.py
    Source: dipwo1iToJ.exe, 00000001.00000002.1783280394.0000017A5E940000.00000004.00000020.00020000.00000000.sdmp, dipwo1iToJ.exe, 00000001.00000003.1710250517.0000017A6045F000.00000004.00000020.00020000.00000000.sdmp, dipwo1iToJ.exe, 00000001.00000003.1717300666.0000017A5E940000.00000004.00000020.00020000.00000000.sdmp, dipwo1iToJ.exe, 00000001.00000003.1710274832.0000017A60456000.00000004.00000020.00020000.00000000.sdmp, dipwo1iToJ.exe, 00000001.00000003.1713302317.0000017A5E940000.00000004.00000020.00020000.00000000.sdmp, dipwo1iToJ.exe, 00000001.00000003.1712793220.0000017A5E940000.00000004.00000020.00020000.00000000.sdmp, dipwo1iToJ.exe, 00000001.00000003.1713862624.0000017A5E940000.00000004.00000020.00020000.00000000.sdmp, dipwo1iToJ.exe, 00000001.00000002.1783601146.0000017A60450000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/python/cpython/blob/839d7893943782ee803536a47f1d4de160314f85/Lib/importlib/reader
    Source: dipwo1iToJ.exe, 00000001.00000003.1717435682.0000017A60737000.00000004.00000020.00020000.00000000.sdmp, dipwo1iToJ.exe, 00000001.00000002.1783821326.0000017A6071E000.00000004.00000020.00020000.00000000.sdmp, dipwo1iToJ.exe, 00000001.00000003.1716973785.0000017A60AD1000.00000004.00000020.00020000.00000000.sdmp, dipwo1iToJ.exe, 00000001.00000003.1716973785.0000017A60B31000.00000004.00000020.00020000.00000000.sdmp, dipwo1iToJ.exe, 00000001.00000003.1715983243.0000017A60B31000.00000004.00000020.00020000.00000000.sdmp, dipwo1iToJ.exe, 00000001.00000003.1718401236.0000017A60737000.00000004.00000020.00020000.00000000.sdmp, dipwo1iToJ.exe, 00000001.00000003.1720406212.0000017A6071E000.00000004.00000020.00020000.00000000.sdmp, dipwo1iToJ.exe, 00000001.00000003.1719042544.0000017A60737000.00000004.00000020.00020000.00000000.sdmp, dipwo1iToJ.exe, 00000001.00000003.1722143244.0000017A6071E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/python/cpython/issues/86361.
    Source: dipwo1iToJ.exe, 00000001.00000002.1787297845.0000017A62090000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/python/cpython/pull/118960
    Source: dipwo1iToJ.exe, 00000001.00000002.1787439688.0000017A622D0000.00000004.00001000.00020000.00000000.sdmp, dipwo1iToJ.exe, 00000001.00000002.1786607711.0000017A61B7E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/python/cpython/pull/28073
    Source: METADATA.0.drString found in binary or memory: https://github.com/python/importlib_metadata
    Source: METADATA.0.drString found in binary or memory: https://github.com/python/importlib_metadata/actions/workflows/main.yml/badge.svg
    Source: METADATA.0.drString found in binary or memory: https://github.com/python/importlib_metadata/actions?query=workflow%3A%22tests%22
    Source: METADATA.0.drString found in binary or memory: https://github.com/python/importlib_metadata/issues
    Source: METADATA0.0.drString found in binary or memory: https://github.com/sponsors/hynek
    Source: METADATA0.0.drString found in binary or memory: https://github.com/sponsors/hynek).
    Source: dipwo1iToJ.exe, 00000001.00000002.1783280394.0000017A5E940000.00000004.00000020.00020000.00000000.sdmp, dipwo1iToJ.exe, 00000001.00000003.1710250517.0000017A6045F000.00000004.00000020.00020000.00000000.sdmp, dipwo1iToJ.exe, 00000001.00000003.1717300666.0000017A5E940000.00000004.00000020.00020000.00000000.sdmp, dipwo1iToJ.exe, 00000001.00000003.1710274832.0000017A60456000.00000004.00000020.00020000.00000000.sdmp, dipwo1iToJ.exe, 00000001.00000003.1713302317.0000017A5E940000.00000004.00000020.00020000.00000000.sdmp, dipwo1iToJ.exe, 00000001.00000003.1712793220.0000017A5E940000.00000004.00000020.00020000.00000000.sdmp, dipwo1iToJ.exe, 00000001.00000003.1713862624.0000017A5E940000.00000004.00000020.00020000.00000000.sdmp, dipwo1iToJ.exe, 00000001.00000002.1783601146.0000017A60450000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/tensorflow/datasets/blob/master/tensorflow_datasets/core/utils/resource_utils.py#
    Source: dipwo1iToJ.exe, 00000001.00000002.1785618265.0000017A61410000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/urllib3/urllib3/issues/2192#issuecomment-821832963
    Source: dipwo1iToJ.exe, 00000001.00000002.1784330278.0000017A60C65000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/urllib3/urllib3/issues/2513#issuecomment-1152559900.
    Source: dipwo1iToJ.exe, 00000001.00000002.1785801228.0000017A61510000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/urllib3/urllib3/issues/2920
    Source: dipwo1iToJ.exe, 00000001.00000002.1785999287.0000017A61630000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/urllib3/urllib3/issues/3290
    Source: dipwo1iToJ.exe, 00000001.00000003.1724114185.0000017A60DC4000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.comr
    Source: dipwo1iToJ.exe, 00000001.00000002.1783601146.0000017A60478000.00000004.00000020.00020000.00000000.sdmp, dipwo1iToJ.exe, 00000001.00000002.1784330278.0000017A60D81000.00000004.00000020.00020000.00000000.sdmp, dipwo1iToJ.exe, 00000001.00000002.1784330278.0000017A60BB5000.00000004.00000020.00020000.00000000.sdmp, dipwo1iToJ.exe, 00000001.00000002.1784330278.0000017A60C65000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://google.com/
    Source: dipwo1iToJ.exe, 00000001.00000002.1784330278.0000017A60D81000.00000004.00000020.00020000.00000000.sdmp, dipwo1iToJ.exe, 00000001.00000002.1784330278.0000017A60BB5000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://google.com/mail
    Source: dipwo1iToJ.exe, 00000001.00000002.1783821326.0000017A6071E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://google.com/mail/
    Source: dipwo1iToJ.exe, 00000001.00000002.1785618265.0000017A61410000.00000004.00001000.00020000.00000000.sdmp, dipwo1iToJ.exe, 00000001.00000003.1724114185.0000017A60DC4000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://gql.twitch.tv/gql
    Source: dipwo1iToJ.exe, 00000001.00000002.1784330278.0000017A60C65000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://html.spec.whatwg.org/multipage/
    Source: dipwo1iToJ.exe, 00000001.00000002.1784330278.0000017A60C65000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://httpbin.org/
    Source: dipwo1iToJ.exe, 00000001.00000002.1786135596.0000017A61780000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://httpbin.org/get
    Source: dipwo1iToJ.exe, 00000001.00000002.1784330278.0000017A60C42000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://httpbin.org/post
    Source: METADATA0.0.drString found in binary or memory: https://hynek.me/articles/import-attrs/)
    Source: dipwo1iToJ.exe, 00000001.00000002.1785418273.0000017A61310000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://i.instagram.com/api/v1/accounts/current_user/?edit=true
    Source: dipwo1iToJ.exe, 00000001.00000003.1724114185.0000017A60DC4000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://i.instagram.com/api/v1/accounts/current_user/?edit=trueTr
    Source: dipwo1iToJ.exe, 00000001.00000002.1785618265.0000017A61410000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://i.instagram.com/api/v1/users/
    Source: dipwo1iToJ.exe, 00000001.00000003.1724114185.0000017A60DC4000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://i.instagram.com/api/v1/users/r
    Source: METADATA.0.drString found in binary or memory: https://img.shields.io/badge/skeleton-2024-informational
    Source: METADATA.0.drString found in binary or memory: https://img.shields.io/endpoint?url=https://raw.githubusercontent.com/charliermarsh/ruff/main/assets
    Source: METADATA.0.drString found in binary or memory: https://img.shields.io/pypi/pyversions/importlib_metadata.svg
    Source: METADATA.0.drString found in binary or memory: https://img.shields.io/pypi/v/importlib_metadata.svg
    Source: METADATA.0.drString found in binary or memory: https://importlib-metadata.readthedocs.io/
    Source: METADATA.0.drString found in binary or memory: https://importlib-metadata.readthedocs.io/en/latest/?badge=latest
    Source: dipwo1iToJ.exe, 00000001.00000002.1784874976.0000017A60ED0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://importlib-resources.readthedocs.io/en/latest/using.html#migrating-from-legacy
    Source: dipwo1iToJ.exe, 00000001.00000002.1785618265.0000017A61410000.00000004.00001000.00020000.00000000.sdmp, dipwo1iToJ.exe, 00000001.00000003.1724114185.0000017A60DC4000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://instagram.com
    Source: dipwo1iToJ.exe, 00000001.00000002.1785618265.0000017A61410000.00000004.00001000.00020000.00000000.sdmp, dipwo1iToJ.exe, 00000001.00000003.1724114185.0000017A60DC4000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://instagram.com/
    Source: dipwo1iToJ.exe, 00000001.00000002.1785618265.0000017A61410000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://inventory.roblox.com/v1/users/
    Source: dipwo1iToJ.exe, 00000001.00000003.1724114185.0000017A60DC4000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://inventory.roblox.com/v1/users/z4/assets/collectibles?sortOrder=Asc&limit=100&cursor=
    Source: dipwo1iToJ.exe, 00000001.00000002.1785618265.0000017A61410000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://ipinfo.io/json
    Source: dipwo1iToJ.exe, 00000001.00000003.1724114185.0000017A60DC4000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://ipinfo.io/jsonu
    Source: dipwo1iToJ.exe, 00000001.00000002.1784330278.0000017A60D81000.00000004.00000020.00020000.00000000.sdmp, dipwo1iToJ.exe, 00000001.00000002.1784330278.0000017A60BB5000.00000004.00000020.00020000.00000000.sdmp, dipwo1iToJ.exe, 00000001.00000002.1784330278.0000017A60C65000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://json.org
    Source: METADATA0.0.drString found in binary or memory: https://klaviyo.com/
    Source: dipwo1iToJ.exe, 00000001.00000002.1785618265.0000017A61410000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://krakenfiles.com/api/v1/file/upload
    Source: dipwo1iToJ.exe, 00000001.00000003.1724114185.0000017A60DC4000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://krakenfiles.com/api/v1/file/uploadr
    Source: dipwo1iToJ.exe, 00000001.00000002.1785618265.0000017A61410000.00000004.00001000.00020000.00000000.sdmp, dipwo1iToJ.exe, 00000001.00000003.1724114185.0000017A60DC4000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://leagueoflegends.com
    Source: dipwo1iToJ.exe, 00000001.00000003.1722665071.0000017A60BFD000.00000004.00000020.00020000.00000000.sdmp, dipwo1iToJ.exe, 00000001.00000002.1784330278.0000017A60BB5000.00000004.00000020.00020000.00000000.sdmp, dipwo1iToJ.exe, 00000001.00000003.1722333865.0000017A60C1D000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://mahler:8092/site-updates.py
    Source: dipwo1iToJ.exe, 00000001.00000002.1786607711.0000017A61B7E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-108r1.pdf
    Source: dipwo1iToJ.exe, 00000001.00000002.1785618265.0000017A61410000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://oauth.reddit.com/api/v1/me
    Source: dipwo1iToJ.exe, 00000001.00000003.1724114185.0000017A60DC4000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://oauth.reddit.com/api/v1/mez&android:com.example.myredditapp:v1.2.3z
    Source: dipwo1iToJ.exe, 00000001.00000002.1785418273.0000017A61310000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://packaging.python.org/en/latest/guides/packaging-namespace-packages/.
    Source: dipwo1iToJ.exe, 00000001.00000002.1785618265.0000017A61410000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://packaging.python.org/en/latest/specifications/core-metadata/
    Source: dipwo1iToJ.exe, 00000001.00000002.1785418273.0000017A61310000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://packaging.python.org/en/latest/specifications/entry-points/
    Source: dipwo1iToJ.exe, 00000001.00000002.1785418273.0000017A61310000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://packaging.python.org/en/latest/specifications/entry-points/All
    Source: dipwo1iToJ.exe, 00000001.00000002.1783821326.0000017A606CD000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://packaging.python.org/en/latest/specifications/pyproject-toml/#declaring-project-metadata-the
    Source: dipwo1iToJ.exe, 00000001.00000002.1785418273.0000017A61310000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://packaging.python.org/specifications/entry-points/
    Source: dipwo1iToJ.exe, 00000001.00000002.1785618265.0000017A61410000.00000004.00001000.00020000.00000000.sdmp, dipwo1iToJ.exe, 00000001.00000003.1724114185.0000017A60DC4000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://paypal.com
    Source: dipwo1iToJ.exe, 00000001.00000002.1784148989.0000017A609A0000.00000004.00001000.00020000.00000000.sdmp, dipwo1iToJ.exe, 00000001.00000003.1716236294.0000017A6068F000.00000004.00000020.00020000.00000000.sdmp, base_library.zip.0.drString found in binary or memory: https://peps.python.org/pep-0205/
    Source: dipwo1iToJ.exe, 00000001.00000002.1797680341.00007FFDFB5F4000.00000002.00000001.01000000.00000004.sdmpString found in binary or memory: https://peps.python.org/pep-0263/
    Source: METADATA0.0.drString found in binary or memory: https://peps.python.org/pep-0649/)
    Source: dipwo1iToJ.exe, 00000001.00000002.1785618265.0000017A61410000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://peps.python.org/pep-0685/
    Source: METADATA0.0.drString found in binary or memory: https://peps.python.org/pep-0749/)-implementing
    Source: dipwo1iToJ.exe, 00000001.00000002.1785618265.0000017A61410000.00000004.00001000.00020000.00000000.sdmp, dipwo1iToJ.exe, 00000001.00000003.1724114185.0000017A60DC4000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://playstation.com
    Source: METADATA0.0.drString found in binary or memory: https://pypi.org/project/attrs/)
    Source: dipwo1iToJ.exe, 00000001.00000002.1785418273.0000017A61310000.00000004.00001000.00020000.00000000.sdmp, dipwo1iToJ.exe, 00000001.00000002.1785102451.0000017A610F0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://pypi.org/project/build/).
    Source: METADATA.0.drString found in binary or memory: https://pypi.org/project/importlib_metadata
    Source: METADATA2.0.drString found in binary or memory: https://pypi.org/project/setuptools/
    Source: METADATA0.0.drString found in binary or memory: https://raw.githubusercontent.com/python-attrs/attrs/main/docs/_static/attrs_logo.svg
    Source: METADATA.0.drString found in binary or memory: https://readthedocs.org/projects/importlib-metadata/badge/?version=latest
    Source: dipwo1iToJ.exe, 00000001.00000002.1785618265.0000017A61410000.00000004.00001000.00020000.00000000.sdmp, dipwo1iToJ.exe, 00000001.00000003.1724114185.0000017A60DC4000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://reddit.com
    Source: dipwo1iToJ.exe, 00000001.00000002.1784965590.0000017A60FF0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://refspecs.linuxfoundation.org/elf/gabi4
    Source: dipwo1iToJ.exe, 00000001.00000002.1784330278.0000017A60C42000.00000004.00000020.00020000.00000000.sdmp, dipwo1iToJ.exe, 00000001.00000002.1786135596.0000017A61780000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://requests.readthedocs.io
    Source: dipwo1iToJ.exe, 00000001.00000002.1786135596.0000017A61780000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://requests.readthedocs.ioe
    Source: dipwo1iToJ.exe, 00000001.00000002.1785618265.0000017A61410000.00000004.00001000.00020000.00000000.sdmp, dipwo1iToJ.exe, 00000001.00000003.1724114185.0000017A60DC4000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://riotgames.com
    Source: dipwo1iToJ.exe, 00000001.00000002.1785618265.0000017A61410000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://s.optifine.net/capes/
    Source: dipwo1iToJ.exe, 00000001.00000003.1724114185.0000017A60DC4000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://s.optifine.net/capes/z
    Source: dipwo1iToJ.exe, 00000001.00000002.1785418273.0000017A61310000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://setuptools.pypa.io/en/latest/
    Source: dipwo1iToJ.exe, 00000001.00000003.1714086462.0000017A6080D000.00000004.00000020.00020000.00000000.sdmp, dipwo1iToJ.exe, 00000001.00000003.1714340744.0000017A60782000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://setuptools.pypa.io/en/latest/pkg_resources.html
    Source: dipwo1iToJ.exe, 00000001.00000003.1714086462.0000017A607BE000.00000004.00000020.00020000.00000000.sdmp, dipwo1iToJ.exe, 00000001.00000003.1717435682.0000017A60737000.00000004.00000020.00020000.00000000.sdmp, dipwo1iToJ.exe, 00000001.00000002.1783821326.0000017A6071E000.00000004.00000020.00020000.00000000.sdmp, dipwo1iToJ.exe, 00000001.00000003.1716236294.0000017A60737000.00000004.00000020.00020000.00000000.sdmp, dipwo1iToJ.exe, 00000001.00000003.1714727421.0000017A60779000.00000004.00000020.00020000.00000000.sdmp, dipwo1iToJ.exe, 00000001.00000003.1714304132.0000017A607AE000.00000004.00000020.00020000.00000000.sdmp, dipwo1iToJ.exe, 00000001.00000003.1714086462.0000017A6080D000.00000004.00000020.00020000.00000000.sdmp, dipwo1iToJ.exe, 00000001.00000003.1718401236.0000017A60737000.00000004.00000020.00020000.00000000.sdmp, dipwo1iToJ.exe, 00000001.00000003.1720406212.0000017A6071E000.00000004.00000020.00020000.00000000.sdmp, dipwo1iToJ.exe, 00000001.00000003.1719042544.0000017A60737000.00000004.00000020.00020000.00000000.sdmp, dipwo1iToJ.exe, 00000001.00000003.1722143244.0000017A6071E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://setuptools.pypa.io/en/latest/pkg_resources.html#basic-resource-access
    Source: dipwo1iToJ.exe, 00000001.00000002.1784071137.0000017A608A0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://setuptools.pypa.io/en/latest/references/keywords.html#keyword-namespace-packages
    Source: dipwo1iToJ.exe, 00000001.00000003.1714086462.0000017A607BE000.00000004.00000020.00020000.00000000.sdmp, dipwo1iToJ.exe, 00000001.00000003.1714086462.0000017A6080D000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://setuptools.pypa.io/en/latest/references/keywords.html#keyword-namespace-packagesr:
    Source: dipwo1iToJ.exe, 00000001.00000003.1714086462.0000017A607BE000.00000004.00000020.00020000.00000000.sdmp, dipwo1iToJ.exe, 00000001.00000003.1714086462.0000017A6080D000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://setuptools.pypa.io/en/latest/references/keywords.html#keyword-namespace-packagesr:r;Nr
    Source: dipwo1iToJ.exe, 00000001.00000002.1785618265.0000017A61410000.00000004.00001000.00020000.00000000.sdmp, dipwo1iToJ.exe, 00000001.00000003.1724114185.0000017A60DC4000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://skype.com
    Source: dipwo1iToJ.exe, 00000001.00000002.1785618265.0000017A61410000.00000004.00001000.00020000.00000000.sdmp, dipwo1iToJ.exe, 00000001.00000003.1724114185.0000017A60DC4000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://spotify.com
    Source: dipwo1iToJ.exe, 00000001.00000002.1787515881.0000017A62710000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://stackoverflow.com/questions/4457745#4457745.
    Source: METADATA0.0.drString found in binary or memory: https://stackoverflow.com/questions/tagged/python-attrs)
    Source: dipwo1iToJ.exe, 00000001.00000002.1785618265.0000017A61410000.00000004.00001000.00020000.00000000.sdmp, dipwo1iToJ.exe, 00000001.00000003.1724114185.0000017A60DC4000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://store.steampowered.com
    Source: dipwo1iToJ.exe, 00000001.00000002.1785618265.0000017A61410000.00000004.00001000.00020000.00000000.sdmp, dipwo1iToJ.exe, 00000001.00000003.1724114185.0000017A60DC4000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://t.me/blxstealer
    Source: METADATA0.0.drString found in binary or memory: https://tidelift.com/?utm_source=lifter&utm_medium=referral&utm_campaign=hynek
    Source: METADATA0.0.drString found in binary or memory: https://tidelift.com/?utm_source=lifter&utm_medium=referral&utm_campaign=hynek).
    Source: METADATA.0.drString found in binary or memory: https://tidelift.com/badges/package/pypi/importlib-metadata
    Source: METADATA0.0.drString found in binary or memory: https://tidelift.com/subscription/pkg/pypi-attrs?utm_source=pypi-attrs&utm_medium=pypi
    Source: METADATA.0.drString found in binary or memory: https://tidelift.com/subscription/pkg/pypi-importlib-metadata?utm_source=pypi-importlib-metadata&utm
    Source: dipwo1iToJ.exe, 00000001.00000002.1785618265.0000017A61410000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://tiktok.com
    Source: dipwo1iToJ.exe, 00000001.00000003.1724114185.0000017A60DC4000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://tiktok.comr
    Source: dipwo1iToJ.exe, 00000001.00000002.1783821326.0000017A6071E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://tools.ietf.org/html/rfc2388#section-4.4
    Source: dipwo1iToJ.exe, 00000001.00000002.1786434698.0000017A61A00000.00000004.00000020.00020000.00000000.sdmp, dipwo1iToJ.exe, 00000001.00000002.1784723256.0000017A60E9F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://tools.ietf.org/html/rfc3610
    Source: dipwo1iToJ.exe, 00000001.00000002.1786434698.0000017A61B3A000.00000004.00000020.00020000.00000000.sdmp, dipwo1iToJ.exe, 00000001.00000002.1786434698.0000017A619AE000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://tools.ietf.org/html/rfc5297
    Source: dipwo1iToJ.exe, 00000001.00000002.1783821326.0000017A6071E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://tools.ietf.org/html/rfc7231#section-4.3.6)
    Source: dipwo1iToJ.exe, 00000001.00000002.1785618265.0000017A61410000.00000004.00001000.00020000.00000000.sdmp, dipwo1iToJ.exe, 00000001.00000003.1724114185.0000017A60DC4000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://twitch.tv
    Source: dipwo1iToJ.exe, 00000001.00000002.1785618265.0000017A61410000.00000004.00001000.00020000.00000000.sdmp, dipwo1iToJ.exe, 00000001.00000003.1724114185.0000017A60DC4000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://twitter.com
    Source: dipwo1iToJ.exe, 00000001.00000002.1785618265.0000017A61410000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://twitter.com/
    Source: dipwo1iToJ.exe, 00000001.00000002.1785618265.0000017A61410000.00000004.00001000.00020000.00000000.sdmp, dipwo1iToJ.exe, 00000001.00000003.1724114185.0000017A60DC4000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://twitter.com/home
    Source: dipwo1iToJ.exe, 00000001.00000002.1785418273.0000017A61310000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://twitter.com/i/api/1.1/account/update_profile.json
    Source: dipwo1iToJ.exe, 00000001.00000003.1724114185.0000017A60DC4000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://twitter.com/i/api/1.1/account/update_profile.jsonTr
    Source: dipwo1iToJ.exe, 00000001.00000002.1785418273.0000017A61310000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://twitter.com/i/api/1.1/account/update_profile.jsonc
    Source: dipwo1iToJ.exe, 00000001.00000003.1724114185.0000017A60DC4000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://twitter.com/r
    Source: dipwo1iToJ.exe, 00000001.00000003.1724114185.0000017A60DC4000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://uguu.se/api.p
    Source: dipwo1iToJ.exe, 00000001.00000002.1785618265.0000017A61410000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://uguu.se/api.php?d=upload
    Source: dipwo1iToJ.exe, 00000001.00000003.1724114185.0000017A60DC4000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://uguu.se/api.php?d=uploadr
    Source: dipwo1iToJ.exe, 00000001.00000002.1785999287.0000017A61630000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://urllib3.readthedocs.io/en/latest/advanced-usage.html#https-proxy-error-http-proxy
    Source: dipwo1iToJ.exe, 00000001.00000002.1785801228.0000017A61510000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://urllib3.readthedocs.io/en/latest/advanced-usage.html#tls-warnings
    Source: dipwo1iToJ.exe, 00000001.00000002.1785618265.0000017A61410000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://users.roblox.com/v1/users/
    Source: dipwo1iToJ.exe, 00000001.00000003.1724114185.0000017A60DC4000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://users.roblox.com/v1/users/r
    Source: dipwo1iToJ.exe, 00000001.00000002.1785618265.0000017A61410000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://webcast.tiktok.com/webcast/wallet_api/diamond_buy/permission/?aid=1988
    Source: METADATA2.0.drString found in binary or memory: https://wheel.readthedocs.io/
    Source: METADATA2.0.drString found in binary or memory: https://wheel.readthedocs.io/en/stable/news.html
    Source: dipwo1iToJ.exe, 00000001.00000002.1783601146.0000017A60478000.00000004.00000020.00020000.00000000.sdmp, dipwo1iToJ.exe, 00000001.00000003.1720054100.0000017A60C27000.00000004.00000020.00020000.00000000.sdmp, dipwo1iToJ.exe, 00000001.00000003.1719700729.0000017A60BBD000.00000004.00000020.00020000.00000000.sdmp, dipwo1iToJ.exe, 00000001.00000003.1719700729.0000017A60C0D000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www-cs-faculty.stanford.edu/~knuth/fasc2a.ps.gz
    Source: LICENSE.APACHE.0.drString found in binary or memory: https://www.apache.org/licenses/
    Source: LICENSE.APACHE.0.drString found in binary or memory: https://www.apache.org/licenses/LICENSE-2.0
    Source: METADATA0.0.drString found in binary or memory: https://www.attrs.org/
    Source: METADATA0.0.drString found in binary or memory: https://www.attrs.org/)
    Source: METADATA0.0.drString found in binary or memory: https://www.attrs.org/en/24.2.0/_static/sponsors/
    Source: METADATA0.0.drString found in binary or memory: https://www.attrs.org/en/24.2.0/_static/sponsors/FilePreviews.svg
    Source: METADATA0.0.drString found in binary or memory: https://www.attrs.org/en/24.2.0/_static/sponsors/Klaviyo.svg
    Source: METADATA0.0.drString found in binary or memory: https://www.attrs.org/en/24.2.0/_static/sponsors/Tidelift.svg
    Source: METADATA0.0.drString found in binary or memory: https://www.attrs.org/en/24.2.0/_static/sponsors/Variomedia.svg
    Source: METADATA0.0.drString found in binary or memory: https://www.attrs.org/en/latest/glossary.html#term-dunder-methods)).
    Source: METADATA0.0.drString found in binary or memory: https://www.attrs.org/en/latest/names.html)
    Source: METADATA0.0.drString found in binary or memory: https://www.attrs.org/en/stable/changelog.html
    Source: METADATA0.0.drString found in binary or memory: https://www.attrs.org/en/stable/changelog.html)
    Source: METADATA0.0.drString found in binary or memory: https://www.attrs.org/en/stable/comparison.html#customization)
    Source: METADATA0.0.drString found in binary or memory: https://www.attrs.org/en/stable/init.html#hooking-yourself-into-initialization)
    Source: METADATA0.0.drString found in binary or memory: https://www.attrs.org/en/stable/why.html#data-classes)
    Source: dipwo1iToJ.exe, 00000001.00000002.1783520183.0000017A60350000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://www.dropbox.com/scl/fi/3clo0b3x6nfajqm27kvx6/exodus.asar?rlkey=200tiyus0rc0u3u4j9kf517l0&st=
    Source: dipwo1iToJ.exe, 00000001.00000002.1783520183.0000017A60350000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://www.dropbox.com/scl/fi/xtt2n593d5n4svefktjhy/atomic.asar?rlkey=5refutaevle4aapp0p6hgn7q1&st=
    Source: dipwo1iToJ.exe, 00000001.00000002.1785618265.0000017A61410000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://www.guilded.gg/api/me
    Source: dipwo1iToJ.exe, 00000001.00000003.1724114185.0000017A60DC4000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.guilded.gg/api/mez
    Source: dipwo1iToJ.exe, 00000001.00000002.1784330278.0000017A60D81000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.ietf.org/rfc/rfc2898.txt
    Source: dipwo1iToJ.exe, 00000001.00000002.1793601128.00007FFDFACE0000.00000002.00000001.01000000.00000013.sdmp, dipwo1iToJ.exe, 00000001.00000002.1797375803.00007FFDFB1D3000.00000002.00000001.01000000.0000000C.sdmpString found in binary or memory: https://www.openssl.org/H
    Source: dipwo1iToJ.exe, 00000001.00000002.1785418273.0000017A61310000.00000004.00001000.00020000.00000000.sdmp, dipwo1iToJ.exe, 00000001.00000003.1724114185.0000017A60DC4000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.patreon.com/api/current_user?include=connected_socials%2Ccampaign.connected_socials&json
    Source: dipwo1iToJ.exe, 00000001.00000002.1784330278.0000017A60C42000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.python.org
    Source: dipwo1iToJ.exe, 00000001.00000003.1722665071.0000017A60BFD000.00000004.00000020.00020000.00000000.sdmp, dipwo1iToJ.exe, 00000001.00000002.1784330278.0000017A60BB5000.00000004.00000020.00020000.00000000.sdmp, dipwo1iToJ.exe, 00000001.00000003.1722333865.0000017A60C1D000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.python.org/
    Source: METADATA2.0.drString found in binary or memory: https://www.python.org/dev/peps/pep-0427/
    Source: dipwo1iToJ.exe, 00000001.00000003.1712023062.0000017A604FC000.00000004.00000020.00020000.00000000.sdmp, dipwo1iToJ.exe, 00000001.00000003.1711892136.0000017A604A7000.00000004.00000020.00020000.00000000.sdmp, dipwo1iToJ.exe, 00000001.00000003.1711892136.0000017A604F5000.00000004.00000020.00020000.00000000.sdmp, dipwo1iToJ.exe, 00000001.00000002.1783399636.0000017A60100000.00000004.00001000.00020000.00000000.sdmp, base_library.zip.0.drString found in binary or memory: https://www.python.org/download/releases/2.3/mro/.
    Source: dipwo1iToJ.exe, 00000001.00000002.1785618265.0000017A61410000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://www.python.org/ftp/python/3.12.6/python-3.12.6-amd64.exe
    Source: dipwo1iToJ.exe, 00000001.00000003.1724114185.0000017A60DC4000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.python.org/ftp/python/3.12.6/python-3.12.6-amd64.exez
    Source: dipwo1iToJ.exe, 00000001.00000002.1798106922.00007FFDFB764000.00000008.00000001.01000000.00000004.sdmpString found in binary or memory: https://www.python.org/psf/license/
    Source: dipwo1iToJ.exe, 00000001.00000002.1797680341.00007FFDFB5F4000.00000002.00000001.01000000.00000004.sdmpString found in binary or memory: https://www.python.org/psf/license/)
    Source: dipwo1iToJ.exe, 00000001.00000002.1785618265.0000017A61410000.00000004.00001000.00020000.00000000.sdmp, dipwo1iToJ.exe, 00000001.00000003.1724114185.0000017A60DC4000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.reddit.com/user/
    Source: dipwo1iToJ.exe, 00000001.00000002.1784330278.0000017A60BB5000.00000004.00000020.00020000.00000000.sdmp, dipwo1iToJ.exe, 00000001.00000002.1784723256.0000017A60E63000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.rfc-editor.org/rfc/rfc8259#section-8.1
    Source: dipwo1iToJ.exe, 00000001.00000002.1785618265.0000017A61410000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://www.roblox.com/mobileapi/userinfo
    Source: dipwo1iToJ.exe, 00000001.00000003.1724114185.0000017A60DC4000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.roblox.com/mobileapi/userinfor
    Source: dipwo1iToJ.exe, 00000001.00000002.1785618265.0000017A61410000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://www.spotify.com/api/account-settings/v1/profile
    Source: dipwo1iToJ.exe, 00000001.00000003.1724114185.0000017A60DC4000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.spotify.com/api/account-settings/v1/profilez7https://www.spotify.com/eg-en/api/account/v
    Source: dipwo1iToJ.exe, 00000001.00000002.1785618265.0000017A61410000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://www.spotify.com/eg-en/api/account/v1/datalayer/
    Source: dipwo1iToJ.exe, 00000001.00000002.1785618265.0000017A61410000.00000004.00001000.00020000.00000000.sdmp, dipwo1iToJ.exe, 00000001.00000003.1724114185.0000017A60DC4000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.tiktok.com/api/user/list/?count=1&minCursor=0&scene=67&secUid=
    Source: dipwo1iToJ.exe, 00000001.00000002.1785618265.0000017A61410000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://www.tiktok.com/passport/web/account/info/
    Source: dipwo1iToJ.exe, 00000001.00000003.1724114185.0000017A60DC4000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.tiktok.com/passport/web/account/info/zNhttps://webcast.tiktok.com/webcast/wallet_api/dia
    Source: dipwo1iToJ.exe, 00000001.00000002.1785618265.0000017A61410000.00000004.00001000.00020000.00000000.sdmp, dipwo1iToJ.exe, 00000001.00000003.1724114185.0000017A60DC4000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.twitch.tv/
    Source: METADATA0.0.drString found in binary or memory: https://www.variomedia.de/
    Source: dipwo1iToJ.exe, 00000001.00000002.1786218480.0000017A618FE000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://wwww.certigna.fr/autorites/
    Source: dipwo1iToJ.exe, 00000001.00000002.1784330278.0000017A60C65000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://wwww.certigna.fr/autorites/0m
    Source: dipwo1iToJ.exe, 00000001.00000002.1785618265.0000017A61410000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://xbox.com
    Source: dipwo1iToJ.exe, 00000001.00000003.1724114185.0000017A60DC4000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://xbox.comz
    Source: dipwo1iToJ.exe, 00000001.00000002.1784330278.0000017A60D81000.00000004.00000020.00020000.00000000.sdmp, dipwo1iToJ.exe, 00000001.00000002.1784330278.0000017A60BB5000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://yahoo.com/
    Source: dipwo1iToJ.exe, 00000001.00000002.1785618265.0000017A61410000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://youtube.com
    Source: dipwo1iToJ.exe, 00000001.00000003.1724114185.0000017A60DC4000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://youtube.com)
    Source: C:\Users\user\Desktop\dipwo1iToJ.exeCode function: 0_2_00007FF6F8FE09380_2_00007FF6F8FE0938
    Source: C:\Users\user\Desktop\dipwo1iToJ.exeCode function: 0_2_00007FF6F8FE69D40_2_00007FF6F8FE69D4
    Source: C:\Users\user\Desktop\dipwo1iToJ.exeCode function: 0_2_00007FF6F8FE5C700_2_00007FF6F8FE5C70
    Source: C:\Users\user\Desktop\dipwo1iToJ.exeCode function: 0_2_00007FF6F8FC8BD00_2_00007FF6F8FC8BD0
    Source: C:\Users\user\Desktop\dipwo1iToJ.exeCode function: 0_2_00007FF6F8FC10000_2_00007FF6F8FC1000
    Source: C:\Users\user\Desktop\dipwo1iToJ.exeCode function: 0_2_00007FF6F8FDDACC0_2_00007FF6F8FDDACC
    Source: C:\Users\user\Desktop\dipwo1iToJ.exeCode function: 0_2_00007FF6F8FD81540_2_00007FF6F8FD8154
    Source: C:\Users\user\Desktop\dipwo1iToJ.exeCode function: 0_2_00007FF6F8FD19B40_2_00007FF6F8FD19B4
    Source: C:\Users\user\Desktop\dipwo1iToJ.exeCode function: 0_2_00007FF6F8FD21D40_2_00007FF6F8FD21D4
    Source: C:\Users\user\Desktop\dipwo1iToJ.exeCode function: 0_2_00007FF6F8FD3A140_2_00007FF6F8FD3A14
    Source: C:\Users\user\Desktop\dipwo1iToJ.exeCode function: 0_2_00007FF6F8FD2C800_2_00007FF6F8FD2C80
    Source: C:\Users\user\Desktop\dipwo1iToJ.exeCode function: 0_2_00007FF6F8FE3C800_2_00007FF6F8FE3C80
    Source: C:\Users\user\Desktop\dipwo1iToJ.exeCode function: 0_2_00007FF6F8FE09380_2_00007FF6F8FE0938
    Source: C:\Users\user\Desktop\dipwo1iToJ.exeCode function: 0_2_00007FF6F8FE64880_2_00007FF6F8FE6488
    Source: C:\Users\user\Desktop\dipwo1iToJ.exeCode function: 0_2_00007FF6F8FCA4E40_2_00007FF6F8FCA4E4
    Source: C:\Users\user\Desktop\dipwo1iToJ.exeCode function: 0_2_00007FF6F8FCAD1D0_2_00007FF6F8FCAD1D
    Source: C:\Users\user\Desktop\dipwo1iToJ.exeCode function: 0_2_00007FF6F8FCA34B0_2_00007FF6F8FCA34B
    Source: C:\Users\user\Desktop\dipwo1iToJ.exeCode function: 0_2_00007FF6F8FD1BC00_2_00007FF6F8FD1BC0
    Source: C:\Users\user\Desktop\dipwo1iToJ.exeCode function: 0_2_00007FF6F8FE5EEC0_2_00007FF6F8FE5EEC
    Source: C:\Users\user\Desktop\dipwo1iToJ.exeCode function: 0_2_00007FF6F8FD9F100_2_00007FF6F8FD9F10
    Source: C:\Users\user\Desktop\dipwo1iToJ.exeCode function: 0_2_00007FF6F8FD5DA00_2_00007FF6F8FD5DA0
    Source: C:\Users\user\Desktop\dipwo1iToJ.exeCode function: 0_2_00007FF6F8FD1DC40_2_00007FF6F8FD1DC4
    Source: C:\Users\user\Desktop\dipwo1iToJ.exeCode function: 0_2_00007FF6F8FDE5E00_2_00007FF6F8FDE5E0
    Source: C:\Users\user\Desktop\dipwo1iToJ.exeCode function: 0_2_00007FF6F8FD36100_2_00007FF6F8FD3610
    Source: C:\Users\user\Desktop\dipwo1iToJ.exeCode function: 0_2_00007FF6F8FC98700_2_00007FF6F8FC9870
    Source: C:\Users\user\Desktop\dipwo1iToJ.exeCode function: 0_2_00007FF6F8FE18E40_2_00007FF6F8FE18E4
    Source: C:\Users\user\Desktop\dipwo1iToJ.exeCode function: 0_2_00007FF6F8FE411C0_2_00007FF6F8FE411C
    Source: C:\Users\user\Desktop\dipwo1iToJ.exeCode function: 0_2_00007FF6F8FDDF600_2_00007FF6F8FDDF60
    Source: C:\Users\user\Desktop\dipwo1iToJ.exeCode function: 0_2_00007FF6F8FE97980_2_00007FF6F8FE9798
    Source: C:\Users\user\Desktop\dipwo1iToJ.exeCode function: 0_2_00007FF6F8FD17B00_2_00007FF6F8FD17B0
    Source: C:\Users\user\Desktop\dipwo1iToJ.exeCode function: 0_2_00007FF6F8FD1FD00_2_00007FF6F8FD1FD0
    Source: C:\Users\user\Desktop\dipwo1iToJ.exeCode function: 0_2_00007FF6F8FD88040_2_00007FF6F8FD8804
    Source: C:\Users\user\Desktop\dipwo1iToJ.exeCode function: 1_2_00007FFDFA9912F01_2_00007FFDFA9912F0
    Source: C:\Users\user\Desktop\dipwo1iToJ.exeCode function: 1_2_00007FFDFA9918A01_2_00007FFDFA9918A0
    Source: C:\Users\user\Desktop\dipwo1iToJ.exeCode function: 1_2_00007FFDFAB44AB01_2_00007FFDFAB44AB0
    Source: C:\Users\user\Desktop\dipwo1iToJ.exeCode function: 1_2_00007FFDFAB29A701_2_00007FFDFAB29A70
    Source: C:\Users\user\Desktop\dipwo1iToJ.exeCode function: 1_2_00007FFDFAB11A801_2_00007FFDFAB11A80
    Source: C:\Users\user\Desktop\dipwo1iToJ.exeCode function: 1_2_00007FFDFAABAAB01_2_00007FFDFAABAAB0
    Source: C:\Users\user\Desktop\dipwo1iToJ.exeCode function: 1_2_00007FFDFAB36BE01_2_00007FFDFAB36BE0
    Source: C:\Users\user\Desktop\dipwo1iToJ.exeCode function: 1_2_00007FFDFAACBB701_2_00007FFDFAACBB70
    Source: C:\Users\user\Desktop\dipwo1iToJ.exeCode function: 1_2_00007FFDFAB62B901_2_00007FFDFAB62B90
    Source: C:\Users\user\Desktop\dipwo1iToJ.exeCode function: 1_2_00007FFDFAAB69481_2_00007FFDFAAB6948
    Source: C:\Users\user\Desktop\dipwo1iToJ.exeCode function: String function: 00007FF6F8FC2710 appears 52 times
    Source: _overlapped.pyd.0.drStatic PE information: Resource name: RT_VERSION type: COM executable for DOS
    Source: unicodedata.pyd.0.drStatic PE information: Resource name: RT_VERSION type: COM executable for DOS
    Source: python3.dll.0.drStatic PE information: No import functions for PE file found
    Source: dipwo1iToJ.exe, 00000000.00000003.1685437325.000001ECBC747000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilename_asyncio.pyd. vs dipwo1iToJ.exe
    Source: dipwo1iToJ.exe, 00000000.00000003.1685593932.000001ECBC747000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilename_bz2.pyd. vs dipwo1iToJ.exe
    Source: dipwo1iToJ.exe, 00000000.00000003.1684977147.000001ECBC747000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenamevcruntime140.dllT vs dipwo1iToJ.exe
    Source: dipwo1iToJ.exe, 00000000.00000003.1685298094.000001ECBC747000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenamevcruntime140_1.dllT vs dipwo1iToJ.exe
    Source: dipwo1iToJ.exeBinary or memory string: OriginalFilename vs dipwo1iToJ.exe
    Source: dipwo1iToJ.exe, 00000001.00000002.1804715294.00007FFE13206000.00000002.00000001.01000000.0000000E.sdmpBinary or memory string: OriginalFilenameselect.pyd. vs dipwo1iToJ.exe
    Source: dipwo1iToJ.exe, 00000001.00000002.1803520712.00007FFE1150E000.00000002.00000001.01000000.0000000B.sdmpBinary or memory string: OriginalFilename_hashlib.pyd. vs dipwo1iToJ.exe
    Source: dipwo1iToJ.exe, 00000001.00000002.1802401027.00007FFE0EB3B000.00000002.00000001.01000000.00000016.sdmpBinary or memory string: OriginalFilename_sqlite3.pyd. vs dipwo1iToJ.exe
    Source: dipwo1iToJ.exe, 00000001.00000002.1802694137.00007FFE0EB69000.00000002.00000001.01000000.00000012.sdmpBinary or memory string: OriginalFilename_ssl.pyd. vs dipwo1iToJ.exe
    Source: dipwo1iToJ.exe, 00000001.00000002.1804339715.00007FFE11EEC000.00000002.00000001.01000000.00000007.sdmpBinary or memory string: OriginalFilename_ctypes.pyd. vs dipwo1iToJ.exe
    Source: dipwo1iToJ.exe, 00000001.00000002.1793601128.00007FFDFACE0000.00000002.00000001.01000000.00000013.sdmpBinary or memory string: OriginalFilenamelibsslH vs dipwo1iToJ.exe
    Source: dipwo1iToJ.exe, 00000001.00000002.1803357473.00007FFE110F4000.00000002.00000001.01000000.00000023.sdmpBinary or memory string: OriginalFilename_uuid.pyd. vs dipwo1iToJ.exe
    Source: dipwo1iToJ.exe, 00000001.00000002.1799878580.00007FFE00022000.00000002.00000001.01000000.00000027.sdmpBinary or memory string: OriginalFilenamepywintypes312.dll0 vs dipwo1iToJ.exe
    Source: dipwo1iToJ.exe, 00000001.00000002.1804436334.00007FFE120CB000.00000002.00000001.01000000.00000015.sdmpBinary or memory string: OriginalFilename_overlapped.pyd. vs dipwo1iToJ.exe
    Source: dipwo1iToJ.exe, 00000001.00000002.1804827969.00007FFE13227000.00000002.00000001.01000000.00000005.sdmpBinary or memory string: OriginalFilenamevcruntime140.dllT vs dipwo1iToJ.exe
    Source: dipwo1iToJ.exe, 00000001.00000002.1797375803.00007FFDFB1D3000.00000002.00000001.01000000.0000000C.sdmpBinary or memory string: OriginalFilenamelibcryptoH vs dipwo1iToJ.exe
    Source: dipwo1iToJ.exe, 00000001.00000002.1804527886.00007FFE12E16000.00000002.00000001.01000000.00000011.sdmpBinary or memory string: OriginalFilename_queue.pyd. vs dipwo1iToJ.exe
    Source: dipwo1iToJ.exe, 00000001.00000002.1802983777.00007FFE1025D000.00000002.00000001.01000000.00000010.sdmpBinary or memory string: OriginalFilenamepyexpat.pyd. vs dipwo1iToJ.exe
    Source: dipwo1iToJ.exe, 00000001.00000002.1803233447.00007FFE11079000.00000002.00000001.01000000.00000028.sdmpBinary or memory string: OriginalFilenamevcruntime140_1.dllT vs dipwo1iToJ.exe
    Source: dipwo1iToJ.exe, 00000001.00000002.1792149222.00007FFDFAC10000.00000002.00000001.01000000.00000017.sdmpBinary or memory string: OriginalFilenamesqlite3.dll0 vs dipwo1iToJ.exe
    Source: dipwo1iToJ.exe, 00000001.00000002.1790657853.00007FFDFAAA4000.00000002.00000001.01000000.0000001A.sdmpBinary or memory string: OriginalFilenameunicodedata.pyd. vs dipwo1iToJ.exe
    Source: dipwo1iToJ.exe, 00000001.00000002.1804228698.00007FFE11EC2000.00000002.00000001.01000000.00000009.sdmpBinary or memory string: OriginalFilename_bz2.pyd. vs dipwo1iToJ.exe
    Source: dipwo1iToJ.exe, 00000001.00000002.1803143210.00007FFE10313000.00000002.00000001.01000000.0000000D.sdmpBinary or memory string: OriginalFilename_socket.pyd. vs dipwo1iToJ.exe
    Source: dipwo1iToJ.exe, 00000001.00000002.1800009311.00007FFE00751000.00000002.00000001.01000000.00000026.sdmpBinary or memory string: OriginalFilenamewin32api.pyd0 vs dipwo1iToJ.exe
    Source: dipwo1iToJ.exe, 00000001.00000002.1798405140.00007FFDFB88D000.00000002.00000001.01000000.00000004.sdmpBinary or memory string: OriginalFilenamepython312.dll. vs dipwo1iToJ.exe
    Source: dipwo1iToJ.exe, 00000001.00000002.1802798048.00007FFE101DF000.00000002.00000001.01000000.00000014.sdmpBinary or memory string: OriginalFilename_asyncio.pyd. vs dipwo1iToJ.exe
    Source: dipwo1iToJ.exe, 00000001.00000002.1804622462.00007FFE130C7000.00000002.00000001.01000000.0000000F.sdmpBinary or memory string: OriginalFilename_wmi.pyd. vs dipwo1iToJ.exe
    Source: dipwo1iToJ.exe, 00000001.00000002.1803635745.00007FFE11545000.00000002.00000001.01000000.0000000A.sdmpBinary or memory string: OriginalFilename_lzma.pyd. vs dipwo1iToJ.exe
    Source: dipwo1iToJ.exe, 00000001.00000002.1783720389.0000017A60550000.00000002.00000001.01000000.00000006.sdmpBinary or memory string: OriginalFilenamepython3.dll. vs dipwo1iToJ.exe
    Source: classification engineClassification label: mal52.troj.winEXE@3/109@0/2
    Source: C:\Users\user\Desktop\dipwo1iToJ.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI68642Jump to behavior
    Source: dipwo1iToJ.exeStatic PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
    Source: C:\Users\user\Desktop\dipwo1iToJ.exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT Architecture FROM Win32_Processor
    Source: C:\Users\user\Desktop\dipwo1iToJ.exeKey opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiersJump to behavior
    Source: dipwo1iToJ.exe, 00000001.00000002.1791797724.00007FFDFABDE000.00000002.00000001.01000000.00000017.sdmpBinary or memory string: UPDATE %Q.sqlite_master SET tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqliteX_autoindex%%' ESCAPE 'X' AND type='index' THEN 'sqlite_autoindex_' || %Q || substr(name,%d+18) ELSE name END WHERE tbl_name=%Q COLLATE nocase AND (type='table' OR type='index' OR type='trigger');
    Source: dipwo1iToJ.exe, 00000001.00000002.1785216227.0000017A61210000.00000004.00001000.00020000.00000000.sdmpBinary or memory string: SELECT item1, item2 FROM metadata;
    Source: dipwo1iToJ.exe, 00000001.00000002.1791797724.00007FFDFABDE000.00000002.00000001.01000000.00000017.sdmpBinary or memory string: CREATE TABLE %Q.'%q_docsize'(docid INTEGER PRIMARY KEY, size BLOB);
    Source: dipwo1iToJ.exe, 00000001.00000002.1791797724.00007FFDFABDE000.00000002.00000001.01000000.00000017.sdmpBinary or memory string: CREATE TABLE IF NOT EXISTS %Q.'%q_stat'(id INTEGER PRIMARY KEY, value BLOB);
    Source: dipwo1iToJ.exe, 00000001.00000002.1791797724.00007FFDFABDE000.00000002.00000001.01000000.00000017.sdmpBinary or memory string: CREATE TABLE %Q.'%q_segdir'(level INTEGER,idx INTEGER,start_block INTEGER,leaves_end_block INTEGER,end_block INTEGER,root BLOB,PRIMARY KEY(level, idx));
    Source: dipwo1iToJ.exe, dipwo1iToJ.exe, 00000001.00000002.1791797724.00007FFDFABDE000.00000002.00000001.01000000.00000017.sdmpBinary or memory string: INSERT INTO %Q.sqlite_master VALUES('index',%Q,%Q,#%d,%Q);
    Source: dipwo1iToJ.exe, 00000001.00000002.1791797724.00007FFDFABDE000.00000002.00000001.01000000.00000017.sdmpBinary or memory string: CREATE TABLE %Q.'%q_segments'(blockid INTEGER PRIMARY KEY, block BLOB);
    Source: dipwo1iToJ.exe, 00000001.00000002.1785618265.0000017A61410000.00000004.00001000.00020000.00000000.sdmpBinary or memory string: SELECT a11, a102 FROM nssPrivate WHERE a102 = ?;
    Source: dipwo1iToJ.exe, 00000001.00000002.1791797724.00007FFDFABDE000.00000002.00000001.01000000.00000017.sdmpBinary or memory string: CREATE TABLE "%w"."%w_parent"(nodeno INTEGER PRIMARY KEY,parentnode);
    Source: dipwo1iToJ.exeReversingLabs: Detection: 52%
    Source: C:\Users\user\Desktop\dipwo1iToJ.exeFile read: C:\Users\user\Desktop\dipwo1iToJ.exeJump to behavior
    Source: unknownProcess created: C:\Users\user\Desktop\dipwo1iToJ.exe "C:\Users\user\Desktop\dipwo1iToJ.exe"
    Source: C:\Users\user\Desktop\dipwo1iToJ.exeProcess created: C:\Users\user\Desktop\dipwo1iToJ.exe "C:\Users\user\Desktop\dipwo1iToJ.exe"
    Source: C:\Users\user\Desktop\dipwo1iToJ.exeProcess created: C:\Users\user\Desktop\dipwo1iToJ.exe "C:\Users\user\Desktop\dipwo1iToJ.exe"Jump to behavior
    Source: C:\Users\user\Desktop\dipwo1iToJ.exeSection loaded: uxtheme.dllJump to behavior
    Source: C:\Users\user\Desktop\dipwo1iToJ.exeSection loaded: kernel.appcore.dllJump to behavior
    Source: C:\Users\user\Desktop\dipwo1iToJ.exeSection loaded: version.dllJump to behavior
    Source: C:\Users\user\Desktop\dipwo1iToJ.exeSection loaded: vcruntime140.dllJump to behavior
    Source: C:\Users\user\Desktop\dipwo1iToJ.exeSection loaded: libffi-8.dllJump to behavior
    Source: C:\Users\user\Desktop\dipwo1iToJ.exeSection loaded: libcrypto-3.dllJump to behavior
    Source: C:\Users\user\Desktop\dipwo1iToJ.exeSection loaded: iphlpapi.dllJump to behavior
    Source: C:\Users\user\Desktop\dipwo1iToJ.exeSection loaded: propsys.dllJump to behavior
    Source: C:\Users\user\Desktop\dipwo1iToJ.exeSection loaded: libssl-3.dllJump to behavior
    Source: C:\Users\user\Desktop\dipwo1iToJ.exeSection loaded: mswsock.dllJump to behavior
    Source: C:\Users\user\Desktop\dipwo1iToJ.exeSection loaded: sqlite3.dllJump to behavior
    Source: C:\Users\user\Desktop\dipwo1iToJ.exeSection loaded: kernel.appcore.dllJump to behavior
    Source: C:\Users\user\Desktop\dipwo1iToJ.exeSection loaded: uxtheme.dllJump to behavior
    Source: C:\Users\user\Desktop\dipwo1iToJ.exeSection loaded: wbemcomn.dllJump to behavior
    Source: C:\Users\user\Desktop\dipwo1iToJ.exeSection loaded: amsi.dllJump to behavior
    Source: C:\Users\user\Desktop\dipwo1iToJ.exeSection loaded: userenv.dllJump to behavior
    Source: C:\Users\user\Desktop\dipwo1iToJ.exeSection loaded: profapi.dllJump to behavior
    Source: C:\Users\user\Desktop\dipwo1iToJ.exeSection loaded: wbemcomn.dllJump to behavior
    Source: C:\Users\user\Desktop\dipwo1iToJ.exeSection loaded: msasn1.dllJump to behavior
    Source: C:\Users\user\Desktop\dipwo1iToJ.exeSection loaded: powrprof.dllJump to behavior
    Source: C:\Users\user\Desktop\dipwo1iToJ.exeSection loaded: pdh.dllJump to behavior
    Source: C:\Users\user\Desktop\dipwo1iToJ.exeSection loaded: umpdc.dllJump to behavior
    Source: C:\Users\user\Desktop\dipwo1iToJ.exeSection loaded: wtsapi32.dllJump to behavior
    Source: C:\Users\user\Desktop\dipwo1iToJ.exeSection loaded: pywintypes312.dllJump to behavior
    Source: C:\Users\user\Desktop\dipwo1iToJ.exeSection loaded: vcruntime140_1.dllJump to behavior
    Source: C:\Users\user\Desktop\dipwo1iToJ.exeSection loaded: vcruntime140_1.dllJump to behavior
    Source: C:\Users\user\Desktop\dipwo1iToJ.exeSection loaded: secur32.dllJump to behavior
    Source: C:\Users\user\Desktop\dipwo1iToJ.exeSection loaded: sspicli.dllJump to behavior
    Source: C:\Users\user\Desktop\dipwo1iToJ.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{4590F811-1D3A-11D0-891F-00AA004B2E24}\InprocServer32Jump to behavior
    Source: dipwo1iToJ.exeStatic PE information: Image base 0x140000000 > 0x60000000
    Source: dipwo1iToJ.exeStatic file information: File size 18082384 > 1048576
    Source: dipwo1iToJ.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
    Source: dipwo1iToJ.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
    Source: dipwo1iToJ.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
    Source: dipwo1iToJ.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
    Source: dipwo1iToJ.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
    Source: dipwo1iToJ.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT
    Source: dipwo1iToJ.exeStatic PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, GUARD_CF, TERMINAL_SERVER_AWARE
    Source: dipwo1iToJ.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
    Source: Binary string: D:\a\1\b\bin\amd64\python312.pdb source: dipwo1iToJ.exe, 00000001.00000002.1797680341.00007FFDFB5F4000.00000002.00000001.01000000.00000004.sdmp
    Source: Binary string: D:\a\1\b\bin\amd64\unicodedata.pdb source: dipwo1iToJ.exe, 00000001.00000002.1790259151.00007FFDFAA9F000.00000002.00000001.01000000.0000001A.sdmp
    Source: Binary string: cryptography_rust.pdbc source: dipwo1iToJ.exe, 00000001.00000002.1789007887.00007FFDFA7AA000.00000002.00000001.01000000.00000029.sdmp
    Source: Binary string: @ compiler: cl /Zi /Fdossl_static.pdb /Gs0 /GF /Gy /MD /W3 /wd4090 /nologo /O2 -DL_ENDIAN -DOPENSSL_PICOpenSSL 3.0.11 19 Sep 20233.0.11built on: Wed Sep 27 22:33:28 2023 UTCplatform: VC-WIN64A-masmOPENSSLDIR: "C:\Program Files\Common Files\SSL"ENGINESDIR: "C:\Program Files\OpenSSL\lib\engines-3"MODULESDIR: "C:\Program Files\OpenSSL\lib\ossl-modules"CPUINFO: N/Anot availableget_and_lock..\s\crypto\ex_data.cossl_crypto_get_ex_new_index_exossl_crypto_new_ex_data_exCRYPTO_dup_ex_dataCRYPTO_set_ex_dataOPENSSL_WIN32_UTF8..\s\crypto\getenv.ccompiler: cl /Zi /Fdossl_static.pdb /Gs0 /GF /Gy /MD /W3 /wd4090 /nologo /O2 -DL_ENDIAN -DOPENSSL_PIC;CPUINFO: OPENSSL_ia32cap=0x%llx:0x%llxOPENSSL_ia32cap env:%sos-specificC:\Program Files\Common Files\SSLC:\Program Files\OpenSSL\lib\ossl-modules.dllCPUINFO: ..\s\crypto\init.cOPENSSL_init_cryptoOPENSSL_atexit..\s\crypto\initthread.c..\s\crypto\mem_sec.cassertion failed: (bit & 1) == 0assertion failed: list >= 0 && list < sh.freelist_sizeassertion failed: ((ptr - sh.arena) & ((sh.arena_size >> list) - 1)) == 0assertion failed: bit > 0 && bit < sh.bittable_sizeassertion failed: TESTBIT(table, bit)assertion failed: !TESTBIT(table, bit)assertion failed: WITHIN_FREELIST(list)assertion failed: WITHIN_ARENA(ptr)assertion failed: temp->next == NULL || WITHIN_ARENA(temp->next)assertion failed: (char **)temp->next->p_next == listassertion failed: WITHIN_FREELIST(temp2->p_next) || WITHIN_ARENA(temp2->p_next)assertion failed: size > 0assertion failed: (size & (size - 1)) == 0assertion failed: (minsize & (minsize - 1)) == 0assertion failed: sh.freelist != NULLassertion failed: sh.bittable != NULLassertion failed: sh.bitmalloc != NULLassertion failed: !sh_testbit(temp, slist, sh.bitmalloc)assertion failed: temp != sh.freelist[slist]assertion failed: sh.freelist[slist] == tempassertion failed: temp-(sh.arena_size >> slist) == sh_find_my_buddy(temp, slist)assertion failed: sh_testbit(chunk, list, sh.bittable)assertion failed: WITHIN_ARENA(chunk)assertion failed: sh_testbit(ptr, list, sh.bittable)assertion failed: ptr == sh_find_my_buddy(buddy, list)assertion failed: ptr != NULLassertion failed: !sh_testbit(ptr, list, sh.bitmalloc)assertion failed: sh.freelist[list] == ptr/*0123456789ABCDEFCRYPTO_memdup..\s\crypto\o_str.chexstr2buf_sepossl_hexstr2buf_sepbuf2hexstr_sepossl_buf2hexstr_sep..\s\crypto\packet.cwpacket_intern_init_lenWPACKET_start_sub_packet_len__..\s\crypto\param_build.cparam_pushparam_push_numOSSL_PARAM_BLD_push_BN_padNegative big numbers are unsupported for OSSL_PARAMOSSL_PARAM_BLD_push_utf8_stringOSSL_PARAM_BLD_push_utf8_ptrOSSL_PARAM_BLD_push_octet_stringOSSL_PARAM_BLD_push_octet_ptrOSSL_PARAM_BLD_to_param..\s\crypto\params.c source: dipwo1iToJ.exe, 00000001.00000002.1796919404.00007FFDFB092000.00000002.00000001.01000000.0000000C.sdmp
    Source: Binary string: D:\a\1\b\bin\amd64\_decimal.pdb source: _decimal.pyd.0.dr
    Source: Binary string: compiler: cl /Zi /Fdossl_static.pdb /Gs0 /GF /Gy /MD /W3 /wd4090 /nologo /O2 -DL_ENDIAN -DOPENSSL_PIC source: dipwo1iToJ.exe, 00000001.00000002.1796919404.00007FFDFB092000.00000002.00000001.01000000.0000000C.sdmp
    Source: Binary string: crypto\bn\bn_ctx.cBN_CTX_startBN_CTX_getossl_ec_group_new_excrypto\ec\ec_lib.cEC_GROUP_copyEC_GROUP_set_generatorEC_GROUP_set_curveEC_GROUP_get_curveEC_GROUP_get_degreeEC_GROUP_check_discriminantEC_POINT_newEC_POINT_copyEC_POINT_set_to_infinityEC_POINT_set_Jprojective_coordinates_GFpEC_POINT_set_affine_coordinatesEC_POINT_get_affine_coordinatesEC_POINT_addEC_POINT_dblEC_POINT_invertEC_POINT_is_at_infinityEC_POINT_is_on_curveEC_POINT_cmpEC_POINT_mulEC_GROUP_get_trinomial_basisEC_GROUP_get_pentanomial_basisgroup_new_from_nameossl_ec_group_set_paramsencodingdecoded-from-explicitEC_GROUP_new_from_paramsgeneratorcrypto\evp\digest.cevp_md_ctx_new_exevp_md_ctx_free_algctxevp_md_init_internalEVP_DigestUpdatesizeEVP_DigestFinal_exassertion failed: mdsize <= EVP_MAX_MD_SIZEEVP_DigestFinalXOFxoflenEVP_MD_CTX_copy_exEVP_MD_CTX_ctrlmicalgssl3-msblocksizexofalgid-absentevp_md_from_algorithmupdatecrypto\evp\m_sigver.cUNDEFdo_sigver_initEVP_DigestSignUpdateEVP_DigestVerifyUpdateEVP_DigestSignFinalEVP_DigestSignEVP_DigestVerifyFinalEVP_DigestVerifycompiler: cl /Zi /Fdossl_static.pdb /MT /Zl /Gs0 /GF /Gy /W3 /wd4090 /nologo /O2 -DL_ENDIAN -DOPENSSL_PIC -D"OPENSSL_BUILDING_OPENSSL" -D"OPENSSL_SYS_WIN32" -D"WIN32_LEAN_AND_MEAN" -D"UNICODE" -D"_UNICODE" -D"_CRT_SECURE_NO_DEPRECATE" -D"_WINSOCK_DEPRECATED_NO_WARNINGS" -D"NDEBUG"3.3.2built on: Fri Oct 18 00:15:00 2024 UTCplatform: VC-WIN64AOPENSSLDIR: "C:\Program Files\Common Files\SSL"ENGINESDIR: "C:\Program Files\OpenSSL\lib\engines-3"MODULESDIR: "C:\Program Files\OpenSSL\lib\ossl-modules"CPUINFO: N/Anot availablecrypto\init.cOPENSSL_init_cryptocrypto\bio\bio_lib.cBIO_new_exbio_read_internbio_write_internBIO_sendmmsgBIO_recvmmsgBIO_putsBIO_getsBIO_get_line BIO_ctrlBIO_callback_ctrlBIO_find_type source: dipwo1iToJ.exe, 00000001.00000002.1789007887.00007FFDFA7AA000.00000002.00000001.01000000.00000029.sdmp
    Source: Binary string: D:\a\1\b\bin\amd64\_overlapped.pdb source: dipwo1iToJ.exe, 00000001.00000002.1804397735.00007FFE120C6000.00000002.00000001.01000000.00000015.sdmp
    Source: Binary string: ossl_ec_GFp_simple_group_set_curvecrypto\ec\ecp_smpl.cossl_ec_GFp_simple_group_check_discriminantossl_ec_GFp_simple_point_set_affine_coordinatesossl_ec_GFp_simple_point_get_affine_coordinatesossl_ec_GFp_simple_make_affineossl_ec_GFp_simple_points_make_affineossl_ec_GFp_simple_field_invossl_ec_GFp_simple_blind_coordinatescrypto\engine\tb_digest.cENGINE_get_digestcompiler: cl /Zi /Fdossl_static.pdb /MT /Zl /Gs0 /GF /Gy /W3 /wd4090 /nologo /O2 -DL_ENDIAN -DOPENSSL_PIC -D"OPENSSL_BUILDING_OPENSSL" -D"OPENSSL_SYS_WIN32" -D"WIN32_LEAN_AND_MEAN" -D"UNICODE" -D"_UNICODE" -D"_CRT_SECURE_NO_DEPRECATE" -D"_WINSOCK_DEPRECATED_NO_WARNINGS" -D"NDEBUG";CPUINFO: OPENSSL_ia32cap=0x%llx:0x%llxOPENSSL_ia32cap env:%sos-specific.dllCPUINFO: crypto\initthread.cOPENSSL_ia32cap source: dipwo1iToJ.exe, 00000001.00000002.1789007887.00007FFDFA7AA000.00000002.00000001.01000000.00000029.sdmp
    Source: Binary string: D:\a\_work\1\s\binaries\amd64ret\bin\amd64\\vcruntime140.amd64.pdb source: dipwo1iToJ.exe, 00000000.00000003.1684977147.000001ECBC747000.00000004.00000020.00020000.00000000.sdmp, dipwo1iToJ.exe, 00000001.00000002.1804789057.00007FFE13221000.00000002.00000001.01000000.00000005.sdmp, VCRUNTIME140.dll.0.dr
    Source: Binary string: D:\a\_work\1\s\binaries\amd64ret\bin\amd64\\vcruntime140.amd64.pdbGCTL source: dipwo1iToJ.exe, 00000000.00000003.1684977147.000001ECBC747000.00000004.00000020.00020000.00000000.sdmp, dipwo1iToJ.exe, 00000001.00000002.1804789057.00007FFE13221000.00000002.00000001.01000000.00000005.sdmp, VCRUNTIME140.dll.0.dr
    Source: Binary string: D:\a\1\b\bin\amd64\sqlite3.pdb source: dipwo1iToJ.exe, 00000001.00000002.1791797724.00007FFDFABDE000.00000002.00000001.01000000.00000017.sdmp
    Source: Binary string: D:\a\pywin32\pywin32\build\temp.win-amd64-cpython-312\Release\pywintypes.pdb source: dipwo1iToJ.exe, 00000001.00000002.1799830423.00007FFE00011000.00000002.00000001.01000000.00000027.sdmp, pywintypes312.dll.0.dr
    Source: Binary string: D:\a\pywin32\pywin32\build\temp.win-amd64-cpython-312\Release\pywintypes.pdb** source: dipwo1iToJ.exe, 00000001.00000002.1799830423.00007FFE00011000.00000002.00000001.01000000.00000027.sdmp, pywintypes312.dll.0.dr
    Source: Binary string: D:\a\1\b\bin\amd64\_multiprocessing.pdb source: _multiprocessing.pyd.0.dr
    Source: Binary string: compiler: cl /Zi /Fdossl_static.pdb /MT /Zl /Gs0 /GF /Gy /W3 /wd4090 /nologo /O2 -DL_ENDIAN -DOPENSSL_PIC -D"OPENSSL_BUILDING_OPENSSL" -D"OPENSSL_SYS_WIN32" -D"WIN32_LEAN_AND_MEAN" -D"UNICODE" -D"_UNICODE" -D"_CRT_SECURE_NO_DEPRECATE" -D"_WINSOCK_DEPRECATED_NO_WARNINGS" -D"NDEBUG" source: dipwo1iToJ.exe, 00000001.00000002.1789007887.00007FFDFA7AA000.00000002.00000001.01000000.00000029.sdmp
    Source: Binary string: D:\a\_work\1\s\binaries\amd64ret\bin\amd64\\vcruntime140_1.amd64.pdb source: dipwo1iToJ.exe, 00000000.00000003.1685298094.000001ECBC747000.00000004.00000020.00020000.00000000.sdmp, dipwo1iToJ.exe, 00000001.00000002.1803196864.00007FFE11075000.00000002.00000001.01000000.00000028.sdmp, VCRUNTIME140_1.dll.0.dr
    Source: Binary string: D:\a\1\b\bin\amd64\select.pdb source: dipwo1iToJ.exe, 00000001.00000002.1804676413.00007FFE13203000.00000002.00000001.01000000.0000000E.sdmp, select.pyd.0.dr
    Source: Binary string: D:\a\1\b\bin\amd64\_ctypes.pdb source: dipwo1iToJ.exe, 00000001.00000002.1804294901.00007FFE11EE1000.00000002.00000001.01000000.00000007.sdmp, _ctypes.pyd.0.dr
    Source: Binary string: D:\a\1\b\bin\amd64\_hashlib.pdb source: dipwo1iToJ.exe, 00000001.00000002.1803442290.00007FFE11507000.00000002.00000001.01000000.0000000B.sdmp, _hashlib.pyd.0.dr
    Source: Binary string: D:\a\1\b\bin\amd64\_decimal.pdb$$ source: _decimal.pyd.0.dr
    Source: Binary string: D:\a\1\b\libssl-3.pdbEE source: dipwo1iToJ.exe, 00000001.00000002.1793377703.00007FFDFACA5000.00000002.00000001.01000000.00000013.sdmp
    Source: Binary string: D:\a\1\b\bin\amd64\_lzma.pdbNN source: dipwo1iToJ.exe, 00000001.00000002.1803578810.00007FFE1153C000.00000002.00000001.01000000.0000000A.sdmp
    Source: Binary string: D:\a\1\b\bin\amd64\_uuid.pdb source: dipwo1iToJ.exe, 00000001.00000002.1803322459.00007FFE110F2000.00000002.00000001.01000000.00000023.sdmp, _uuid.pyd.0.dr
    Source: Binary string: D:\a\1\b\bin\amd64\_asyncio.pdb source: dipwo1iToJ.exe, 00000000.00000003.1685437325.000001ECBC747000.00000004.00000020.00020000.00000000.sdmp, dipwo1iToJ.exe, 00000001.00000002.1802758529.00007FFE101D8000.00000002.00000001.01000000.00000014.sdmp, _asyncio.pyd.0.dr
    Source: Binary string: D:\a\1\b\bin\amd64\pyexpat.pdb source: dipwo1iToJ.exe, 00000001.00000002.1802907428.00007FFE10252000.00000002.00000001.01000000.00000010.sdmp, pyexpat.pyd.0.dr
    Source: Binary string: D:\a\1\b\bin\amd64\_queue.pdb source: dipwo1iToJ.exe, 00000001.00000002.1804490140.00007FFE12E13000.00000002.00000001.01000000.00000011.sdmp
    Source: Binary string: D:\a\1\b\bin\amd64\_lzma.pdb source: dipwo1iToJ.exe, 00000001.00000002.1803578810.00007FFE1153C000.00000002.00000001.01000000.0000000A.sdmp
    Source: Binary string: D:\a\1\b\bin\amd64\_bz2.pdb source: dipwo1iToJ.exe, 00000000.00000003.1685593932.000001ECBC747000.00000004.00000020.00020000.00000000.sdmp, dipwo1iToJ.exe, 00000001.00000002.1804189678.00007FFE11EBD000.00000002.00000001.01000000.00000009.sdmp
    Source: Binary string: D:\a\1\b\bin\amd64\_wmi.pdb source: dipwo1iToJ.exe, 00000001.00000002.1804584285.00007FFE130C4000.00000002.00000001.01000000.0000000F.sdmp, _wmi.pyd.0.dr
    Source: Binary string: D:\a\pywin32\pywin32\build\temp.win-amd64-cpython-312\Release\win32api.pdb!! source: dipwo1iToJ.exe, 00000001.00000002.1799958060.00007FFE00743000.00000002.00000001.01000000.00000026.sdmp, win32api.pyd.0.dr
    Source: Binary string: D:\a\pywin32\pywin32\build\temp.win-amd64-cpython-312\Release\win32api.pdb source: dipwo1iToJ.exe, 00000001.00000002.1799958060.00007FFE00743000.00000002.00000001.01000000.00000026.sdmp, win32api.pyd.0.dr
    Source: Binary string: D:\a\1\b\bin\amd64\_socket.pdb source: dipwo1iToJ.exe, 00000001.00000002.1803074322.00007FFE10309000.00000002.00000001.01000000.0000000D.sdmp, _socket.pyd.0.dr
    Source: Binary string: cryptography_rust.pdb source: dipwo1iToJ.exe, 00000001.00000002.1789007887.00007FFDFA7AA000.00000002.00000001.01000000.00000029.sdmp
    Source: Binary string: D:\a\1\b\bin\amd64\_wmi.pdb''&GCTL source: dipwo1iToJ.exe, 00000001.00000002.1804584285.00007FFE130C4000.00000002.00000001.01000000.0000000F.sdmp, _wmi.pyd.0.dr
    Source: Binary string: D:\a\1\b\bin\amd64\_sqlite3.pdb source: dipwo1iToJ.exe, 00000001.00000002.1802335498.00007FFE0EB2F000.00000002.00000001.01000000.00000016.sdmp
    Source: Binary string: D:\a\1\b\bin\amd64\python3.pdb source: dipwo1iToJ.exe, 00000001.00000002.1783720389.0000017A60550000.00000002.00000001.01000000.00000006.sdmp
    Source: Binary string: D:\a\_work\1\s\binaries\amd64ret\bin\amd64\\vcruntime140_1.amd64.pdbGCTL source: dipwo1iToJ.exe, 00000000.00000003.1685298094.000001ECBC747000.00000004.00000020.00020000.00000000.sdmp, dipwo1iToJ.exe, 00000001.00000002.1803196864.00007FFE11075000.00000002.00000001.01000000.00000028.sdmp, VCRUNTIME140_1.dll.0.dr
    Source: Binary string: D:\a\1\b\libssl-3.pdb source: dipwo1iToJ.exe, 00000001.00000002.1793377703.00007FFDFACA5000.00000002.00000001.01000000.00000013.sdmp
    Source: Binary string: D:\a\1\b\bin\amd64\_ssl.pdb source: dipwo1iToJ.exe, 00000001.00000002.1802493358.00007FFE0EB4D000.00000002.00000001.01000000.00000012.sdmp, _ssl.pyd.0.dr
    Source: dipwo1iToJ.exeStatic PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
    Source: dipwo1iToJ.exeStatic PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
    Source: dipwo1iToJ.exeStatic PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
    Source: dipwo1iToJ.exeStatic PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
    Source: dipwo1iToJ.exeStatic PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata
    Source: python312.dll.0.drStatic PE information: section name: PyRuntim
    Source: VCRUNTIME140.dll.0.drStatic PE information: section name: _RDATA
    Source: libcrypto-3.dll.0.drStatic PE information: section name: .00cfg
    Source: libssl-3.dll.0.drStatic PE information: section name: .00cfg
    Source: C:\Users\user\Desktop\dipwo1iToJ.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI68642\Crypto\Util\_strxor.pydJump to dropped file
    Source: C:\Users\user\Desktop\dipwo1iToJ.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI68642\VCRUNTIME140_1.dllJump to dropped file
    Source: C:\Users\user\Desktop\dipwo1iToJ.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI68642\Crypto\Hash\_SHA224.pydJump to dropped file
    Source: C:\Users\user\Desktop\dipwo1iToJ.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI68642\aiohttp\_http_parser.cp312-win_amd64.pydJump to dropped file
    Source: C:\Users\user\Desktop\dipwo1iToJ.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI68642\Crypto\Util\_cpuid_c.pydJump to dropped file
    Source: C:\Users\user\Desktop\dipwo1iToJ.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI68642\sqlite3.dllJump to dropped file
    Source: C:\Users\user\Desktop\dipwo1iToJ.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI68642\pyexpat.pydJump to dropped file
    Source: C:\Users\user\Desktop\dipwo1iToJ.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI68642\Crypto\Hash\_ghash_clmul.pydJump to dropped file
    Source: C:\Users\user\Desktop\dipwo1iToJ.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI68642\win32\win32api.pydJump to dropped file
    Source: C:\Users\user\Desktop\dipwo1iToJ.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI68642\_asyncio.pydJump to dropped file
    Source: C:\Users\user\Desktop\dipwo1iToJ.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI68642\libffi-8.dllJump to dropped file
    Source: C:\Users\user\Desktop\dipwo1iToJ.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI68642\psutil\_psutil_windows.pydJump to dropped file
    Source: C:\Users\user\Desktop\dipwo1iToJ.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI68642\Crypto\Hash\_MD2.pydJump to dropped file
    Source: C:\Users\user\Desktop\dipwo1iToJ.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI68642\_uuid.pydJump to dropped file
    Source: C:\Users\user\Desktop\dipwo1iToJ.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI68642\Crypto\Hash\_poly1305.pydJump to dropped file
    Source: C:\Users\user\Desktop\dipwo1iToJ.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI68642\python3.dllJump to dropped file
    Source: C:\Users\user\Desktop\dipwo1iToJ.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI68642\charset_normalizer\md__mypyc.cp312-win_amd64.pydJump to dropped file
    Source: C:\Users\user\Desktop\dipwo1iToJ.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI68642\Crypto\Cipher\_raw_des.pydJump to dropped file
    Source: C:\Users\user\Desktop\dipwo1iToJ.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI68642\Crypto\Cipher\_chacha20.pydJump to dropped file
    Source: C:\Users\user\Desktop\dipwo1iToJ.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI68642\_hashlib.pydJump to dropped file
    Source: C:\Users\user\Desktop\dipwo1iToJ.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI68642\Crypto\Cipher\_raw_aes.pydJump to dropped file
    Source: C:\Users\user\Desktop\dipwo1iToJ.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI68642\aiohttp\_websocket\mask.cp312-win_amd64.pydJump to dropped file
    Source: C:\Users\user\Desktop\dipwo1iToJ.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI68642\_bz2.pydJump to dropped file
    Source: C:\Users\user\Desktop\dipwo1iToJ.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI68642\_multiprocessing.pydJump to dropped file
    Source: C:\Users\user\Desktop\dipwo1iToJ.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI68642\Crypto\Cipher\_raw_ocb.pydJump to dropped file
    Source: C:\Users\user\Desktop\dipwo1iToJ.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI68642\Crypto\PublicKey\_ed25519.pydJump to dropped file
    Source: C:\Users\user\Desktop\dipwo1iToJ.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI68642\Crypto\Cipher\_raw_ofb.pydJump to dropped file
    Source: C:\Users\user\Desktop\dipwo1iToJ.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI68642\Crypto\Cipher\_raw_ecb.pydJump to dropped file
    Source: C:\Users\user\Desktop\dipwo1iToJ.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI68642\select.pydJump to dropped file
    Source: C:\Users\user\Desktop\dipwo1iToJ.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI68642\_decimal.pydJump to dropped file
    Source: C:\Users\user\Desktop\dipwo1iToJ.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI68642\Crypto\PublicKey\_ed448.pydJump to dropped file
    Source: C:\Users\user\Desktop\dipwo1iToJ.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI68642\_overlapped.pydJump to dropped file
    Source: C:\Users\user\Desktop\dipwo1iToJ.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI68642\Crypto\Hash\_MD4.pydJump to dropped file
    Source: C:\Users\user\Desktop\dipwo1iToJ.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI68642\Crypto\Hash\_keccak.pydJump to dropped file
    Source: C:\Users\user\Desktop\dipwo1iToJ.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI68642\aiohttp\_websocket\reader_c.cp312-win_amd64.pydJump to dropped file
    Source: C:\Users\user\Desktop\dipwo1iToJ.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI68642\pywin32_system32\pywintypes312.dllJump to dropped file
    Source: C:\Users\user\Desktop\dipwo1iToJ.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI68642\aiohttp\_http_writer.cp312-win_amd64.pydJump to dropped file
    Source: C:\Users\user\Desktop\dipwo1iToJ.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI68642\VCRUNTIME140.dllJump to dropped file
    Source: C:\Users\user\Desktop\dipwo1iToJ.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI68642\_sqlite3.pydJump to dropped file
    Source: C:\Users\user\Desktop\dipwo1iToJ.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI68642\Crypto\Cipher\_raw_blowfish.pydJump to dropped file
    Source: C:\Users\user\Desktop\dipwo1iToJ.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI68642\Crypto\Hash\_SHA1.pydJump to dropped file
    Source: C:\Users\user\Desktop\dipwo1iToJ.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI68642\libcrypto-3.dllJump to dropped file
    Source: C:\Users\user\Desktop\dipwo1iToJ.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI68642\_cffi_backend.cp312-win_amd64.pydJump to dropped file
    Source: C:\Users\user\Desktop\dipwo1iToJ.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI68642\multidict\_multidict.cp312-win_amd64.pydJump to dropped file
    Source: C:\Users\user\Desktop\dipwo1iToJ.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI68642\Crypto\Hash\_MD5.pydJump to dropped file
    Source: C:\Users\user\Desktop\dipwo1iToJ.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI68642\yarl\_quoting_c.cp312-win_amd64.pydJump to dropped file
    Source: C:\Users\user\Desktop\dipwo1iToJ.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI68642\Crypto\Hash\_ghash_portable.pydJump to dropped file
    Source: C:\Users\user\Desktop\dipwo1iToJ.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI68642\libssl-3.dllJump to dropped file
    Source: C:\Users\user\Desktop\dipwo1iToJ.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI68642\unicodedata.pydJump to dropped file
    Source: C:\Users\user\Desktop\dipwo1iToJ.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI68642\propcache\_helpers_c.cp312-win_amd64.pydJump to dropped file
    Source: C:\Users\user\Desktop\dipwo1iToJ.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI68642\Crypto\Cipher\_raw_cbc.pydJump to dropped file
    Source: C:\Users\user\Desktop\dipwo1iToJ.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI68642\python312.dllJump to dropped file
    Source: C:\Users\user\Desktop\dipwo1iToJ.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI68642\Crypto\PublicKey\_curve25519.pydJump to dropped file
    Source: C:\Users\user\Desktop\dipwo1iToJ.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI68642\_wmi.pydJump to dropped file
    Source: C:\Users\user\Desktop\dipwo1iToJ.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI68642\Crypto\Cipher\_raw_aesni.pydJump to dropped file
    Source: C:\Users\user\Desktop\dipwo1iToJ.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI68642\Crypto\Hash\_RIPEMD160.pydJump to dropped file
    Source: C:\Users\user\Desktop\dipwo1iToJ.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI68642\_queue.pydJump to dropped file
    Source: C:\Users\user\Desktop\dipwo1iToJ.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI68642\_socket.pydJump to dropped file
    Source: C:\Users\user\Desktop\dipwo1iToJ.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI68642\Crypto\Cipher\_Salsa20.pydJump to dropped file
    Source: C:\Users\user\Desktop\dipwo1iToJ.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI68642\Crypto\Hash\_BLAKE2b.pydJump to dropped file
    Source: C:\Users\user\Desktop\dipwo1iToJ.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI68642\Crypto\Hash\_BLAKE2s.pydJump to dropped file
    Source: C:\Users\user\Desktop\dipwo1iToJ.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI68642\Crypto\Hash\_SHA384.pydJump to dropped file
    Source: C:\Users\user\Desktop\dipwo1iToJ.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI68642\frozenlist\_frozenlist.cp312-win_amd64.pydJump to dropped file
    Source: C:\Users\user\Desktop\dipwo1iToJ.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI68642\Crypto\Cipher\_pkcs1_decode.pydJump to dropped file
    Source: C:\Users\user\Desktop\dipwo1iToJ.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI68642\Crypto\PublicKey\_curve448.pydJump to dropped file
    Source: C:\Users\user\Desktop\dipwo1iToJ.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI68642\Crypto\PublicKey\_ec_ws.pydJump to dropped file
    Source: C:\Users\user\Desktop\dipwo1iToJ.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI68642\_ssl.pydJump to dropped file
    Source: C:\Users\user\Desktop\dipwo1iToJ.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI68642\Crypto\Hash\_SHA256.pydJump to dropped file
    Source: C:\Users\user\Desktop\dipwo1iToJ.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI68642\Crypto\Cipher\_raw_ctr.pydJump to dropped file
    Source: C:\Users\user\Desktop\dipwo1iToJ.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI68642\Crypto\Cipher\_raw_cast.pydJump to dropped file
    Source: C:\Users\user\Desktop\dipwo1iToJ.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI68642\Crypto\Math\_modexp.pydJump to dropped file
    Source: C:\Users\user\Desktop\dipwo1iToJ.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI68642\Crypto\Cipher\_raw_arc2.pydJump to dropped file
    Source: C:\Users\user\Desktop\dipwo1iToJ.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI68642\Crypto\Cipher\_ARC4.pydJump to dropped file
    Source: C:\Users\user\Desktop\dipwo1iToJ.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI68642\Crypto\Cipher\_raw_eksblowfish.pydJump to dropped file
    Source: C:\Users\user\Desktop\dipwo1iToJ.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI68642\_lzma.pydJump to dropped file
    Source: C:\Users\user\Desktop\dipwo1iToJ.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI68642\cryptography\hazmat\bindings\_rust.pydJump to dropped file
    Source: C:\Users\user\Desktop\dipwo1iToJ.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI68642\charset_normalizer\md.cp312-win_amd64.pydJump to dropped file
    Source: C:\Users\user\Desktop\dipwo1iToJ.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI68642\Crypto\Hash\_SHA512.pydJump to dropped file
    Source: C:\Users\user\Desktop\dipwo1iToJ.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI68642\Crypto\Protocol\_scrypt.pydJump to dropped file
    Source: C:\Users\user\Desktop\dipwo1iToJ.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI68642\_ctypes.pydJump to dropped file
    Source: C:\Users\user\Desktop\dipwo1iToJ.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI68642\Crypto\Cipher\_raw_des3.pydJump to dropped file
    Source: C:\Users\user\Desktop\dipwo1iToJ.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI68642\Crypto\Cipher\_raw_cfb.pydJump to dropped file
    Source: C:\Users\user\Desktop\dipwo1iToJ.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI68642\setuptools\_vendor\wheel-0.43.0.dist-info\LICENSE.txtJump to behavior
    Source: C:\Users\user\Desktop\dipwo1iToJ.exeCode function: 0_2_00007FF6F8FC76B0 GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,0_2_00007FF6F8FC76B0
    Source: C:\Users\user\Desktop\dipwo1iToJ.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Users\user\Desktop\dipwo1iToJ.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI68642\Crypto\Util\_strxor.pydJump to dropped file
    Source: C:\Users\user\Desktop\dipwo1iToJ.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI68642\Crypto\Hash\_SHA224.pydJump to dropped file
    Source: C:\Users\user\Desktop\dipwo1iToJ.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI68642\aiohttp\_http_parser.cp312-win_amd64.pydJump to dropped file
    Source: C:\Users\user\Desktop\dipwo1iToJ.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI68642\Crypto\Util\_cpuid_c.pydJump to dropped file
    Source: C:\Users\user\Desktop\dipwo1iToJ.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI68642\pyexpat.pydJump to dropped file
    Source: C:\Users\user\Desktop\dipwo1iToJ.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI68642\Crypto\Hash\_ghash_clmul.pydJump to dropped file
    Source: C:\Users\user\Desktop\dipwo1iToJ.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI68642\win32\win32api.pydJump to dropped file
    Source: C:\Users\user\Desktop\dipwo1iToJ.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI68642\_asyncio.pydJump to dropped file
    Source: C:\Users\user\Desktop\dipwo1iToJ.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI68642\psutil\_psutil_windows.pydJump to dropped file
    Source: C:\Users\user\Desktop\dipwo1iToJ.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI68642\Crypto\Hash\_MD2.pydJump to dropped file
    Source: C:\Users\user\Desktop\dipwo1iToJ.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI68642\_uuid.pydJump to dropped file
    Source: C:\Users\user\Desktop\dipwo1iToJ.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI68642\Crypto\Hash\_poly1305.pydJump to dropped file
    Source: C:\Users\user\Desktop\dipwo1iToJ.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI68642\python3.dllJump to dropped file
    Source: C:\Users\user\Desktop\dipwo1iToJ.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI68642\charset_normalizer\md__mypyc.cp312-win_amd64.pydJump to dropped file
    Source: C:\Users\user\Desktop\dipwo1iToJ.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI68642\Crypto\Cipher\_raw_des.pydJump to dropped file
    Source: C:\Users\user\Desktop\dipwo1iToJ.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI68642\Crypto\Cipher\_chacha20.pydJump to dropped file
    Source: C:\Users\user\Desktop\dipwo1iToJ.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI68642\_hashlib.pydJump to dropped file
    Source: C:\Users\user\Desktop\dipwo1iToJ.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI68642\Crypto\Cipher\_raw_aes.pydJump to dropped file
    Source: C:\Users\user\Desktop\dipwo1iToJ.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI68642\aiohttp\_websocket\mask.cp312-win_amd64.pydJump to dropped file
    Source: C:\Users\user\Desktop\dipwo1iToJ.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI68642\_bz2.pydJump to dropped file
    Source: C:\Users\user\Desktop\dipwo1iToJ.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI68642\_multiprocessing.pydJump to dropped file
    Source: C:\Users\user\Desktop\dipwo1iToJ.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI68642\Crypto\Cipher\_raw_ocb.pydJump to dropped file
    Source: C:\Users\user\Desktop\dipwo1iToJ.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI68642\Crypto\PublicKey\_ed25519.pydJump to dropped file
    Source: C:\Users\user\Desktop\dipwo1iToJ.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI68642\Crypto\Cipher\_raw_ofb.pydJump to dropped file
    Source: C:\Users\user\Desktop\dipwo1iToJ.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI68642\Crypto\Cipher\_raw_ecb.pydJump to dropped file
    Source: C:\Users\user\Desktop\dipwo1iToJ.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI68642\select.pydJump to dropped file
    Source: C:\Users\user\Desktop\dipwo1iToJ.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI68642\_decimal.pydJump to dropped file
    Source: C:\Users\user\Desktop\dipwo1iToJ.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI68642\Crypto\PublicKey\_ed448.pydJump to dropped file
    Source: C:\Users\user\Desktop\dipwo1iToJ.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI68642\_overlapped.pydJump to dropped file
    Source: C:\Users\user\Desktop\dipwo1iToJ.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI68642\aiohttp\_websocket\reader_c.cp312-win_amd64.pydJump to dropped file
    Source: C:\Users\user\Desktop\dipwo1iToJ.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI68642\Crypto\Hash\_MD4.pydJump to dropped file
    Source: C:\Users\user\Desktop\dipwo1iToJ.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI68642\Crypto\Hash\_keccak.pydJump to dropped file
    Source: C:\Users\user\Desktop\dipwo1iToJ.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI68642\aiohttp\_http_writer.cp312-win_amd64.pydJump to dropped file
    Source: C:\Users\user\Desktop\dipwo1iToJ.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI68642\_sqlite3.pydJump to dropped file
    Source: C:\Users\user\Desktop\dipwo1iToJ.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI68642\Crypto\Cipher\_raw_blowfish.pydJump to dropped file
    Source: C:\Users\user\Desktop\dipwo1iToJ.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI68642\Crypto\Hash\_SHA1.pydJump to dropped file
    Source: C:\Users\user\Desktop\dipwo1iToJ.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI68642\multidict\_multidict.cp312-win_amd64.pydJump to dropped file
    Source: C:\Users\user\Desktop\dipwo1iToJ.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI68642\_cffi_backend.cp312-win_amd64.pydJump to dropped file
    Source: C:\Users\user\Desktop\dipwo1iToJ.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI68642\yarl\_quoting_c.cp312-win_amd64.pydJump to dropped file
    Source: C:\Users\user\Desktop\dipwo1iToJ.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI68642\Crypto\Hash\_MD5.pydJump to dropped file
    Source: C:\Users\user\Desktop\dipwo1iToJ.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI68642\Crypto\Hash\_ghash_portable.pydJump to dropped file
    Source: C:\Users\user\Desktop\dipwo1iToJ.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI68642\unicodedata.pydJump to dropped file
    Source: C:\Users\user\Desktop\dipwo1iToJ.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI68642\propcache\_helpers_c.cp312-win_amd64.pydJump to dropped file
    Source: C:\Users\user\Desktop\dipwo1iToJ.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI68642\Crypto\Cipher\_raw_cbc.pydJump to dropped file
    Source: C:\Users\user\Desktop\dipwo1iToJ.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI68642\python312.dllJump to dropped file
    Source: C:\Users\user\Desktop\dipwo1iToJ.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI68642\Crypto\PublicKey\_curve25519.pydJump to dropped file
    Source: C:\Users\user\Desktop\dipwo1iToJ.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI68642\_wmi.pydJump to dropped file
    Source: C:\Users\user\Desktop\dipwo1iToJ.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI68642\Crypto\Cipher\_raw_aesni.pydJump to dropped file
    Source: C:\Users\user\Desktop\dipwo1iToJ.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI68642\_socket.pydJump to dropped file
    Source: C:\Users\user\Desktop\dipwo1iToJ.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI68642\Crypto\Hash\_RIPEMD160.pydJump to dropped file
    Source: C:\Users\user\Desktop\dipwo1iToJ.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI68642\_queue.pydJump to dropped file
    Source: C:\Users\user\Desktop\dipwo1iToJ.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI68642\Crypto\Cipher\_Salsa20.pydJump to dropped file
    Source: C:\Users\user\Desktop\dipwo1iToJ.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI68642\Crypto\Hash\_BLAKE2b.pydJump to dropped file
    Source: C:\Users\user\Desktop\dipwo1iToJ.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI68642\Crypto\Hash\_BLAKE2s.pydJump to dropped file
    Source: C:\Users\user\Desktop\dipwo1iToJ.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI68642\Crypto\Hash\_SHA384.pydJump to dropped file
    Source: C:\Users\user\Desktop\dipwo1iToJ.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI68642\frozenlist\_frozenlist.cp312-win_amd64.pydJump to dropped file
    Source: C:\Users\user\Desktop\dipwo1iToJ.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI68642\Crypto\Cipher\_pkcs1_decode.pydJump to dropped file
    Source: C:\Users\user\Desktop\dipwo1iToJ.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI68642\Crypto\PublicKey\_curve448.pydJump to dropped file
    Source: C:\Users\user\Desktop\dipwo1iToJ.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI68642\Crypto\PublicKey\_ec_ws.pydJump to dropped file
    Source: C:\Users\user\Desktop\dipwo1iToJ.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI68642\_ssl.pydJump to dropped file
    Source: C:\Users\user\Desktop\dipwo1iToJ.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI68642\Crypto\Hash\_SHA256.pydJump to dropped file
    Source: C:\Users\user\Desktop\dipwo1iToJ.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI68642\Crypto\Cipher\_raw_cast.pydJump to dropped file
    Source: C:\Users\user\Desktop\dipwo1iToJ.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI68642\Crypto\Cipher\_raw_ctr.pydJump to dropped file
    Source: C:\Users\user\Desktop\dipwo1iToJ.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI68642\Crypto\Math\_modexp.pydJump to dropped file
    Source: C:\Users\user\Desktop\dipwo1iToJ.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI68642\Crypto\Cipher\_raw_arc2.pydJump to dropped file
    Source: C:\Users\user\Desktop\dipwo1iToJ.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI68642\Crypto\Cipher\_ARC4.pydJump to dropped file
    Source: C:\Users\user\Desktop\dipwo1iToJ.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI68642\Crypto\Cipher\_raw_eksblowfish.pydJump to dropped file
    Source: C:\Users\user\Desktop\dipwo1iToJ.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI68642\_lzma.pydJump to dropped file
    Source: C:\Users\user\Desktop\dipwo1iToJ.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI68642\cryptography\hazmat\bindings\_rust.pydJump to dropped file
    Source: C:\Users\user\Desktop\dipwo1iToJ.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI68642\charset_normalizer\md.cp312-win_amd64.pydJump to dropped file
    Source: C:\Users\user\Desktop\dipwo1iToJ.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI68642\_ctypes.pydJump to dropped file
    Source: C:\Users\user\Desktop\dipwo1iToJ.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI68642\Crypto\Protocol\_scrypt.pydJump to dropped file
    Source: C:\Users\user\Desktop\dipwo1iToJ.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI68642\Crypto\Hash\_SHA512.pydJump to dropped file
    Source: C:\Users\user\Desktop\dipwo1iToJ.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI68642\Crypto\Cipher\_raw_des3.pydJump to dropped file
    Source: C:\Users\user\Desktop\dipwo1iToJ.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI68642\Crypto\Cipher\_raw_cfb.pydJump to dropped file
    Source: C:\Users\user\Desktop\dipwo1iToJ.exeCheck user administrative privileges: GetTokenInformation,DecisionNodesgraph_0-17460
    Source: C:\Users\user\Desktop\dipwo1iToJ.exeAPI coverage: 0.5 %
    Source: C:\Users\user\Desktop\dipwo1iToJ.exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT Architecture FROM Win32_Processor
    Source: C:\Users\user\Desktop\dipwo1iToJ.exeFile Volume queried: C:\ FullSizeInformationJump to behavior
    Source: C:\Users\user\Desktop\dipwo1iToJ.exeFile Volume queried: \Device\CdRom0\ FullSizeInformationJump to behavior
    Source: C:\Users\user\Desktop\dipwo1iToJ.exeFile Volume queried: C:\ FullSizeInformationJump to behavior
    Source: C:\Users\user\Desktop\dipwo1iToJ.exeCode function: 0_2_00007FF6F8FC92F0 FindFirstFileExW,FindClose,0_2_00007FF6F8FC92F0
    Source: C:\Users\user\Desktop\dipwo1iToJ.exeCode function: 0_2_00007FF6F8FC83B0 FindFirstFileW,RemoveDirectoryW,DeleteFileW,FindNextFileW,FindClose,RemoveDirectoryW,0_2_00007FF6F8FC83B0
    Source: C:\Users\user\Desktop\dipwo1iToJ.exeCode function: 0_2_00007FF6F8FE18E4 _invalid_parameter_noinfo,FindFirstFileExW,FindNextFileW,FindClose,FindClose,0_2_00007FF6F8FE18E4
    Source: C:\Users\user\Desktop\dipwo1iToJ.exeCode function: 1_2_00007FFDFAAC0180 GetSystemInfo,1_2_00007FFDFAAC0180
    Source: dipwo1iToJ.exe, 00000001.00000002.1785618265.0000017A61410000.00000004.00001000.00020000.00000000.sdmpBinary or memory string: VMware
    Source: cacert.pem.0.drBinary or memory string: j2aTPs+9xYa9+bG3tD60B8jzljHz7aRP+KNOjSkVWLjVb3/ubCK1sK9IRQq9qEmU
    Source: dipwo1iToJ.exe, 00000001.00000002.1785618265.0000017A61410000.00000004.00001000.00020000.00000000.sdmpBinary or memory string: dqemu-ga
    Source: dipwo1iToJ.exe, 00000001.00000002.1785618265.0000017A61410000.00000004.00001000.00020000.00000000.sdmpBinary or memory string: Rfvmwaretray
    Source: dipwo1iToJ.exe, 00000001.00000003.1724114185.0000017A60DC4000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: vboxservice
    Source: dipwo1iToJ.exe, 00000001.00000002.1783601146.0000017A60478000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V RAWz
    Source: dipwo1iToJ.exe, 00000001.00000002.1785618265.0000017A61410000.00000004.00001000.00020000.00000000.sdmpBinary or memory string: *fqemu
    Source: dipwo1iToJ.exe, 00000001.00000002.1785618265.0000017A61410000.00000004.00001000.00020000.00000000.sdmpBinary or memory string: vmwareuser
    Source: dipwo1iToJ.exe, 00000001.00000003.1724114185.0000017A60DC4000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: vmmouse.sysz
    Source: dipwo1iToJ.exe, 00000001.00000003.1724114185.0000017A60DC4000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: vmwareuserz
    Source: dipwo1iToJ.exe, 00000001.00000002.1785618265.0000017A61410000.00000004.00001000.00020000.00000000.sdmpBinary or memory string: +]fvmwareuser
    Source: dipwo1iToJ.exe, 00000001.00000003.1724114185.0000017A60DC4000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: vmsrvc
    Source: dipwo1iToJ.exe, 00000001.00000002.1785618265.0000017A61410000.00000004.00001000.00020000.00000000.sdmpBinary or memory string: fvmware
    Source: dipwo1iToJ.exe, 00000001.00000002.1785618265.0000017A61410000.00000004.00001000.00020000.00000000.sdmpBinary or memory string: Yfvmusrvc
    Source: dipwo1iToJ.exe, 00000001.00000002.1785618265.0000017A61410000.00000004.00001000.00020000.00000000.sdmpBinary or memory string: fvboxservice
    Source: dipwo1iToJ.exe, 00000001.00000003.1724114185.0000017A60DC4000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: vmwaretray
    Source: dipwo1iToJ.exe, 00000001.00000003.1724114185.0000017A60DC4000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: VMware Tools
    Source: dipwo1iToJ.exe, 00000001.00000003.1724114185.0000017A60DC4000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: vmhgfs.sysr
    Source: dipwo1iToJ.exe, 00000001.00000002.1785618265.0000017A61410000.00000004.00001000.00020000.00000000.sdmpBinary or memory string: fvboxtray
    Source: dipwo1iToJ.exe, 00000001.00000002.1785618265.0000017A61410000.00000004.00001000.00020000.00000000.sdmpBinary or memory string: fvmtoolsd
    Source: cacert.pem.0.drBinary or memory string: zJVSk/BwJVmcIGfE7vmLV2H0knZ9P4SNVbfo5azV8fUZVqZa+5Acr5Pr5RzUZ5dd
    Source: dipwo1iToJ.exe, 00000001.00000002.1785618265.0000017A61410000.00000004.00001000.00020000.00000000.sdmp, dipwo1iToJ.exe, 00000001.00000003.1724114185.0000017A60DC4000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: vboxtray
    Source: dipwo1iToJ.exe, 00000001.00000002.1785618265.0000017A61410000.00000004.00001000.00020000.00000000.sdmp, dipwo1iToJ.exe, 00000001.00000003.1724114185.0000017A60DC4000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: qemu-ga
    Source: dipwo1iToJ.exe, 00000001.00000002.1785618265.0000017A61410000.00000004.00001000.00020000.00000000.sdmpBinary or memory string: fvmsrvc
    Source: dipwo1iToJ.exe, 00000001.00000003.1724114185.0000017A60DC4000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: vmware
    Source: dipwo1iToJ.exe, 00000001.00000002.1785618265.0000017A61410000.00000004.00001000.00020000.00000000.sdmpBinary or memory string: fVMware
    Source: dipwo1iToJ.exe, 00000001.00000002.1785618265.0000017A61410000.00000004.00001000.00020000.00000000.sdmp, dipwo1iToJ.exe, 00000001.00000003.1724114185.0000017A60DC4000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: vmusrvc
    Source: dipwo1iToJ.exe, 00000001.00000002.1785618265.0000017A61410000.00000004.00001000.00020000.00000000.sdmpBinary or memory string: dvmhgfs.sys
    Source: dipwo1iToJ.exe, 00000001.00000002.1785618265.0000017A61410000.00000004.00001000.00020000.00000000.sdmpBinary or memory string: vmhgfs.sys
    Source: dipwo1iToJ.exe, 00000001.00000003.1724114185.0000017A60DC4000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: VMwarez
    Source: dipwo1iToJ.exe, 00000001.00000002.1785618265.0000017A61410000.00000004.00001000.00020000.00000000.sdmpBinary or memory string: dVMware Tools
    Source: dipwo1iToJ.exe, 00000001.00000003.1724114185.0000017A60DC4000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: vmtoolsd
    Source: dipwo1iToJ.exe, 00000001.00000002.1785618265.0000017A61410000.00000004.00001000.00020000.00000000.sdmpBinary or memory string: vmmouse.sys
    Source: dipwo1iToJ.exe, 00000001.00000002.1785618265.0000017A61410000.00000004.00001000.00020000.00000000.sdmpBinary or memory string: dvmmouse.sys
    Source: C:\Users\user\Desktop\dipwo1iToJ.exeProcess information queried: ProcessInformationJump to behavior
    Source: C:\Users\user\Desktop\dipwo1iToJ.exeCode function: 0_2_00007FF6F8FCD19C IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,0_2_00007FF6F8FCD19C
    Source: C:\Users\user\Desktop\dipwo1iToJ.exeCode function: 0_2_00007FF6F8FE34F0 GetProcessHeap,0_2_00007FF6F8FE34F0
    Source: C:\Users\user\Desktop\dipwo1iToJ.exeProcess token adjusted: DebugJump to behavior
    Source: C:\Users\user\Desktop\dipwo1iToJ.exeProcess token adjusted: DebugJump to behavior
    Source: C:\Users\user\Desktop\dipwo1iToJ.exeCode function: 0_2_00007FF6F8FCD19C IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,0_2_00007FF6F8FCD19C
    Source: C:\Users\user\Desktop\dipwo1iToJ.exeCode function: 0_2_00007FF6F8FCD37C SetUnhandledExceptionFilter,0_2_00007FF6F8FCD37C
    Source: C:\Users\user\Desktop\dipwo1iToJ.exeCode function: 0_2_00007FF6F8FDA684 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,0_2_00007FF6F8FDA684
    Source: C:\Users\user\Desktop\dipwo1iToJ.exeCode function: 0_2_00007FF6F8FCC910 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,0_2_00007FF6F8FCC910
    Source: C:\Users\user\Desktop\dipwo1iToJ.exeCode function: 1_2_00007FFDFA993068 IsProcessorFeaturePresent,memset,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,1_2_00007FFDFA993068
    Source: C:\Users\user\Desktop\dipwo1iToJ.exeCode function: 1_2_00007FFDFA992AA0 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,1_2_00007FFDFA992AA0
    Source: C:\Users\user\Desktop\dipwo1iToJ.exeCode function: 1_2_00007FFDFABDCAF0 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,1_2_00007FFDFABDCAF0
    Source: C:\Users\user\Desktop\dipwo1iToJ.exeProcess created: C:\Users\user\Desktop\dipwo1iToJ.exe "C:\Users\user\Desktop\dipwo1iToJ.exe"Jump to behavior
    Source: C:\Users\user\Desktop\dipwo1iToJ.exeCode function: 0_2_00007FF6F8FE95E0 cpuid 0_2_00007FF6F8FE95E0
    Source: C:\Users\user\Desktop\dipwo1iToJ.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI68642\Crypto VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\dipwo1iToJ.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI68642\Crypto\Cipher VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\dipwo1iToJ.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI68642\Crypto VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\dipwo1iToJ.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI68642\Crypto VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\dipwo1iToJ.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI68642\Crypto VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\dipwo1iToJ.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI68642\Crypto VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\dipwo1iToJ.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI68642\Crypto VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\dipwo1iToJ.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI68642\Crypto VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\dipwo1iToJ.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI68642\Crypto VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\dipwo1iToJ.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI68642\Crypto VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\dipwo1iToJ.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI68642\Crypto\Cipher VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\dipwo1iToJ.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI68642\Crypto VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\dipwo1iToJ.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI68642\Crypto\Cipher VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\dipwo1iToJ.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI68642\Crypto VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\dipwo1iToJ.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI68642\Crypto VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\dipwo1iToJ.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI68642\Crypto VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\dipwo1iToJ.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI68642\Crypto VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\dipwo1iToJ.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI68642\Crypto VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\dipwo1iToJ.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI68642\Crypto\Hash VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\dipwo1iToJ.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI68642\Crypto VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\dipwo1iToJ.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI68642\Crypto VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\dipwo1iToJ.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI68642\Crypto\Hash VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\dipwo1iToJ.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI68642\Crypto VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\dipwo1iToJ.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI68642\Crypto\Hash VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\dipwo1iToJ.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI68642\Crypto VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\dipwo1iToJ.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI68642\Crypto VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\dipwo1iToJ.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI68642\Crypto VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\dipwo1iToJ.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI68642\Crypto VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\dipwo1iToJ.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI68642\Crypto\Hash VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\dipwo1iToJ.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI68642\Crypto VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\dipwo1iToJ.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI68642\Crypto\Hash VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\dipwo1iToJ.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI68642\Crypto VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\dipwo1iToJ.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI68642\Crypto VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\dipwo1iToJ.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI68642\Crypto VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\dipwo1iToJ.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI68642\Crypto\Hash VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\dipwo1iToJ.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI68642\Crypto VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\dipwo1iToJ.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI68642\Crypto VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\dipwo1iToJ.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI68642\Crypto VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\dipwo1iToJ.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI68642\Crypto VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\dipwo1iToJ.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI68642\Crypto\PublicKey VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\dipwo1iToJ.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI68642\Crypto VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\dipwo1iToJ.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI68642\Crypto\PublicKey VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\dipwo1iToJ.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI68642\Crypto VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\dipwo1iToJ.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI68642\Crypto\PublicKey VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\dipwo1iToJ.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI68642\Crypto VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\dipwo1iToJ.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI68642\Crypto\PublicKey VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\dipwo1iToJ.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI68642\Crypto VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\dipwo1iToJ.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI68642\Crypto VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\dipwo1iToJ.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI68642\Crypto\Util VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\dipwo1iToJ.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI68642\aiohttp VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\dipwo1iToJ.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI68642\aiohttp\_websocket VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\dipwo1iToJ.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI68642\attrs-24.2.0.dist-info VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\dipwo1iToJ.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI68642\attrs-24.2.0.dist-info VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\dipwo1iToJ.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI68642\attrs-24.2.0.dist-info VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\dipwo1iToJ.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI68642\attrs-24.2.0.dist-info VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\dipwo1iToJ.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI68642\certifi VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\dipwo1iToJ.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI68642\charset_normalizer VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\dipwo1iToJ.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI68642\cryptography-43.0.3.dist-info VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\dipwo1iToJ.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI68642\cryptography-43.0.3.dist-info VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\dipwo1iToJ.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI68642\cryptography-43.0.3.dist-info VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\dipwo1iToJ.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI68642\cryptography-43.0.3.dist-info VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\dipwo1iToJ.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI68642\cryptography-43.0.3.dist-info VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\dipwo1iToJ.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI68642\cryptography-43.0.3.dist-info VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\dipwo1iToJ.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI68642\cryptography-43.0.3.dist-info\license_files VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\dipwo1iToJ.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI68642\setuptools VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\dipwo1iToJ.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI68642\setuptools\_vendor VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\dipwo1iToJ.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI68642\setuptools\_vendor\importlib_metadata-8.0.0.dist-info VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\dipwo1iToJ.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI68642\setuptools VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\dipwo1iToJ.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI68642\setuptools\_vendor VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\dipwo1iToJ.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI68642\setuptools\_vendor\importlib_metadata-8.0.0.dist-info VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\dipwo1iToJ.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI68642\setuptools VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\dipwo1iToJ.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI68642\setuptools\_vendor VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\dipwo1iToJ.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI68642\setuptools\_vendor\importlib_metadata-8.0.0.dist-info VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\dipwo1iToJ.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI68642\setuptools VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\dipwo1iToJ.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI68642\setuptools\_vendor VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\dipwo1iToJ.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI68642\setuptools VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\dipwo1iToJ.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI68642\setuptools VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\dipwo1iToJ.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI68642\setuptools VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\dipwo1iToJ.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI68642\setuptools VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\dipwo1iToJ.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI68642\setuptools\_vendor\wheel-0.43.0.dist-info VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\dipwo1iToJ.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI68642\setuptools\_vendor VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\dipwo1iToJ.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI68642\setuptools\_vendor\wheel-0.43.0.dist-info VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\dipwo1iToJ.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI68642\setuptools VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\dipwo1iToJ.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI68642\setuptools\_vendor VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\dipwo1iToJ.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI68642\setuptools\_vendor\wheel-0.43.0.dist-info VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\dipwo1iToJ.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI68642\setuptools VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\dipwo1iToJ.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI68642\setuptools VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\dipwo1iToJ.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI68642\setuptools\_vendor VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\dipwo1iToJ.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI68642\setuptools\_vendor\wheel-0.43.0.dist-info VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\dipwo1iToJ.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI68642\base_library.zip VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\dipwo1iToJ.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI68642\base_library.zip VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\dipwo1iToJ.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI68642\base_library.zip VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\dipwo1iToJ.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI68642\base_library.zip VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\dipwo1iToJ.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI68642\base_library.zip VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\dipwo1iToJ.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI68642\base_library.zip VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\dipwo1iToJ.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI68642\base_library.zip VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\dipwo1iToJ.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI68642\base_library.zip VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\dipwo1iToJ.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI68642\base_library.zip VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\dipwo1iToJ.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI68642\base_library.zip VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\dipwo1iToJ.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI68642\base_library.zip VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\dipwo1iToJ.exeQueries volume information: C:\Users\user\Desktop\dipwo1iToJ.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\dipwo1iToJ.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI68642 VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\dipwo1iToJ.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI68642 VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\dipwo1iToJ.exeQueries volume information: C:\Users\user\Desktop\dipwo1iToJ.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\dipwo1iToJ.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI68642\base_library.zip VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\dipwo1iToJ.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI68642\base_library.zip VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\dipwo1iToJ.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI68642 VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\dipwo1iToJ.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI68642 VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\dipwo1iToJ.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI68642 VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\dipwo1iToJ.exeQueries volume information: C:\Users\user\Desktop\dipwo1iToJ.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\dipwo1iToJ.exeQueries volume information: C:\Users\user\Desktop\dipwo1iToJ.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\dipwo1iToJ.exeQueries volume information: C:\Users\user\Desktop\dipwo1iToJ.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\dipwo1iToJ.exeQueries volume information: C:\Users\user\Desktop\dipwo1iToJ.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\dipwo1iToJ.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI68642 VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\dipwo1iToJ.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI68642\base_library.zip VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\dipwo1iToJ.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI68642\base_library.zip VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\dipwo1iToJ.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI68642\base_library.zip VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\dipwo1iToJ.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI68642\base_library.zip VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\dipwo1iToJ.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI68642\base_library.zip VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\dipwo1iToJ.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI68642\base_library.zip VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\dipwo1iToJ.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI68642\base_library.zip VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\dipwo1iToJ.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI68642\base_library.zip VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\dipwo1iToJ.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI68642\base_library.zip VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\dipwo1iToJ.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI68642\base_library.zip VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\dipwo1iToJ.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI68642\base_library.zip VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\dipwo1iToJ.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI68642\base_library.zip VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\dipwo1iToJ.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI68642\base_library.zip VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\dipwo1iToJ.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI68642\base_library.zip VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\dipwo1iToJ.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI68642\base_library.zip VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\dipwo1iToJ.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI68642\base_library.zip VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\dipwo1iToJ.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI68642\base_library.zip VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\dipwo1iToJ.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI68642\base_library.zip VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\dipwo1iToJ.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI68642\base_library.zip VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\dipwo1iToJ.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI68642\base_library.zip VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\dipwo1iToJ.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI68642\base_library.zip VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\dipwo1iToJ.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI68642\base_library.zip VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\dipwo1iToJ.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI68642\base_library.zip VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\dipwo1iToJ.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI68642\base_library.zip VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\dipwo1iToJ.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI68642\base_library.zip VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\dipwo1iToJ.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI68642\base_library.zip VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\dipwo1iToJ.exeQueries volume information: C:\Users\user\Desktop\dipwo1iToJ.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\dipwo1iToJ.exeQueries volume information: C:\Users\user\Desktop\dipwo1iToJ.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\dipwo1iToJ.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI68642 VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\dipwo1iToJ.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI68642\_bz2.pyd VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\dipwo1iToJ.exeQueries volume information: C:\Users\user\Desktop\dipwo1iToJ.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\dipwo1iToJ.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI68642 VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\dipwo1iToJ.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI68642\_lzma.pyd VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\dipwo1iToJ.exeQueries volume information: C:\Users\user\Desktop\dipwo1iToJ.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\dipwo1iToJ.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI68642\base_library.zip VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\dipwo1iToJ.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI68642\base_library.zip VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\dipwo1iToJ.exeQueries volume information: C:\Users\user\Desktop\dipwo1iToJ.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\dipwo1iToJ.exeQueries volume information: C:\Users\user\Desktop\dipwo1iToJ.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\dipwo1iToJ.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI68642\base_library.zip VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\dipwo1iToJ.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI68642\base_library.zip VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\dipwo1iToJ.exeQueries volume information: C:\Users\user\Desktop\dipwo1iToJ.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\dipwo1iToJ.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI68642 VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\dipwo1iToJ.exeQueries volume information: C:\Users\user\Desktop\dipwo1iToJ.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\dipwo1iToJ.exeQueries volume information: C:\Users\user\Desktop\dipwo1iToJ.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\dipwo1iToJ.exeQueries volume information: C:\Users\user\Desktop\dipwo1iToJ.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\dipwo1iToJ.exeQueries volume information: C:\Users\user\Desktop\dipwo1iToJ.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\dipwo1iToJ.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI68642\base_library.zip VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\dipwo1iToJ.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI68642\base_library.zip VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\dipwo1iToJ.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI68642\base_library.zip VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\dipwo1iToJ.exeQueries volume information: C:\Users\user\Desktop\dipwo1iToJ.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\dipwo1iToJ.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI68642\base_library.zip VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\dipwo1iToJ.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI68642\base_library.zip VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\dipwo1iToJ.exeQueries volume information: C:\Users\user\Desktop\dipwo1iToJ.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\dipwo1iToJ.exeQueries volume information: C:\Users\user\Desktop\dipwo1iToJ.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\dipwo1iToJ.exeQueries volume information: C:\Users\user\Desktop\dipwo1iToJ.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\dipwo1iToJ.exeQueries volume information: C:\Users\user\Desktop\dipwo1iToJ.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\dipwo1iToJ.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI68642 VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\dipwo1iToJ.exeQueries volume information: C:\Users\user\Desktop\dipwo1iToJ.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\dipwo1iToJ.exeQueries volume information: C:\Users\user\Desktop\dipwo1iToJ.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\dipwo1iToJ.exeQueries volume information: C:\Users\user\Desktop\dipwo1iToJ.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\dipwo1iToJ.exeQueries volume information: C:\Users\user\Desktop\dipwo1iToJ.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\dipwo1iToJ.exeQueries volume information: C:\Users\user\Desktop\dipwo1iToJ.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\dipwo1iToJ.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI68642 VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\dipwo1iToJ.exeQueries volume information: C:\Users\user\Desktop\dipwo1iToJ.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\dipwo1iToJ.exeQueries volume information: C:\Users\user\Desktop\dipwo1iToJ.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\dipwo1iToJ.exeQueries volume information: C:\Users\user\Desktop\dipwo1iToJ.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\dipwo1iToJ.exeQueries volume information: C:\Users\user\Desktop\dipwo1iToJ.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\dipwo1iToJ.exeQueries volume information: C:\Users\user\Desktop\dipwo1iToJ.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\dipwo1iToJ.exeQueries volume information: C:\Users\user\Desktop\dipwo1iToJ.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\dipwo1iToJ.exeQueries volume information: C:\Users\user\Desktop\dipwo1iToJ.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\dipwo1iToJ.exeQueries volume information: C:\Users\user\Desktop\dipwo1iToJ.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\dipwo1iToJ.exeQueries volume information: C:\Users\user\Desktop\dipwo1iToJ.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\dipwo1iToJ.exeQueries volume information: C:\Users\user\Desktop\dipwo1iToJ.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\dipwo1iToJ.exeQueries volume information: C:\Users\user\Desktop\dipwo1iToJ.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\dipwo1iToJ.exeQueries volume information: C:\Users\user\Desktop\dipwo1iToJ.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\dipwo1iToJ.exeQueries volume information: C:\Users\user\Desktop\dipwo1iToJ.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\dipwo1iToJ.exeQueries volume information: C:\Users\user\Desktop\dipwo1iToJ.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\dipwo1iToJ.exeQueries volume information: C:\Users\user\Desktop\dipwo1iToJ.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\dipwo1iToJ.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI68642 VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\dipwo1iToJ.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI68642\win32 VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\dipwo1iToJ.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI68642\win32 VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\dipwo1iToJ.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI68642\pywin32_system32 VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\dipwo1iToJ.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI68642\pywin32_system32 VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\dipwo1iToJ.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI68642\pywin32_system32 VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\dipwo1iToJ.exeQueries volume information: C:\Users\user\Desktop\dipwo1iToJ.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\dipwo1iToJ.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI68642 VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\dipwo1iToJ.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI68642\_hashlib.pyd VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\dipwo1iToJ.exeQueries volume information: C:\Users\user\Desktop\dipwo1iToJ.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\dipwo1iToJ.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI68642 VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\dipwo1iToJ.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI68642\_socket.pyd VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\dipwo1iToJ.exeQueries volume information: C:\Users\user\Desktop\dipwo1iToJ.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\dipwo1iToJ.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI68642 VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\dipwo1iToJ.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI68642\select.pyd VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\dipwo1iToJ.exeQueries volume information: C:\Users\user\Desktop\dipwo1iToJ.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\dipwo1iToJ.exeQueries volume information: C:\Users\user\Desktop\dipwo1iToJ.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\dipwo1iToJ.exeQueries volume information: C:\Users\user\Desktop\dipwo1iToJ.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\dipwo1iToJ.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI68642 VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\dipwo1iToJ.exeQueries volume information: C:\Users\user\Desktop\dipwo1iToJ.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\dipwo1iToJ.exeQueries volume information: C:\Users\user\Desktop\dipwo1iToJ.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\dipwo1iToJ.exeQueries volume information: C:\Users\user\Desktop\dipwo1iToJ.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\dipwo1iToJ.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI68642 VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\dipwo1iToJ.exeQueries volume information: C:\Users\user\Desktop\dipwo1iToJ.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\dipwo1iToJ.exeQueries volume information: C:\Users\user\Desktop\dipwo1iToJ.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\dipwo1iToJ.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI68642\base_library.zip VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\dipwo1iToJ.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI68642\base_library.zip VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\dipwo1iToJ.exeQueries volume information: C:\Users\user\Desktop\dipwo1iToJ.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\dipwo1iToJ.exeQueries volume information: C:\Users\user\Desktop\dipwo1iToJ.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\dipwo1iToJ.exeQueries volume information: C:\Users\user\Desktop\dipwo1iToJ.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\dipwo1iToJ.exeQueries volume information: C:\Users\user\Desktop\dipwo1iToJ.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\dipwo1iToJ.exeQueries volume information: C:\Users\user\Desktop\dipwo1iToJ.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\dipwo1iToJ.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI68642 VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\dipwo1iToJ.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI68642\_wmi.pyd VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\dipwo1iToJ.exeQueries volume information: C:\Users\user\Desktop\dipwo1iToJ.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\dipwo1iToJ.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI68642 VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\dipwo1iToJ.exeQueries volume information: C:\Users\user\Desktop\dipwo1iToJ.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\dipwo1iToJ.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI68642 VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\dipwo1iToJ.exeQueries volume information: C:\Users\user\Desktop\dipwo1iToJ.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\dipwo1iToJ.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI68642 VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\dipwo1iToJ.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI68642\pyexpat.pyd VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\dipwo1iToJ.exeQueries volume information: C:\Users\user\Desktop\dipwo1iToJ.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\dipwo1iToJ.exeQueries volume information: C:\Users\user\Desktop\dipwo1iToJ.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\dipwo1iToJ.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI68642 VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\dipwo1iToJ.exeQueries volume information: C:\Users\user\Desktop\dipwo1iToJ.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\dipwo1iToJ.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI68642 VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\dipwo1iToJ.exeQueries volume information: C:\Users\user\Desktop\dipwo1iToJ.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\dipwo1iToJ.exeQueries volume information: C:\Users\user\Desktop\dipwo1iToJ.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\dipwo1iToJ.exeQueries volume information: C:\Users\user\Desktop\dipwo1iToJ.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\dipwo1iToJ.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI68642 VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\dipwo1iToJ.exeQueries volume information: C:\Users\user\Desktop\dipwo1iToJ.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\dipwo1iToJ.exeQueries volume information: C:\Users\user\Desktop\dipwo1iToJ.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\dipwo1iToJ.exeQueries volume information: C:\Users\user\Desktop\dipwo1iToJ.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\dipwo1iToJ.exeQueries volume information: C:\Users\user\Desktop\dipwo1iToJ.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\dipwo1iToJ.exeQueries volume information: C:\Users\user\Desktop\dipwo1iToJ.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\dipwo1iToJ.exeQueries volume information: C:\Users\user\Desktop\dipwo1iToJ.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\dipwo1iToJ.exeQueries volume information: C:\Users\user\Desktop\dipwo1iToJ.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\dipwo1iToJ.exeQueries volume information: C:\Users\user\Desktop\dipwo1iToJ.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\dipwo1iToJ.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI68642\base_library.zip VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\dipwo1iToJ.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI68642\base_library.zip VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\dipwo1iToJ.exeQueries volume information: C:\Users\user\Desktop\dipwo1iToJ.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\dipwo1iToJ.exeQueries volume information: C:\Users\user\Desktop\dipwo1iToJ.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\dipwo1iToJ.exeQueries volume information: C:\Users\user\Desktop\dipwo1iToJ.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\dipwo1iToJ.exeQueries volume information: C:\Users\user\Desktop\dipwo1iToJ.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\dipwo1iToJ.exeQueries volume information: C:\Users\user\Desktop\dipwo1iToJ.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\dipwo1iToJ.exeQueries volume information: C:\Users\user\Desktop\dipwo1iToJ.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\dipwo1iToJ.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI68642\win32 VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\dipwo1iToJ.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI68642\pywin32_system32 VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\dipwo1iToJ.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI68642\setuptools\_vendor VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\dipwo1iToJ.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI68642 VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\dipwo1iToJ.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI68642\setuptools\_vendor\jaraco VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\dipwo1iToJ.exeQueries volume information: C:\Users\user\Desktop\dipwo1iToJ.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\dipwo1iToJ.exeQueries volume information: C:\Users\user\Desktop\dipwo1iToJ.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\dipwo1iToJ.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI68642\pywin32_system32 VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\dipwo1iToJ.exeQueries volume information: C:\Users\user\Desktop\dipwo1iToJ.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\dipwo1iToJ.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI68642\setuptools\_vendor VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\dipwo1iToJ.exeQueries volume information: C:\Users\user\Desktop\dipwo1iToJ.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\dipwo1iToJ.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI68642\base_library.zip VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\dipwo1iToJ.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI68642\base_library.zip VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\dipwo1iToJ.exeQueries volume information: C:\Users\user\Desktop\dipwo1iToJ.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\dipwo1iToJ.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI68642 VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\dipwo1iToJ.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI68642\_queue.pyd VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\dipwo1iToJ.exeQueries volume information: C:\Users\user\Desktop\dipwo1iToJ.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\dipwo1iToJ.exeQueries volume information: C:\Users\user\Desktop\dipwo1iToJ.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\dipwo1iToJ.exeQueries volume information: C:\Users\user\Desktop\dipwo1iToJ.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\dipwo1iToJ.exeQueries volume information: C:\Users\user\Desktop\dipwo1iToJ.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\dipwo1iToJ.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI68642 VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\dipwo1iToJ.exeQueries volume information: C:\Users\user\Desktop\dipwo1iToJ.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\dipwo1iToJ.exeQueries volume information: C:\Users\user\Desktop\dipwo1iToJ.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\dipwo1iToJ.exeQueries volume information: C:\Users\user\Desktop\dipwo1iToJ.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\dipwo1iToJ.exeQueries volume information: C:\Users\user\Desktop\dipwo1iToJ.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\dipwo1iToJ.exeQueries volume information: C:\Users\user\Desktop\dipwo1iToJ.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\dipwo1iToJ.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI68642 VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\dipwo1iToJ.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI68642\_ssl.pyd VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\dipwo1iToJ.exeQueries volume information: C:\Users\user\Desktop\dipwo1iToJ.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\dipwo1iToJ.exeQueries volume information: C:\Users\user\Desktop\dipwo1iToJ.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\dipwo1iToJ.exeQueries volume information: C:\Users\user\Desktop\dipwo1iToJ.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\dipwo1iToJ.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI68642 VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\dipwo1iToJ.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI68642\win32 VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\dipwo1iToJ.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI68642\setuptools\_vendor\jaraco\text\Lorem ipsum.txt VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\dipwo1iToJ.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI68642\setuptools\_vendor\jaraco\text\Lorem ipsum.txt VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\dipwo1iToJ.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI68642 VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\dipwo1iToJ.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI68642\win32 VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\dipwo1iToJ.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI68642\setuptools\_vendor VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\dipwo1iToJ.exeQueries volume information: C:\Users\user\Desktop\dipwo1iToJ.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\dipwo1iToJ.exeQueries volume information: C:\Users\user\Desktop\dipwo1iToJ.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\dipwo1iToJ.exeQueries volume information: C:\Users\user\Desktop\dipwo1iToJ.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\dipwo1iToJ.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI68642 VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\dipwo1iToJ.exeQueries volume information: C:\Users\user\Desktop\dipwo1iToJ.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\dipwo1iToJ.exeQueries volume information: C:\Users\user\Desktop\dipwo1iToJ.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\dipwo1iToJ.exeQueries volume information: C:\Users\user\Desktop\dipwo1iToJ.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\dipwo1iToJ.exeQueries volume information: C:\Users\user\Desktop\dipwo1iToJ.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\dipwo1iToJ.exeQueries volume information: C:\Users\user\Desktop\dipwo1iToJ.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\dipwo1iToJ.exeQueries volume information: C:\Users\user\Desktop\dipwo1iToJ.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\dipwo1iToJ.exeQueries volume information: C:\Users\user\Desktop\dipwo1iToJ.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\dipwo1iToJ.exeQueries volume information: C:\Users\user\Desktop\dipwo1iToJ.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\dipwo1iToJ.exeQueries volume information: C:\Users\user\Desktop\dipwo1iToJ.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\dipwo1iToJ.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI68642 VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\dipwo1iToJ.exeQueries volume information: C:\Users\user\Desktop\dipwo1iToJ.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\dipwo1iToJ.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI68642\setuptools VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\dipwo1iToJ.exeQueries volume information: C:\Users\user\Desktop\dipwo1iToJ.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\dipwo1iToJ.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI68642 VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\dipwo1iToJ.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI68642\win32 VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\dipwo1iToJ.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI68642\setuptools VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\dipwo1iToJ.exeQueries volume information: C:\Users\user\Desktop\dipwo1iToJ.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\dipwo1iToJ.exeQueries volume information: C:\Users\user\Desktop\dipwo1iToJ.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\dipwo1iToJ.exeQueries volume information: C:\Users\user\Desktop\dipwo1iToJ.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\dipwo1iToJ.exeQueries volume information: C:\Users\user\Desktop\dipwo1iToJ.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\dipwo1iToJ.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI68642\setuptools VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\dipwo1iToJ.exeQueries volume information: C:\Users\user\Desktop\dipwo1iToJ.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\dipwo1iToJ.exeQueries volume information: C:\Users\user\Desktop\dipwo1iToJ.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\dipwo1iToJ.exeQueries volume information: C:\Users\user\Desktop\dipwo1iToJ.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\dipwo1iToJ.exeQueries volume information: C:\Users\user\Desktop\dipwo1iToJ.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\dipwo1iToJ.exeQueries volume information: C:\Users\user\Desktop\dipwo1iToJ.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\dipwo1iToJ.exeQueries volume information: C:\Users\user\Desktop\dipwo1iToJ.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\dipwo1iToJ.exeQueries volume information: C:\Users\user\Desktop\dipwo1iToJ.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\dipwo1iToJ.exeQueries volume information: C:\Users\user\Desktop\dipwo1iToJ.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\dipwo1iToJ.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI68642 VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\dipwo1iToJ.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI68642\win32 VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\dipwo1iToJ.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI68642\pywin32_system32 VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\dipwo1iToJ.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI68642 VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\dipwo1iToJ.exeQueries volume information: C:\Users\user\Desktop\dipwo1iToJ.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\dipwo1iToJ.exeQueries volume information: C:\Users\user\Desktop\dipwo1iToJ.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\dipwo1iToJ.exeQueries volume information: C:\Users\user\Desktop\dipwo1iToJ.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\dipwo1iToJ.exeQueries volume information: C:\Users\user\Desktop\dipwo1iToJ.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\dipwo1iToJ.exeQueries volume information: C:\Users\user\Desktop\dipwo1iToJ.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\dipwo1iToJ.exeQueries volume information: C:\Users\user\Desktop\dipwo1iToJ.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\dipwo1iToJ.exeQueries volume information: C:\Users\user\Desktop\dipwo1iToJ.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\dipwo1iToJ.exeQueries volume information: C:\Users\user\Desktop\dipwo1iToJ.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\dipwo1iToJ.exeQueries volume information: C:\Users\user\Desktop\dipwo1iToJ.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\dipwo1iToJ.exeQueries volume information: C:\Users\user\Desktop\dipwo1iToJ.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\dipwo1iToJ.exeQueries volume information: C:\Users\user\Desktop\dipwo1iToJ.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\dipwo1iToJ.exeQueries volume information: C:\Users\user\Desktop\dipwo1iToJ.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\dipwo1iToJ.exeQueries volume information: C:\Users\user\Desktop\dipwo1iToJ.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\dipwo1iToJ.exeQueries volume information: C:\Users\user\Desktop\dipwo1iToJ.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\dipwo1iToJ.exeQueries volume information: C:\Users\user\Desktop\dipwo1iToJ.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\dipwo1iToJ.exeQueries volume information: C:\Users\user\Desktop\dipwo1iToJ.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\dipwo1iToJ.exeQueries volume information: C:\Users\user\Desktop\dipwo1iToJ.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\dipwo1iToJ.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI68642 VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\dipwo1iToJ.exeQueries volume information: C:\Users\user\Desktop\dipwo1iToJ.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\dipwo1iToJ.exeQueries volume information: C:\Users\user\Desktop\dipwo1iToJ.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\dipwo1iToJ.exeQueries volume information: C:\Users\user\Desktop\dipwo1iToJ.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\dipwo1iToJ.exeQueries volume information: C:\Users\user\Desktop\dipwo1iToJ.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\dipwo1iToJ.exeQueries volume information: C:\Users\user\Desktop\dipwo1iToJ.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\dipwo1iToJ.exeQueries volume information: C:\Users\user\Desktop\dipwo1iToJ.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\dipwo1iToJ.exeQueries volume information: C:\Users\user\Desktop\dipwo1iToJ.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\dipwo1iToJ.exeQueries volume information: C:\Users\user\Desktop\dipwo1iToJ.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\dipwo1iToJ.exeQueries volume information: C:\Users\user\Desktop\dipwo1iToJ.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\dipwo1iToJ.exeQueries volume information: C:\Users\user\Desktop\dipwo1iToJ.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\dipwo1iToJ.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI68642\setuptools VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\dipwo1iToJ.exeQueries volume information: C:\Users\user\Desktop\dipwo1iToJ.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\dipwo1iToJ.exeQueries volume information: C:\Users\user\Desktop\dipwo1iToJ.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\dipwo1iToJ.exeQueries volume information: C:\Users\user\Desktop\dipwo1iToJ.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\dipwo1iToJ.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI68642\setuptools VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\dipwo1iToJ.exeQueries volume information: C:\Users\user\Desktop\dipwo1iToJ.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\dipwo1iToJ.exeQueries volume information: C:\Users\user\Desktop\dipwo1iToJ.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\dipwo1iToJ.exeQueries volume information: C:\Users\user\Desktop\dipwo1iToJ.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\dipwo1iToJ.exeQueries volume information: C:\Users\user\Desktop\dipwo1iToJ.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\dipwo1iToJ.exeQueries volume information: C:\Users\user\Desktop\dipwo1iToJ.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\dipwo1iToJ.exeQueries volume information: C:\Users\user\Desktop\dipwo1iToJ.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\dipwo1iToJ.exeQueries volume information: C:\Users\user\Desktop\dipwo1iToJ.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\dipwo1iToJ.exeQueries volume information: C:\Users\user\Desktop\dipwo1iToJ.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\dipwo1iToJ.exeQueries volume information: C:\Users\user\Desktop\dipwo1iToJ.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\dipwo1iToJ.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI68642\base_library.zip VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\dipwo1iToJ.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI68642\base_library.zip VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\dipwo1iToJ.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI68642\base_library.zip VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\dipwo1iToJ.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI68642\base_library.zip VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\dipwo1iToJ.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI68642\base_library.zip VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\dipwo1iToJ.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI68642 VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\dipwo1iToJ.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI68642\win32 VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\dipwo1iToJ.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI68642\pywin32_system32 VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\dipwo1iToJ.exeQueries volume information: C:\Users\user\Desktop\dipwo1iToJ.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\dipwo1iToJ.exeQueries volume information: C:\Users\user\Desktop\dipwo1iToJ.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\dipwo1iToJ.exeQueries volume information: C:\Users\user\Desktop\dipwo1iToJ.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\dipwo1iToJ.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI68642 VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\dipwo1iToJ.exeQueries volume information: C:\Users\user\Desktop\dipwo1iToJ.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\dipwo1iToJ.exeQueries volume information: C:\Users\user\Desktop\dipwo1iToJ.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\dipwo1iToJ.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI68642 VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\dipwo1iToJ.exeQueries volume information: C:\Users\user\Desktop\dipwo1iToJ.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\dipwo1iToJ.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI68642 VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\dipwo1iToJ.exeQueries volume information: C:\Users\user\Desktop\dipwo1iToJ.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\dipwo1iToJ.exeQueries volume information: C:\Users\user\Desktop\dipwo1iToJ.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\dipwo1iToJ.exeQueries volume information: C:\Users\user\Desktop\dipwo1iToJ.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\dipwo1iToJ.exeQueries volume information: C:\Users\user\Desktop\dipwo1iToJ.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\dipwo1iToJ.exeQueries volume information: C:\Users\user\Desktop\dipwo1iToJ.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\dipwo1iToJ.exeQueries volume information: C:\Users\user\Desktop\dipwo1iToJ.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\dipwo1iToJ.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI68642 VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\dipwo1iToJ.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI68642\_asyncio.pyd VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\dipwo1iToJ.exeQueries volume information: C:\Users\user\Desktop\dipwo1iToJ.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\dipwo1iToJ.exeQueries volume information: C:\Users\user\Desktop\dipwo1iToJ.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\dipwo1iToJ.exeQueries volume information: C:\Users\user\Desktop\dipwo1iToJ.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\dipwo1iToJ.exeQueries volume information: C:\Users\user\Desktop\dipwo1iToJ.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\dipwo1iToJ.exeQueries volume information: C:\Users\user\Desktop\dipwo1iToJ.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\dipwo1iToJ.exeQueries volume information: C:\Users\user\Desktop\dipwo1iToJ.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\dipwo1iToJ.exeQueries volume information: C:\Users\user\Desktop\dipwo1iToJ.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\dipwo1iToJ.exeQueries volume information: C:\Users\user\Desktop\dipwo1iToJ.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\dipwo1iToJ.exeQueries volume information: C:\Users\user\Desktop\dipwo1iToJ.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\dipwo1iToJ.exeQueries volume information: C:\Users\user\Desktop\dipwo1iToJ.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\dipwo1iToJ.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI68642 VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\dipwo1iToJ.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI68642\_overlapped.pyd VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\dipwo1iToJ.exeQueries volume information: C:\Users\user\Desktop\dipwo1iToJ.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\dipwo1iToJ.exeQueries volume information: C:\Users\user\Desktop\dipwo1iToJ.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\dipwo1iToJ.exeQueries volume information: C:\Users\user\Desktop\dipwo1iToJ.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\dipwo1iToJ.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI68642 VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\dipwo1iToJ.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI68642 VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\dipwo1iToJ.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI68642\_sqlite3.pyd VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\dipwo1iToJ.exeQueries volume information: C:\Users\user\Desktop\dipwo1iToJ.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\dipwo1iToJ.exeQueries volume information: C:\Users\user\Desktop\dipwo1iToJ.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\dipwo1iToJ.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI68642 VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\dipwo1iToJ.exeQueries volume information: C:\Users\user\Desktop\dipwo1iToJ.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\dipwo1iToJ.exeQueries volume information: C:\Users\user\Desktop\dipwo1iToJ.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\dipwo1iToJ.exeQueries volume information: C:\Users\user\Desktop\dipwo1iToJ.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\dipwo1iToJ.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI68642 VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\dipwo1iToJ.exeQueries volume information: C:\Users\user\Desktop\dipwo1iToJ.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\dipwo1iToJ.exeQueries volume information: C:\Users\user\Desktop\dipwo1iToJ.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\dipwo1iToJ.exeQueries volume information: C:\Users\user\Desktop\dipwo1iToJ.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\dipwo1iToJ.exeQueries volume information: C:\Users\user\Desktop\dipwo1iToJ.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\dipwo1iToJ.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI68642 VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\dipwo1iToJ.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI68642\win32 VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\dipwo1iToJ.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI68642\pywin32_system32 VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\dipwo1iToJ.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI68642 VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\dipwo1iToJ.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI68642\win32 VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\dipwo1iToJ.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI68642\pywin32_system32 VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\dipwo1iToJ.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI68642\setuptools\_vendor VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\dipwo1iToJ.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI68642 VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\dipwo1iToJ.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI68642\win32 VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\dipwo1iToJ.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI68642\setuptools\_vendor VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\dipwo1iToJ.exeQueries volume information: C:\Users\user\Desktop\dipwo1iToJ.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\dipwo1iToJ.exeQueries volume information: C:\Users\user\Desktop\dipwo1iToJ.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\dipwo1iToJ.exeQueries volume information: C:\Users\user\Desktop\dipwo1iToJ.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\dipwo1iToJ.exeQueries volume information: C:\Users\user\Desktop\dipwo1iToJ.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\dipwo1iToJ.exeQueries volume information: C:\Users\user\Desktop\dipwo1iToJ.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\dipwo1iToJ.exeQueries volume information: C:\Users\user\Desktop\dipwo1iToJ.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\dipwo1iToJ.exeQueries volume information: C:\Users\user\Desktop\dipwo1iToJ.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\dipwo1iToJ.exeQueries volume information: C:\Users\user\Desktop\dipwo1iToJ.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\dipwo1iToJ.exeQueries volume information: C:\Users\user\Desktop\dipwo1iToJ.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\dipwo1iToJ.exeQueries volume information: C:\Users\user\Desktop\dipwo1iToJ.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\dipwo1iToJ.exeQueries volume information: C:\Users\user\Desktop\dipwo1iToJ.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\dipwo1iToJ.exeQueries volume information: C:\Users\user\Desktop\dipwo1iToJ.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\dipwo1iToJ.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI68642 VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\dipwo1iToJ.exeQueries volume information: C:\Users\user\Desktop\dipwo1iToJ.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\dipwo1iToJ.exeQueries volume information: C:\Users\user\Desktop\dipwo1iToJ.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\dipwo1iToJ.exeQueries volume information: C:\Users\user\Desktop\dipwo1iToJ.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\dipwo1iToJ.exeQueries volume information: C:\Users\user\Desktop\dipwo1iToJ.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\dipwo1iToJ.exeQueries volume information: C:\Users\user\Desktop\dipwo1iToJ.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\dipwo1iToJ.exeQueries volume information: C:\Users\user\Desktop\dipwo1iToJ.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\dipwo1iToJ.exeQueries volume information: C:\Users\user\Desktop\dipwo1iToJ.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\dipwo1iToJ.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI68642 VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\dipwo1iToJ.exeCode function: 0_2_00007FF6F8FCD080 GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,0_2_00007FF6F8FCD080
    Source: C:\Users\user\Desktop\dipwo1iToJ.exeCode function: 0_2_00007FF6F8FE5C70 _get_daylight,_get_daylight,_get_daylight,_get_daylight,_get_daylight,GetTimeZoneInformation,0_2_00007FF6F8FE5C70

    Stealing of Sensitive Information

    barindex
    Yara detected Generic Python Stealer
    Source: Yara matchFile source: Process Memory Space: dipwo1iToJ.exe PID: 792, type: MEMORYSTR

    Remote Access Functionality

    barindex
    Yara detected Generic Python Stealer
    Source: Yara matchFile source: Process Memory Space: dipwo1iToJ.exe PID: 792, type: MEMORYSTR

    Mitre Att&ck Matrix

    ReconnaissanceResource DevelopmentInitial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionCommand and ControlExfiltrationImpact
    Gather Victim Identity InformationAcquire InfrastructureValid Accounts11
    Windows Management Instrumentation    		1
    DLL Side-Loading    		11
    Process Injection    		1
    Virtualization/Sandbox Evasion    		OS Credential Dumping2
    System Time Discovery    		Remote Services1
    Archive Collected Data    		1
    Encrypted Channel    		Exfiltration Over Other Network MediumAbuse Accessibility Features
    CredentialsDomainsDefault Accounts1
    Native API    		Boot or Logon Initialization Scripts1
    DLL Side-Loading    		11
    Process Injection    		LSASS Memory31
    Security Software Discovery    		Remote Desktop ProtocolData from Removable Media1
    Ingress Tool Transfer    		Exfiltration Over BluetoothNetwork Denial of Service
    Email AddressesDNS ServerDomain AccountsAtLogon Script (Windows)Logon Script (Windows)1
    Deobfuscate/Decode Files or Information    		Security Account Manager1
    Virtualization/Sandbox Evasion    		SMB/Windows Admin SharesData from Network Shared Drive1
    Non-Application Layer Protocol    		Automated ExfiltrationData Encrypted for Impact
    Employee NamesVirtual Private ServerLocal AccountsCronLogin HookLogin Hook1
    Obfuscated Files or Information    		NTDS1
    Process Discovery    		Distributed Component Object ModelInput Capture1
    Application Layer Protocol    		Traffic DuplicationData Destruction
    Gather Victim Network InformationServerCloud AccountsLaunchdNetwork Logon ScriptNetwork Logon Script1
    DLL Side-Loading    		LSA Secrets1
    File and Directory Discovery    		SSHKeyloggingFallback ChannelsScheduled TransferData Encrypted for Impact
    Domain PropertiesBotnetReplication Through Removable MediaScheduled TaskRC ScriptsRC ScriptsSteganographyCached Domain Credentials25
    System Information Discovery    		VNCGUI Input CaptureMultiband CommunicationData Transfer Size LimitsService Stop

    Behavior Graph

    Hide Legend

    Legend:

    • Process
    • Signature
    • Created File
    • DNS/IP Info
    • Is Dropped
    • Is Windows Process
    • Number of created Registry Values
    • Number of created Files
    • Visual Basic
    • Delphi
    • Java
    • .Net C# or VB.NET
    • C, C++ or other language
    • Is malicious
    • Internet

    Screenshots

    Thumbnails

    This section contains all screenshots as thumbnails, including those not shown in the slideshow.


    windows-stand

    Antivirus, Machine Learning and Genetic Malware Detection

    Initial Sample

    SourceDetectionScannerLabelLink
    dipwo1iToJ.exe53%ReversingLabsWin64.Trojan.Generic

    Dropped Files

    SourceDetectionScannerLabelLink
    C:\Users\user\AppData\Local\Temp\_MEI68642\Crypto\Cipher\_ARC4.pyd0%ReversingLabs
    C:\Users\user\AppData\Local\Temp\_MEI68642\Crypto\Cipher\_Salsa20.pyd0%ReversingLabs
    C:\Users\user\AppData\Local\Temp\_MEI68642\Crypto\Cipher\_chacha20.pyd0%ReversingLabs
    C:\Users\user\AppData\Local\Temp\_MEI68642\Crypto\Cipher\_pkcs1_decode.pyd0%ReversingLabs
    C:\Users\user\AppData\Local\Temp\_MEI68642\Crypto\Cipher\_raw_aes.pyd0%ReversingLabs
    C:\Users\user\AppData\Local\Temp\_MEI68642\Crypto\Cipher\_raw_aesni.pyd0%ReversingLabs
    C:\Users\user\AppData\Local\Temp\_MEI68642\Crypto\Cipher\_raw_arc2.pyd0%ReversingLabs
    C:\Users\user\AppData\Local\Temp\_MEI68642\Crypto\Cipher\_raw_blowfish.pyd0%ReversingLabs
    C:\Users\user\AppData\Local\Temp\_MEI68642\Crypto\Cipher\_raw_cast.pyd0%ReversingLabs
    C:\Users\user\AppData\Local\Temp\_MEI68642\Crypto\Cipher\_raw_cbc.pyd0%ReversingLabs
    C:\Users\user\AppData\Local\Temp\_MEI68642\Crypto\Cipher\_raw_cfb.pyd0%ReversingLabs
    C:\Users\user\AppData\Local\Temp\_MEI68642\Crypto\Cipher\_raw_ctr.pyd0%ReversingLabs
    C:\Users\user\AppData\Local\Temp\_MEI68642\Crypto\Cipher\_raw_des.pyd0%ReversingLabs
    C:\Users\user\AppData\Local\Temp\_MEI68642\Crypto\Cipher\_raw_des3.pyd0%ReversingLabs
    C:\Users\user\AppData\Local\Temp\_MEI68642\Crypto\Cipher\_raw_ecb.pyd0%ReversingLabs
    C:\Users\user\AppData\Local\Temp\_MEI68642\Crypto\Cipher\_raw_eksblowfish.pyd0%ReversingLabs
    C:\Users\user\AppData\Local\Temp\_MEI68642\Crypto\Cipher\_raw_ocb.pyd0%ReversingLabs
    C:\Users\user\AppData\Local\Temp\_MEI68642\Crypto\Cipher\_raw_ofb.pyd0%ReversingLabs
    C:\Users\user\AppData\Local\Temp\_MEI68642\Crypto\Hash\_BLAKE2b.pyd0%ReversingLabs
    C:\Users\user\AppData\Local\Temp\_MEI68642\Crypto\Hash\_BLAKE2s.pyd0%ReversingLabs
    C:\Users\user\AppData\Local\Temp\_MEI68642\Crypto\Hash\_MD2.pyd0%ReversingLabs
    C:\Users\user\AppData\Local\Temp\_MEI68642\Crypto\Hash\_MD4.pyd0%ReversingLabs
    C:\Users\user\AppData\Local\Temp\_MEI68642\Crypto\Hash\_MD5.pyd0%ReversingLabs
    C:\Users\user\AppData\Local\Temp\_MEI68642\Crypto\Hash\_RIPEMD160.pyd0%ReversingLabs
    C:\Users\user\AppData\Local\Temp\_MEI68642\Crypto\Hash\_SHA1.pyd0%ReversingLabs
    C:\Users\user\AppData\Local\Temp\_MEI68642\Crypto\Hash\_SHA224.pyd0%ReversingLabs
    C:\Users\user\AppData\Local\Temp\_MEI68642\Crypto\Hash\_SHA256.pyd0%ReversingLabs
    C:\Users\user\AppData\Local\Temp\_MEI68642\Crypto\Hash\_SHA384.pyd0%ReversingLabs
    C:\Users\user\AppData\Local\Temp\_MEI68642\Crypto\Hash\_SHA512.pyd0%ReversingLabs
    C:\Users\user\AppData\Local\Temp\_MEI68642\Crypto\Hash\_ghash_clmul.pyd0%ReversingLabs
    C:\Users\user\AppData\Local\Temp\_MEI68642\Crypto\Hash\_ghash_portable.pyd0%ReversingLabs
    C:\Users\user\AppData\Local\Temp\_MEI68642\Crypto\Hash\_keccak.pyd0%ReversingLabs
    C:\Users\user\AppData\Local\Temp\_MEI68642\Crypto\Hash\_poly1305.pyd0%ReversingLabs
    C:\Users\user\AppData\Local\Temp\_MEI68642\Crypto\Math\_modexp.pyd0%ReversingLabs
    C:\Users\user\AppData\Local\Temp\_MEI68642\Crypto\Protocol\_scrypt.pyd0%ReversingLabs
    C:\Users\user\AppData\Local\Temp\_MEI68642\Crypto\PublicKey\_curve25519.pyd0%ReversingLabs
    C:\Users\user\AppData\Local\Temp\_MEI68642\Crypto\PublicKey\_curve448.pyd0%ReversingLabs
    C:\Users\user\AppData\Local\Temp\_MEI68642\Crypto\PublicKey\_ec_ws.pyd0%ReversingLabs
    C:\Users\user\AppData\Local\Temp\_MEI68642\Crypto\PublicKey\_ed25519.pyd0%ReversingLabs
    C:\Users\user\AppData\Local\Temp\_MEI68642\Crypto\PublicKey\_ed448.pyd0%ReversingLabs
    C:\Users\user\AppData\Local\Temp\_MEI68642\Crypto\Util\_cpuid_c.pyd0%ReversingLabs
    C:\Users\user\AppData\Local\Temp\_MEI68642\Crypto\Util\_strxor.pyd0%ReversingLabs
    C:\Users\user\AppData\Local\Temp\_MEI68642\VCRUNTIME140.dll0%ReversingLabs
    C:\Users\user\AppData\Local\Temp\_MEI68642\VCRUNTIME140_1.dll0%ReversingLabs
    C:\Users\user\AppData\Local\Temp\_MEI68642\_asyncio.pyd0%ReversingLabs
    C:\Users\user\AppData\Local\Temp\_MEI68642\_bz2.pyd0%ReversingLabs
    C:\Users\user\AppData\Local\Temp\_MEI68642\_cffi_backend.cp312-win_amd64.pyd0%ReversingLabs
    C:\Users\user\AppData\Local\Temp\_MEI68642\_ctypes.pyd0%ReversingLabs
    C:\Users\user\AppData\Local\Temp\_MEI68642\_decimal.pyd0%ReversingLabs
    C:\Users\user\AppData\Local\Temp\_MEI68642\_hashlib.pyd0%ReversingLabs
    C:\Users\user\AppData\Local\Temp\_MEI68642\_lzma.pyd0%ReversingLabs
    C:\Users\user\AppData\Local\Temp\_MEI68642\_multiprocessing.pyd0%ReversingLabs
    C:\Users\user\AppData\Local\Temp\_MEI68642\_overlapped.pyd0%ReversingLabs
    C:\Users\user\AppData\Local\Temp\_MEI68642\_queue.pyd0%ReversingLabs
    C:\Users\user\AppData\Local\Temp\_MEI68642\_socket.pyd0%ReversingLabs
    C:\Users\user\AppData\Local\Temp\_MEI68642\_sqlite3.pyd0%ReversingLabs
    C:\Users\user\AppData\Local\Temp\_MEI68642\_ssl.pyd0%ReversingLabs
    C:\Users\user\AppData\Local\Temp\_MEI68642\_uuid.pyd0%ReversingLabs
    C:\Users\user\AppData\Local\Temp\_MEI68642\_wmi.pyd0%ReversingLabs
    C:\Users\user\AppData\Local\Temp\_MEI68642\aiohttp\_http_parser.cp312-win_amd64.pyd0%ReversingLabs

    Unpacked PE Files

    ⊘No Antivirus matches

    Domains

    ⊘No Antivirus matches

    URLs

    SourceDetectionScannerLabelLink
    https://www.attrs.org/en/stable/why.html#data-classes)0%Avira URL Cloudsafe
    https://api.namemc.com/profile/0%Avira URL Cloudsafe
    http://repository.swisssign.com/00%Avira URL Cloudsafe
    https://tidelift.com/?utm_source=lifter&utm_medium=referral&utm_campaign=hynek).0%Avira URL Cloudsafe
    https://cryptography.io/en/latest/faq/#why-can-t-i-import-my-pem-file0%Avira URL Cloudsafe
    https://urllib3.readthedocs.io/en/latest/advanced-usage.html#https-proxy-error-http-proxy0%Avira URL Cloudsafe
    https://tiktok.comr0%Avira URL Cloudsafe
    https://filepreviews.io/0%Avira URL Cloudsafe
    https://setuptools.pypa.io/en/latest/references/keywords.html#keyword-namespace-packagesr:0%Avira URL Cloudsafe
    https://wwww.certigna.fr/autorites/0m0%Avira URL Cloudsafe
    http://163.5.242.208/7236785358_chat.txtPn0%Avira URL Cloudsafe
    http://163.5.242.208/7236785358_chat.txt0%Avira URL Cloudsafe
    https://xbox.comz0%Avira URL Cloudsafe
    https://uguu.se/api.php?d=uploadr0%Avira URL Cloudsafe
    https://www.variomedia.de/0%Avira URL Cloudsafe
    https://www.attrs.org/en/stable/changelog.html0%Avira URL Cloudsafe
    https://www.attrs.org/0%Avira URL Cloudsafe
    http://www.accv.es000%Avira URL Cloudsafe

    Domains and IPs

    Contacted Domains

    ⊘No contacted domains info

    Contacted URLs

    NameMaliciousAntivirus DetectionReputation
    http://163.5.242.208/7236785358_chat.txtfalse
    • Avira URL Cloud: safe
    		unknown

    URLs from Memory and Binaries

    NameSourceMaliciousAntivirus DetectionReputation
    https://account.riotgames.com/api/account/v1/userdipwo1iToJ.exe, 00000001.00000002.1785618265.0000017A61410000.00000004.00001000.00020000.00000000.sdmp, dipwo1iToJ.exe, 00000001.00000003.1724114185.0000017A60DC4000.00000004.00000020.00020000.00000000.sdmpfalse
      		high
      https://github.com/pyca/cryptography/issues/8996dipwo1iToJ.exe, 00000001.00000002.1789007887.00007FFDFA7AA000.00000002.00000001.01000000.00000029.sdmpfalse
        		high
        https://github.com/astral-sh/ruffMETADATA.0.drfalse
          		high
          https://github.com/giampaolo/psutil/issues/875.dipwo1iToJ.exe, 00000001.00000002.1787515881.0000017A62710000.00000004.00001000.00020000.00000000.sdmpfalse
            		high
            https://github.com/python-attrs/attrs/issues/251dipwo1iToJ.exe, 00000001.00000002.1783821326.0000017A606CD000.00000004.00000020.00020000.00000000.sdmpfalse
              		high
              https://setuptools.pypa.io/en/latest/references/keywords.html#keyword-namespace-packagesdipwo1iToJ.exe, 00000001.00000002.1784071137.0000017A608A0000.00000004.00001000.00020000.00000000.sdmpfalse
                		high
                https://github.com/python/importlib_metadata/actions/workflows/main.yml/badge.svgMETADATA.0.drfalse
                  		high
                  https://github.com/aio-libs/aiohttp/discussions/6044dipwo1iToJ.exe, 00000001.00000002.1787439688.0000017A622D0000.00000004.00001000.00020000.00000000.sdmp, dipwo1iToJ.exe, 00000001.00000002.1786607711.0000017A61B7E000.00000004.00000020.00020000.00000000.sdmpfalse
                    		high
                    https://github.com/python/importlib_metadata/issuesMETADATA.0.drfalse
                      		high
                      https://paypal.comdipwo1iToJ.exe, 00000001.00000002.1785618265.0000017A61410000.00000004.00001000.00020000.00000000.sdmp, dipwo1iToJ.exe, 00000001.00000003.1724114185.0000017A60DC4000.00000004.00000020.00020000.00000000.sdmpfalse
                        		high
                        http://repository.swisssign.com/0dipwo1iToJ.exe, 00000001.00000002.1784330278.0000017A60D81000.00000004.00000020.00020000.00000000.sdmpfalse
                        • Avira URL Cloud: safe
                        		unknown
                        http://python.orgdipwo1iToJ.exe, 00000001.00000002.1786135596.0000017A61780000.00000004.00001000.00020000.00000000.sdmpfalse
                          		high
                          https://github.com/tensorflow/datasets/blob/master/tensorflow_datasets/core/utils/resource_utils.py#dipwo1iToJ.exe, 00000001.00000002.1783280394.0000017A5E940000.00000004.00000020.00020000.00000000.sdmp, dipwo1iToJ.exe, 00000001.00000003.1710250517.0000017A6045F000.00000004.00000020.00020000.00000000.sdmp, dipwo1iToJ.exe, 00000001.00000003.1717300666.0000017A5E940000.00000004.00000020.00020000.00000000.sdmp, dipwo1iToJ.exe, 00000001.00000003.1710274832.0000017A60456000.00000004.00000020.00020000.00000000.sdmp, dipwo1iToJ.exe, 00000001.00000003.1713302317.0000017A5E940000.00000004.00000020.00020000.00000000.sdmp, dipwo1iToJ.exe, 00000001.00000003.1712793220.0000017A5E940000.00000004.00000020.00020000.00000000.sdmp, dipwo1iToJ.exe, 00000001.00000003.1713862624.0000017A5E940000.00000004.00000020.00020000.00000000.sdmp, dipwo1iToJ.exe, 00000001.00000002.1783601146.0000017A60450000.00000004.00000020.00020000.00000000.sdmpfalse
                            		high
                            https://wheel.readthedocs.io/en/stable/news.htmlMETADATA2.0.drfalse
                              		high
                              https://github.com/sponsors/hynekMETADATA0.0.drfalse
                                		high
                                https://oauth.reddit.com/api/v1/medipwo1iToJ.exe, 00000001.00000002.1785618265.0000017A61410000.00000004.00001000.00020000.00000000.sdmpfalse
                                  		high
                                  https://ipinfo.io/jsonudipwo1iToJ.exe, 00000001.00000003.1724114185.0000017A60DC4000.00000004.00000020.00020000.00000000.sdmpfalse
                                    		high
                                    https://importlib-metadata.readthedocs.io/METADATA.0.drfalse
                                      		high
                                      https://store.steampowered.comdipwo1iToJ.exe, 00000001.00000002.1785618265.0000017A61410000.00000004.00001000.00020000.00000000.sdmp, dipwo1iToJ.exe, 00000001.00000003.1724114185.0000017A60DC4000.00000004.00000020.00020000.00000000.sdmpfalse
                                        		high
                                        http://goo.gl/zeJZl.dipwo1iToJ.exe, 00000001.00000002.1787439688.0000017A622D0000.00000004.00001000.00020000.00000000.sdmp, dipwo1iToJ.exe, 00000001.00000002.1784723256.0000017A60E9F000.00000004.00000020.00020000.00000000.sdmpfalse
                                          		high
                                          https://www.apache.org/licenses/LICENSE-2.0LICENSE.APACHE.0.drfalse
                                            		high
                                            https://ebay.comdipwo1iToJ.exe, 00000001.00000002.1785618265.0000017A61410000.00000004.00001000.00020000.00000000.sdmp, dipwo1iToJ.exe, 00000001.00000003.1724114185.0000017A60DC4000.00000004.00000020.00020000.00000000.sdmpfalse
                                              		high
                                              https://packaging.python.org/en/latest/specifications/core-metadata/dipwo1iToJ.exe, 00000001.00000002.1785618265.0000017A61410000.00000004.00001000.00020000.00000000.sdmpfalse
                                                		high
                                                https://epicgames.comdipwo1iToJ.exe, 00000001.00000002.1785618265.0000017A61410000.00000004.00001000.00020000.00000000.sdmp, dipwo1iToJ.exe, 00000001.00000003.1724114185.0000017A60DC4000.00000004.00000020.00020000.00000000.sdmpfalse
                                                  		high
                                                  https://docs.python.org/3.11/library/binascii.html#binascii.a2b_base64dipwo1iToJ.exe, 00000001.00000003.1719042544.0000017A60817000.00000004.00000020.00020000.00000000.sdmp, dipwo1iToJ.exe, 00000001.00000003.1718206364.0000017A60815000.00000004.00000020.00020000.00000000.sdmp, dipwo1iToJ.exe, 00000001.00000003.1715349063.0000017A60815000.00000004.00000020.00020000.00000000.sdmp, dipwo1iToJ.exe, 00000001.00000002.1783821326.0000017A6084A000.00000004.00000020.00020000.00000000.sdmp, dipwo1iToJ.exe, 00000001.00000003.1720080418.0000017A60817000.00000004.00000020.00020000.00000000.sdmp, dipwo1iToJ.exe, 00000001.00000003.1719985872.0000017A60815000.00000004.00000020.00020000.00000000.sdmp, dipwo1iToJ.exe, 00000001.00000003.1715319594.0000017A60823000.00000004.00000020.00020000.00000000.sdmp, dipwo1iToJ.exe, 00000001.00000003.1716039388.0000017A6081F000.00000004.00000020.00020000.00000000.sdmp, dipwo1iToJ.exe, 00000001.00000003.1727487193.0000017A607FA000.00000004.00000020.00020000.00000000.sdmp, dipwo1iToJ.exe, 00000001.00000003.1720015694.0000017A6081B000.00000004.00000020.00020000.00000000.sdmp, dipwo1iToJ.exe, 00000001.00000003.1721263504.0000017A60812000.00000004.00000020.00020000.00000000.sdmpfalse
                                                    		high
                                                    https://github.com/pypa/packagingdipwo1iToJ.exe, 00000001.00000002.1784874976.0000017A60ED0000.00000004.00001000.00020000.00000000.sdmpfalse
                                                      		high
                                                      https://www.dropbox.com/scl/fi/3clo0b3x6nfajqm27kvx6/exodus.asar?rlkey=200tiyus0rc0u3u4j9kf517l0&st=dipwo1iToJ.exe, 00000001.00000002.1783520183.0000017A60350000.00000004.00001000.00020000.00000000.sdmpfalse
                                                        		high
                                                        https://tidelift.com/?utm_source=lifter&utm_medium=referral&utm_campaign=hynek).METADATA0.0.drfalse
                                                        • Avira URL Cloud: safe
                                                        		unknown
                                                        https://readthedocs.org/projects/importlib-metadata/badge/?version=latestMETADATA.0.drfalse
                                                          		high
                                                          https://refspecs.linuxfoundation.org/elf/gabi4dipwo1iToJ.exe, 00000001.00000002.1784965590.0000017A60FF0000.00000004.00001000.00020000.00000000.sdmpfalse
                                                            		high
                                                            https://www.roblox.com/mobileapi/userinfordipwo1iToJ.exe, 00000001.00000003.1724114185.0000017A60DC4000.00000004.00000020.00020000.00000000.sdmpfalse
                                                              		high
                                                              https://api.namemc.com/profile/dipwo1iToJ.exe, 00000001.00000002.1785618265.0000017A61410000.00000004.00001000.00020000.00000000.sdmp, dipwo1iToJ.exe, 00000001.00000003.1724114185.0000017A60DC4000.00000004.00000020.00020000.00000000.sdmpfalse
                                                              • Avira URL Cloud: safe
                                                              		unknown
                                                              https://discord.com/api/v9/users/dipwo1iToJ.exe, 00000001.00000003.1724114185.0000017A60DC4000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                		high
                                                                https://ipinfo.io/jsondipwo1iToJ.exe, 00000001.00000002.1785618265.0000017A61410000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                  		high
                                                                  https://github.com/urllib3/urllib3/issues/2192#issuecomment-821832963dipwo1iToJ.exe, 00000001.00000002.1785618265.0000017A61410000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                    		high
                                                                    https://youtube.com)dipwo1iToJ.exe, 00000001.00000003.1724114185.0000017A60DC4000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                      		high
                                                                      https://blog.jaraco.com/skeletonMETADATA.0.drfalse
                                                                        		high
                                                                        https://github.com/python-attrs/attrs/issues/136dipwo1iToJ.exe, 00000001.00000002.1786434698.0000017A619AE000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                          		high
                                                                          https://tools.ietf.org/html/rfc3610dipwo1iToJ.exe, 00000001.00000002.1786434698.0000017A61A00000.00000004.00000020.00020000.00000000.sdmp, dipwo1iToJ.exe, 00000001.00000002.1784723256.0000017A60E9F000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                            		high
                                                                            https://github.com/platformdirs/platformdirsdipwo1iToJ.exe, 00000001.00000002.1784965590.0000017A60FF0000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                              		high
                                                                              http://crl.dhimyotis.com/certignarootca.crldipwo1iToJ.exe, 00000001.00000002.1786218480.0000017A618FE000.00000004.00000020.00020000.00000000.sdmp, dipwo1iToJ.exe, 00000001.00000002.1784330278.0000017A60C65000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                		high
                                                                                http://curl.haxx.se/rfc/cookie_spec.htmldipwo1iToJ.exe, 00000001.00000002.1785999287.0000017A61630000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                  		high
                                                                                  http://docs.python.org/3/library/subprocess#subprocess.Popen.returncodedipwo1iToJ.exe, 00000001.00000002.1785618265.0000017A61410000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                    		high
                                                                                    https://github.com/pypa/.github/blob/main/CODE_OF_CONDUCT.mdMETADATA2.0.drfalse
                                                                                      		high
                                                                                      https://setuptools.pypa.io/en/latest/references/keywords.html#keyword-namespace-packagesr:dipwo1iToJ.exe, 00000001.00000003.1714086462.0000017A607BE000.00000004.00000020.00020000.00000000.sdmp, dipwo1iToJ.exe, 00000001.00000003.1714086462.0000017A6080D000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                      • Avira URL Cloud: safe
                                                                                      		unknown
                                                                                      https://catbox.moe/user/api.phpdipwo1iToJ.exe, 00000001.00000002.1785618265.0000017A61410000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                        		high
                                                                                        https://docs.python.org/3/library/importlib.html#importlib.abc.ExecutionLoader.get_filenamedipwo1iToJ.exe, 00000001.00000003.1710250517.0000017A6045F000.00000004.00000020.00020000.00000000.sdmp, dipwo1iToJ.exe, 00000001.00000003.1710274832.0000017A60456000.00000004.00000020.00020000.00000000.sdmp, dipwo1iToJ.exe, 00000001.00000002.1783399636.0000017A60100000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                          		high
                                                                                          https://urllib3.readthedocs.io/en/latest/advanced-usage.html#https-proxy-error-http-proxydipwo1iToJ.exe, 00000001.00000002.1785999287.0000017A61630000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                          • Avira URL Cloud: safe
                                                                                          		unknown
                                                                                          https://github.com/python-attrs/attrs/issues/1330)METADATA0.0.drfalse
                                                                                            		high
                                                                                            https://catbox.moe/user/api.phprdipwo1iToJ.exe, 00000001.00000003.1724114185.0000017A60DC4000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                              		high
                                                                                              https://pypi.org/project/build/).dipwo1iToJ.exe, 00000001.00000002.1785418273.0000017A61310000.00000004.00001000.00020000.00000000.sdmp, dipwo1iToJ.exe, 00000001.00000002.1785102451.0000017A610F0000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                		high
                                                                                                https://datatracker.ietf.org/doc/html/rfc3986#section-3.2.3dipwo1iToJ.exe, 00000001.00000002.1786218480.0000017A618FE000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                  		high
                                                                                                  https://tiktok.comrdipwo1iToJ.exe, 00000001.00000003.1724114185.0000017A60DC4000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                  • Avira URL Cloud: safe
                                                                                                  		unknown
                                                                                                  https://datatracker.ietf.org/doc/html/rfc3986#section-3.2.2dipwo1iToJ.exe, 00000001.00000002.1786218480.0000017A618FE000.00000004.00000020.00020000.00000000.sdmp, dipwo1iToJ.exe, 00000001.00000002.1786135596.0000017A61780000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                    		high
                                                                                                    https://wwww.certigna.fr/autorites/0mdipwo1iToJ.exe, 00000001.00000002.1784330278.0000017A60C65000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                    • Avira URL Cloud: safe
                                                                                                    		unknown
                                                                                                    https://github.com/pypa/wheelMETADATA2.0.drfalse
                                                                                                      		high
                                                                                                      https://www.python.org/dev/peps/pep-0427/METADATA2.0.drfalse
                                                                                                        		high
                                                                                                        https://github.com/python/cpython/blob/839d7893943782ee803536a47f1d4de160314f85/Lib/importlib/readerdipwo1iToJ.exe, 00000001.00000002.1783280394.0000017A5E940000.00000004.00000020.00020000.00000000.sdmp, dipwo1iToJ.exe, 00000001.00000003.1710250517.0000017A6045F000.00000004.00000020.00020000.00000000.sdmp, dipwo1iToJ.exe, 00000001.00000003.1717300666.0000017A5E940000.00000004.00000020.00020000.00000000.sdmp, dipwo1iToJ.exe, 00000001.00000003.1710274832.0000017A60456000.00000004.00000020.00020000.00000000.sdmp, dipwo1iToJ.exe, 00000001.00000003.1713302317.0000017A5E940000.00000004.00000020.00020000.00000000.sdmp, dipwo1iToJ.exe, 00000001.00000003.1712793220.0000017A5E940000.00000004.00000020.00020000.00000000.sdmp, dipwo1iToJ.exe, 00000001.00000003.1713862624.0000017A5E940000.00000004.00000020.00020000.00000000.sdmp, dipwo1iToJ.exe, 00000001.00000002.1783601146.0000017A60450000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                          		high
                                                                                                          https://instagram.comdipwo1iToJ.exe, 00000001.00000002.1785618265.0000017A61410000.00000004.00001000.00020000.00000000.sdmp, dipwo1iToJ.exe, 00000001.00000003.1724114185.0000017A60DC4000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                            		high
                                                                                                            https://github.com/python/cpython/issues/86361.dipwo1iToJ.exe, 00000001.00000003.1717435682.0000017A60737000.00000004.00000020.00020000.00000000.sdmp, dipwo1iToJ.exe, 00000001.00000002.1783821326.0000017A6071E000.00000004.00000020.00020000.00000000.sdmp, dipwo1iToJ.exe, 00000001.00000003.1716973785.0000017A60AD1000.00000004.00000020.00020000.00000000.sdmp, dipwo1iToJ.exe, 00000001.00000003.1716973785.0000017A60B31000.00000004.00000020.00020000.00000000.sdmp, dipwo1iToJ.exe, 00000001.00000003.1715983243.0000017A60B31000.00000004.00000020.00020000.00000000.sdmp, dipwo1iToJ.exe, 00000001.00000003.1718401236.0000017A60737000.00000004.00000020.00020000.00000000.sdmp, dipwo1iToJ.exe, 00000001.00000003.1720406212.0000017A6071E000.00000004.00000020.00020000.00000000.sdmp, dipwo1iToJ.exe, 00000001.00000003.1719042544.0000017A60737000.00000004.00000020.00020000.00000000.sdmp, dipwo1iToJ.exe, 00000001.00000003.1722143244.0000017A6071E000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                              		high
                                                                                                              http://mail.python.org/pipermail/python-dev/2012-June/120787.html.dipwo1iToJ.exe, 00000001.00000002.1786434698.0000017A61A00000.00000004.00000020.00020000.00000000.sdmp, dipwo1iToJ.exe, 00000001.00000002.1787439688.0000017A622D0000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                                		high
                                                                                                                https://httpbin.org/dipwo1iToJ.exe, 00000001.00000002.1784330278.0000017A60C65000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                  		high
                                                                                                                  https://www.apache.org/licenses/LICENSE.APACHE.0.drfalse
                                                                                                                    		high
                                                                                                                    https://cryptography.io/en/latest/faq/#why-can-t-i-import-my-pem-filedipwo1iToJ.exe, 00000001.00000002.1789007887.00007FFDFA7AA000.00000002.00000001.01000000.00000029.sdmpfalse
                                                                                                                    • Avira URL Cloud: safe
                                                                                                                    		unknown
                                                                                                                    https://docs.python.org/3/library/importlib.html#importlib.abc.Loader.exec_moduledipwo1iToJ.exe, 00000001.00000003.1710250517.0000017A6045F000.00000004.00000020.00020000.00000000.sdmp, dipwo1iToJ.exe, 00000001.00000003.1710274832.0000017A60456000.00000004.00000020.00020000.00000000.sdmp, dipwo1iToJ.exe, 00000001.00000002.1783520183.0000017A60350000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                                      		high
                                                                                                                      https://docs.python.org/3/library/importlib.html#importlib.abc.MetaPathFinder.invalidate_cachesdipwo1iToJ.exe, 00000001.00000003.1710250517.0000017A6045F000.00000004.00000020.00020000.00000000.sdmp, dipwo1iToJ.exe, 00000001.00000003.1710274832.0000017A60456000.00000004.00000020.00020000.00000000.sdmp, dipwo1iToJ.exe, 00000001.00000002.1783520183.0000017A60350000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                                        		high
                                                                                                                        https://filepreviews.io/METADATA0.0.drfalse
                                                                                                                        • Avira URL Cloud: safe
                                                                                                                        		unknown
                                                                                                                        https://discord.gg/rdipwo1iToJ.exe, 00000001.00000003.1724114185.0000017A60DC4000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                          		high
                                                                                                                          https://twitch.tvdipwo1iToJ.exe, 00000001.00000002.1785618265.0000017A61410000.00000004.00001000.00020000.00000000.sdmp, dipwo1iToJ.exe, 00000001.00000003.1724114185.0000017A60DC4000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                            		high
                                                                                                                            https://www.attrs.org/en/stable/why.html#data-classes)METADATA0.0.drfalse
                                                                                                                            • Avira URL Cloud: safe
                                                                                                                            		unknown
                                                                                                                            https://img.shields.io/badge/skeleton-2024-informationalMETADATA.0.drfalse
                                                                                                                              		high
                                                                                                                              https://packaging.python.org/en/latest/specifications/pyproject-toml/#declaring-project-metadata-thedipwo1iToJ.exe, 00000001.00000002.1783821326.0000017A606CD000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                		high
                                                                                                                                http://hg.python.org/cpython/file/603b4d593758/Lib/socket.py#l535dipwo1iToJ.exe, 00000001.00000002.1784330278.0000017A60D81000.00000004.00000020.00020000.00000000.sdmp, dipwo1iToJ.exe, 00000001.00000002.1784330278.0000017A60C65000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                  		high
                                                                                                                                  http://www.cert.fnmt.es/dpcs/LuvNdipwo1iToJ.exe, 00000001.00000002.1786218480.0000017A618FE000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                    		high
                                                                                                                                    https://xbox.comzdipwo1iToJ.exe, 00000001.00000003.1724114185.0000017A60DC4000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                    • Avira URL Cloud: safe
                                                                                                                                    		unknown
                                                                                                                                    https://github.com/pypa/setuptools/issues/417#issuecomment-392298401dipwo1iToJ.exe, 00000001.00000002.1785102451.0000017A610F0000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                                                      		high
                                                                                                                                      http://crl.securetrust.com/STCA.crldipwo1iToJ.exe, 00000001.00000002.1786218480.0000017A618A8000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                        		high
                                                                                                                                        http://www.accv.es/fileadmin/Archivos/certificados/raizaccv1.crt0dipwo1iToJ.exe, 00000001.00000002.1786218480.0000017A618FE000.00000004.00000020.00020000.00000000.sdmp, dipwo1iToJ.exe, 00000001.00000002.1786218480.0000017A618A8000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                          		high
                                                                                                                                          http://tools.ietf.org/html/rfc6125#section-6.4.3dipwo1iToJ.exe, 00000001.00000002.1785999287.0000017A61630000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                                                            		high
                                                                                                                                            https://www.attrs.org/en/stable/changelog.htmlMETADATA0.0.drfalse
                                                                                                                                            • Avira URL Cloud: safe
                                                                                                                                            		unknown
                                                                                                                                            https://discord.com/api/v6/guilds/dipwo1iToJ.exe, 00000001.00000002.1785618265.0000017A61410000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                                                              		high
                                                                                                                                              http://163.5.242.208/7236785358_chat.txtPndipwo1iToJ.exe, 00000001.00000002.1787594884.0000017A628F0000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                                                              • Avira URL Cloud: safe
                                                                                                                                              		unknown
                                                                                                                                              http://ip-api.com/jsonrdipwo1iToJ.exe, 00000001.00000003.1724114185.0000017A60DC4000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                		high
                                                                                                                                                https://uguu.se/api.php?d=uploadrdipwo1iToJ.exe, 00000001.00000003.1724114185.0000017A60DC4000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                • Avira URL Cloud: safe
                                                                                                                                                		unknown
                                                                                                                                                https://www.variomedia.de/METADATA0.0.drfalse
                                                                                                                                                • Avira URL Cloud: safe
                                                                                                                                                		unknown
                                                                                                                                                http://www.cert.fnmt.es/dpcs/dipwo1iToJ.exe, 00000001.00000002.1784330278.0000017A60D81000.00000004.00000020.00020000.00000000.sdmp, dipwo1iToJ.exe, 00000001.00000002.1786218480.0000017A618FE000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                  		high
                                                                                                                                                  https://google.com/maildipwo1iToJ.exe, 00000001.00000002.1784330278.0000017A60D81000.00000004.00000020.00020000.00000000.sdmp, dipwo1iToJ.exe, 00000001.00000002.1784330278.0000017A60BB5000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                    		high
                                                                                                                                                    https://img.shields.io/pypi/v/importlib_metadata.svgMETADATA.0.drfalse
                                                                                                                                                      		high
                                                                                                                                                      https://github.com/jaraco/jaraco.functools/issues/5dipwo1iToJ.exe, 00000001.00000002.1784965590.0000017A60FF0000.00000004.00001000.00020000.00000000.sdmp, dipwo1iToJ.exe, 00000001.00000003.1720406212.0000017A6071E000.00000004.00000020.00020000.00000000.sdmp, dipwo1iToJ.exe, 00000001.00000003.1722143244.0000017A6071E000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                        		high
                                                                                                                                                        http://www.accv.es00dipwo1iToJ.exe, 00000001.00000002.1786218480.0000017A618FE000.00000004.00000020.00020000.00000000.sdmp, dipwo1iToJ.exe, 00000001.00000002.1786218480.0000017A618A8000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                        • Avira URL Cloud: safe
                                                                                                                                                        		unknown
                                                                                                                                                        http://www.rfc-editor.org/info/rfc7253dipwo1iToJ.exe, 00000001.00000002.1786434698.0000017A61B3A000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                          		high
                                                                                                                                                          https://github.com/pyca/cryptography/issuesdipwo1iToJ.exe, 00000001.00000002.1789007887.00007FFDFA7AA000.00000002.00000001.01000000.00000029.sdmpfalse
                                                                                                                                                            		high
                                                                                                                                                            https://github.com/urllib3/urllib3/issues/2513#issuecomment-1152559900.dipwo1iToJ.exe, 00000001.00000002.1784330278.0000017A60C65000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                              		high
                                                                                                                                                              https://www.attrs.org/METADATA0.0.drfalse
                                                                                                                                                              • Avira URL Cloud: safe
                                                                                                                                                              		unknown
                                                                                                                                                              https://mahler:8092/site-updates.pydipwo1iToJ.exe, 00000001.00000003.1722665071.0000017A60BFD000.00000004.00000020.00020000.00000000.sdmp, dipwo1iToJ.exe, 00000001.00000002.1784330278.0000017A60BB5000.00000004.00000020.00020000.00000000.sdmp, dipwo1iToJ.exe, 00000001.00000003.1722333865.0000017A60C1D000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                		high
                                                                                                                                                                https://i.instagram.com/api/v1/accounts/current_user/?edit=trueTrdipwo1iToJ.exe, 00000001.00000003.1724114185.0000017A60DC4000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                  		high
                                                                                                                                                                  https://tools.ietf.org/html/rfc7231#section-4.3.6)dipwo1iToJ.exe, 00000001.00000002.1783821326.0000017A6071E000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                    		high
                                                                                                                                                                    https://users.roblox.com/v1/users/rdipwo1iToJ.exe, 00000001.00000003.1724114185.0000017A60DC4000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                      		high
                                                                                                                                                                      https://discord.gg/dipwo1iToJ.exe, 00000001.00000002.1785618265.0000017A61410000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                                                                                        		high

                                                                                                                                                                        World Map of Contacted IPs

                                                                                                                                                                        • No. of IPs < 25%
                                                                                                                                                                        • 25% < No. of IPs < 50%
                                                                                                                                                                        • 50% < No. of IPs < 75%
                                                                                                                                                                        • 75% < No. of IPs

                                                                                                                                                                        Public IPs

                                                                                                                                                                        IPDomainCountryFlagASNASN NameMalicious
                                                                                                                                                                        163.5.242.208
                                                                                                                                                                        		unknownFrance
                                                                                                                                                                        		56339EPITECHFRfalse

                                                                                                                                                                        Private

                                                                                                                                                                        IP
                                                                                                                                                                        127.0.0.1

                                                                                                                                                                        General Information

                                                                                                                                                                        Joe Sandbox version:41.0.0 Charoite
                                                                                                                                                                        Analysis ID:1570259
                                                                                                                                                                        Start date and time:2024-12-06 17:44:00 +01:00
                                                                                                                                                                        Joe Sandbox product:CloudBasic
                                                                                                                                                                        Overall analysis duration:0h 7m 6s
                                                                                                                                                                        Hypervisor based Inspection enabled:false
                                                                                                                                                                        Report type:full
                                                                                                                                                                        Cookbook file name:default.jbs
                                                                                                                                                                        Analysis system description:Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
                                                                                                                                                                        Number of analysed new started processes analysed:5
                                                                                                                                                                        Number of new started drivers analysed:0
                                                                                                                                                                        Number of existing processes analysed:0
                                                                                                                                                                        Number of existing drivers analysed:0
                                                                                                                                                                        Number of injected processes analysed:0
                                                                                                                                                                        Technologies:
                                                                                                                                                                        • HCA enabled
                                                                                                                                                                        • EGA enabled
                                                                                                                                                                        • AMSI enabled
                                                                                                                                                                        Analysis Mode:default
                                                                                                                                                                        Analysis stop reason:Timeout
                                                                                                                                                                        Sample name:dipwo1iToJ.exe
                                                                                                                                                                        renamed because original name is a hash value
                                                                                                                                                                        Original Sample Name:f40d72b602d086c3724048c5df9cc6f0.exe
                                                                                                                                                                        Detection:MAL
                                                                                                                                                                        Classification:mal52.troj.winEXE@3/109@0/2
                                                                                                                                                                        EGA Information:
                                                                                                                                                                        • Successful, ratio: 100%
                                                                                                                                                                        HCA Information:Failed
                                                                                                                                                                        Cookbook Comments:
                                                                                                                                                                        • Found application associated with file extension: .exe
                                                                                                                                                                        • Stop behavior analysis, all processes terminated

                                                                                                                                                                        Warnings

                                                                                                                                                                        • Exclude process from analysis (whitelisted): MpCmdRun.exe, SIHClient.exe, conhost.exe
                                                                                                                                                                        • Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, otelrules.azureedge.net, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
                                                                                                                                                                        • Not all processes where analyzed, report is missing behavior information
                                                                                                                                                                        • Report size getting too big, too many NtOpenKeyEx calls found.
                                                                                                                                                                        • Report size getting too big, too many NtQueryValueKey calls found.
                                                                                                                                                                        • Report size getting too big, too many NtQueryVolumeInformationFile calls found.
                                                                                                                                                                        • VT rate limit hit for: dipwo1iToJ.exe

                                                                                                                                                                        Simulations

                                                                                                                                                                        Behavior and APIs

                                                                                                                                                                        ⊘No simulations

                                                                                                                                                                        Joe Sandbox View / Context

                                                                                                                                                                        IPs

                                                                                                                                                                        ⊘No context

                                                                                                                                                                        Domains

                                                                                                                                                                        ⊘No context

                                                                                                                                                                        ASNs

                                                                                                                                                                        MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                                                                                                                                                        EPITECHFR105vjMVwfJ.dllGet hashmaliciousCobaltStrikeBrowse
                                                                                                                                                                        • 163.5.169.26
                                                                                                                                                                        7RDTQuL8WF.exeGet hashmaliciousCobaltStrikeBrowse
                                                                                                                                                                        • 163.5.169.26
                                                                                                                                                                        botx.spc.elfGet hashmaliciousMiraiBrowse
                                                                                                                                                                        • 163.5.176.64
                                                                                                                                                                        spc.elfGet hashmaliciousMiraiBrowse
                                                                                                                                                                        • 163.5.130.180
                                                                                                                                                                        m68k.elfGet hashmaliciousMiraiBrowse
                                                                                                                                                                        • 163.5.176.71
                                                                                                                                                                        sora.sh4.elfGet hashmaliciousMiraiBrowse
                                                                                                                                                                        • 163.5.152.99
                                                                                                                                                                        SecuriteInfo.com.Win32.MalwareX-gen.20028.17631.exeGet hashmaliciousAsyncRATBrowse
                                                                                                                                                                        • 163.5.160.86
                                                                                                                                                                        jNA5BK2z12.exeGet hashmaliciousAsyncRATBrowse
                                                                                                                                                                        • 163.5.160.86
                                                                                                                                                                        la.bot.m68k.elfGet hashmaliciousUnknownBrowse
                                                                                                                                                                        • 163.5.63.254
                                                                                                                                                                        https://zupimages.net/up/24/42/ol13.jpg?d6mSMvU0ZvpGwffnuqPHYMR7NvlxIzVjDfTD4YJjdRSCOccGet hashmaliciousUnknownBrowse
                                                                                                                                                                        • 163.5.194.37

                                                                                                                                                                        JA3 Fingerprints

                                                                                                                                                                        ⊘No context

                                                                                                                                                                        Dropped Files

                                                                                                                                                                        MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_MEI68642\Crypto\Cipher\_ARC4.pydROh2ijuEpr.exeGet hashmaliciousBabuk, ContiBrowse
                                                                                                                                                                          zed.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                            back.ps1Get hashmaliciousUnknownBrowse
                                                                                                                                                                              zed.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                                file.exeGet hashmaliciousPython Stealer, Amadey, LummaC Stealer, Nymaim, StealcBrowse
                                                                                                                                                                                  file.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                                    file.exeGet hashmaliciousAmadey, CryptbotBrowse
                                                                                                                                                                                      file.exeGet hashmaliciousAmadey, XWormBrowse
                                                                                                                                                                                        file.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                                          Payload.exeGet hashmaliciousPython Stealer, BLX Stealer, XLABB GrabberBrowse
                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI68642\Crypto\Cipher\_Salsa20.pydROh2ijuEpr.exeGet hashmaliciousBabuk, ContiBrowse
                                                                                                                                                                                              zed.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                back.ps1Get hashmaliciousUnknownBrowse
                                                                                                                                                                                                  zed.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                    file.exeGet hashmaliciousPython Stealer, Amadey, LummaC Stealer, Nymaim, StealcBrowse
                                                                                                                                                                                                      file.exeGet hashmaliciousPython StealerBrowse
                                                                                                                                                                                                        file.exeGet hashmaliciousPython StealerBrowse
                                                                                                                                                                                                          file.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                            file.exeGet hashmaliciousAmadey, CryptbotBrowse
                                                                                                                                                                                                              file.exeGet hashmaliciousAmadey, XWormBrowse

                                                                                                                                                                                                                Created / dropped Files

                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI68642\Crypto\Cipher\_ARC4.pyd

                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                Process:C:\Users\user\Desktop\dipwo1iToJ.exe
                                                                                                                                                                                                                File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                Size (bytes):11264
                                                                                                                                                                                                                Entropy (8bit):4.640339306680604
                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                SSDEEP:192:dLklddyTHThob0q/tJRrlDfNYSOcqgYCWt:ZgcdZq/JJD6gRWt
                                                                                                                                                                                                                MD5:BCD8CAAF9342AB891BB1D8DD45EF0098
                                                                                                                                                                                                                SHA1:EE7760BA0FF2548F25D764F000EFBB1332BE6D3E
                                                                                                                                                                                                                SHA-256:78725D2F55B7400A3FCAFECD35AF7AEB253FBC0FFCDF1903016EB0AABD1B4E50
                                                                                                                                                                                                                SHA-512:8B6FB53AECB514769985EBFDAB1B3C739024597D9C35905E04971D5422256546F7F169BF98F9BAF7D9F42A61CFF3EE7A20664989D3000773BF5EDA10CB3A0C24
                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                Antivirus:
                                                                                                                                                                                                                • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                Joe Sandbox View:
                                                                                                                                                                                                                • Filename: ROh2ijuEpr.exe, Detection: malicious, Browse
                                                                                                                                                                                                                • Filename: zed.exe, Detection: malicious, Browse
                                                                                                                                                                                                                • Filename: back.ps1, Detection: malicious, Browse
                                                                                                                                                                                                                • Filename: zed.exe, Detection: malicious, Browse
                                                                                                                                                                                                                • Filename: file.exe, Detection: malicious, Browse
                                                                                                                                                                                                                • Filename: file.exe, Detection: malicious, Browse
                                                                                                                                                                                                                • Filename: file.exe, Detection: malicious, Browse
                                                                                                                                                                                                                • Filename: file.exe, Detection: malicious, Browse
                                                                                                                                                                                                                • Filename: file.exe, Detection: malicious, Browse
                                                                                                                                                                                                                • Filename: Payload.exe, Detection: malicious, Browse
                                                                                                                                                                                                                Reputation:moderate, very likely benign file
                                                                                                                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......r^J.6?$.6?$.6?$.?G..2?$.dJ%.4?$.}G%.5?$.6?%..?$.dJ!.<?$.dJ .>?$.dJ'.5?$..J,.7?$..J$.7?$..J..7?$..J&.7?$.Rich6?$.........................PE..d...Y..f.........." ................P........................................p............`..........................................'......0(..d....P.......@...............`..(....!...............................!..8............ ...............................text............................... ..`.rdata..Z.... ......................@..@.data...H....0......."..............@....pdata.......@.......$..............@..@.rsrc........P.......(..............@..@.reloc..(....`.......*..............@..B........................................................................................................................................................................................................................................

                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI68642\Crypto\Cipher\_Salsa20.pyd

                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                Process:C:\Users\user\Desktop\dipwo1iToJ.exe
                                                                                                                                                                                                                File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                Size (bytes):13824
                                                                                                                                                                                                                Entropy (8bit):5.0194545642425075
                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                SSDEEP:192:4t/1nCuqaL0kt7AznuRmceS4lDFhAlcqgcLg:F/k1ACln4lDogcLg
                                                                                                                                                                                                                MD5:F19CB847E567A31FAB97435536C7B783
                                                                                                                                                                                                                SHA1:4C8BFE404AF28C1781740E7767619A5E2D2FF2B7
                                                                                                                                                                                                                SHA-256:1ECE1DC94471D6977DBE2CEEBA3764ADF0625E2203D6257F7C781C619D2A3DAD
                                                                                                                                                                                                                SHA-512:382DC205F703FC3E1F072F17F58E321E1A65B86BE7D9D6B07F24A02A156308A7FEC9B1A621BA1F3428FD6BB413D14AE9ECB2A2C8DD62A7659776CFFDEBB6374C
                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                Antivirus:
                                                                                                                                                                                                                • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                Joe Sandbox View:
                                                                                                                                                                                                                • Filename: ROh2ijuEpr.exe, Detection: malicious, Browse
                                                                                                                                                                                                                • Filename: zed.exe, Detection: malicious, Browse
                                                                                                                                                                                                                • Filename: back.ps1, Detection: malicious, Browse
                                                                                                                                                                                                                • Filename: zed.exe, Detection: malicious, Browse
                                                                                                                                                                                                                • Filename: file.exe, Detection: malicious, Browse
                                                                                                                                                                                                                • Filename: file.exe, Detection: malicious, Browse
                                                                                                                                                                                                                • Filename: file.exe, Detection: malicious, Browse
                                                                                                                                                                                                                • Filename: file.exe, Detection: malicious, Browse
                                                                                                                                                                                                                • Filename: file.exe, Detection: malicious, Browse
                                                                                                                                                                                                                • Filename: file.exe, Detection: malicious, Browse
                                                                                                                                                                                                                Reputation:moderate, very likely benign file
                                                                                                                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......~.:...:...:...3.j.>...h...8...q...9...:.......h...1...h...2...h...9.......;.......;.......;.......;...Rich:...........................PE..d...Z..f.........." ................P.....................................................`..........................................8......H9..d....`.......P..L............p..(....1...............................1..8............0...............................text...h........................... ..`.rdata..r....0......................@..@.data...H....@.......,..............@....pdata..L....P......................@..@.rsrc........`.......2..............@..@.reloc..(....p.......4..............@..B........................................................................................................................................................................................................................................

                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI68642\Crypto\Cipher\_chacha20.pyd

                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                Process:C:\Users\user\Desktop\dipwo1iToJ.exe
                                                                                                                                                                                                                File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                Size (bytes):13312
                                                                                                                                                                                                                Entropy (8bit):5.037456384995606
                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                SSDEEP:192:st/1nCuqaL0ktPMn1ENe3erKr5br0YbsiDw6a9lkOcqgRGd:p/kpMIodrXbsiDS95gRGd
                                                                                                                                                                                                                MD5:DC14677EA8A8C933CC41F9CCF2BEDDC1
                                                                                                                                                                                                                SHA1:A6FB87E8F3540743097A467ABE0723247FDAF469
                                                                                                                                                                                                                SHA-256:68F081E96AE08617CF111B21EDED35C1774A5EF1223DF9A161C9445A78F25C73
                                                                                                                                                                                                                SHA-512:3ABA4CFCBBE4B350AB3230D488BD75186427E3AAAF38D19E0E1C7330F16795AD77FB6E26FF39AF29EAF4F5E8C42118CB680F90AFBFCA218AEDA64DC444675BA2
                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                Antivirus:
                                                                                                                                                                                                                • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                Reputation:moderate, very likely benign file
                                                                                                                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......~.:...:...:...3.j.>...h...8...q...9...:.......h...1...h...2...h...9.......;.......;.......;.......;...Rich:...........................PE..d...Z..f.........." ................P.....................................................`......................................... 8.......8..d....`.......P..d............p..(....1...............................1..8............0...............................text............................... ..`.rdata.......0......................@..@.data...H....@.......*..............@....pdata..d....P.......,..............@..@.rsrc........`.......0..............@..@.reloc..(....p.......2..............@..B........................................................................................................................................................................................................................................

                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI68642\Crypto\Cipher\_pkcs1_decode.pyd

                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                Process:C:\Users\user\Desktop\dipwo1iToJ.exe
                                                                                                                                                                                                                File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                Size (bytes):14336
                                                                                                                                                                                                                Entropy (8bit):5.09191874780435
                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                SSDEEP:192:rMVsiXeqVb0lIb0Pj5Jdfpm68WZDInU282tacqgYLg:rM7ali0Pj5JxCaDuUlgYLg
                                                                                                                                                                                                                MD5:C09BB8A30F0F733C81C5C5A3DAD8D76D
                                                                                                                                                                                                                SHA1:46FD3BA87A32D12F4EE14601D1AD73B78EDC81D1
                                                                                                                                                                                                                SHA-256:8A1B751DB47CE7B1D3BD10BEBFFC7442BE4CFB398E96E3B1FF7FB83C88A8953D
                                                                                                                                                                                                                SHA-512:691AC74FAE930E9CEABE782567EFB99C50DD9B8AD607DD7F99A5C7DF2FA2BEB7EDFE2EBB7095A72DA0AE24E688FBABD340EAE8B646D5B8C394FEE8DDD5E60D31
                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                Antivirus:
                                                                                                                                                                                                                • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                Reputation:moderate, very likely benign file
                                                                                                                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......r^:.6?T.6?T.6?T.?G..2?T.dJU.4?T.}GU.5?T.6?U..?T.dJQ.<?T.dJP.>?T.dJW.5?T..J\.7?T..JT.7?T..J..7?T..JV.7?T.Rich6?T.........................PE..d...X..f.........." ................P.....................................................`.........................................`8.......8..d....`.......P..(............p..(....1...............................1..8............0...............................text............................... ..`.rdata..6....0....... ..............@..@.data...x....@......................@....pdata..(....P.......0..............@..@.rsrc........`.......4..............@..@.reloc..(....p.......6..............@..B........................................................................................................................................................................................................................................

                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI68642\Crypto\Cipher\_raw_aes.pyd

                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                Process:C:\Users\user\Desktop\dipwo1iToJ.exe
                                                                                                                                                                                                                File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                Size (bytes):36352
                                                                                                                                                                                                                Entropy (8bit):6.541423493519083
                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                SSDEEP:384:f/UlZA5PUEllvxL/7v/iKBt5ByU0xGitqzSEkxGG7+tpKHb/LZ7fr52EkifcMxme:klcR7JriEbwDaS4j990th9VDBV
                                                                                                                                                                                                                MD5:0AB25F99CDAACA6B11F2ECBE8223CAD5
                                                                                                                                                                                                                SHA1:7A881B3F84EF39D97A31283DE6D7B7AE85C8BAE6
                                                                                                                                                                                                                SHA-256:6CE8A60D1AB5ADC186E23E3DE864D7ADF6BDD37E3B0C591FA910763C5C26AF60
                                                                                                                                                                                                                SHA-512:11E89EEF34398DF3B144A0303E08B3A4CAF41A9A8CA618C18135F561731F285F8CF821D81179C2C45F6EEB0E496D9DD3ECF6FF202A3C453C80AFEF8582D06C17
                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                Antivirus:
                                                                                                                                                                                                                • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......r^J.6?$.6?$.6?$.?G..2?$.dJ%.4?$.}G%.5?$.6?%..?$.dJ!.<?$.dJ .>?$.dJ'.5?$..J,.7?$..J$.7?$..J..7?$..J&.7?$.Rich6?$.........................PE..d...V..f.........." .....H...H......P.....................................................`.........................................p...........d...............................0......................................8............`...............................text...xG.......H.................. ..`.rdata.."6...`...8...L..............@..@.data...H...........................@....pdata..............................@..@.rsrc...............................@..@.reloc..0...........................@..B........................................................................................................................................................................................................................................

                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI68642\Crypto\Cipher\_raw_aesni.pyd

                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                Process:C:\Users\user\Desktop\dipwo1iToJ.exe
                                                                                                                                                                                                                File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                Size (bytes):15360
                                                                                                                                                                                                                Entropy (8bit):5.367749645917753
                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                SSDEEP:192:YiJBj5fq/Rk0kPLhOZ3UucCWuSKPEkA2bD9JXx03cqg5YUMLgs:/k1kTMZEjCWNaA2DTx0g5YUMLg
                                                                                                                                                                                                                MD5:B6EA675C3A35CD6400A7ECF2FB9530D1
                                                                                                                                                                                                                SHA1:0E41751AA48108D7924B0A70A86031DDE799D7D6
                                                                                                                                                                                                                SHA-256:76EF4C1759B5553550AB652B84F8E158BA8F34F29FD090393815F06A1C1DC59D
                                                                                                                                                                                                                SHA-512:E31FD33E1ED6D4DA3957320250282CFD9EB3A64F12DE4BD2DFE3410F66725164D96B27CAA34C501D1A535A5A2442D5F070650FD3014B4B92624EE00F1C3F3197
                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                Antivirus:
                                                                                                                                                                                                                • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......~.:...:...:...3.z.>...h...8...q...9...:.......h...1...h...2...h...9.......;.......;.......;.......;...Rich:...........................PE..d...V..f.........." ......... ......P.....................................................`..........................................9......$:..d....`.......P...............p..(....1...............................1..8............0.. ............................text............................... ..`.rdata.......0......."..............@..@.data...8....@.......2..............@....pdata.......P.......4..............@..@.rsrc........`.......8..............@..@.reloc..(....p.......:..............@..B........................................................................................................................................................................................................................................

                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI68642\Crypto\Cipher\_raw_arc2.pyd

                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                Process:C:\Users\user\Desktop\dipwo1iToJ.exe
                                                                                                                                                                                                                File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                Size (bytes):16384
                                                                                                                                                                                                                Entropy (8bit):5.41148259289073
                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                SSDEEP:192:w3d9FkHaz0EJvrj+CYuz7ucc9dG7otDr22KcqgOiewZjW:YkHEJzj+X6769lDzagO/w
                                                                                                                                                                                                                MD5:F14E1AA2590D621BE8C10321B2C43132
                                                                                                                                                                                                                SHA1:FD84D11619DFFDF82C563E45B48F82099D9E3130
                                                                                                                                                                                                                SHA-256:FCE70B3DAFB39C6A4DB85D2D662CB9EB9C4861AA648AD7436E7F65663345D177
                                                                                                                                                                                                                SHA-512:A86B9DF163007277D26F2F732ECAB9DBCA8E860F8B5809784F46702D4CEA198824FDEF6AB98BA7DDC281E8791C10EABA002ABDA6F975323B36D5967E0443C1E4
                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                Antivirus:
                                                                                                                                                                                                                • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......~.g.:...:...:...3...>...h...8...q...9...:.......h...1...h...2...h...9.......;.......;.......;.......;...Rich:...................PE..d...W..f.........." ....."... ......P.....................................................`.........................................pI.......J..d....p.......`..................(....B...............................B..8............@...............................text...( .......".................. ..`.rdata..<....@.......&..............@..@.data...H....P.......6..............@....pdata.......`.......8..............@..@.rsrc........p.......<..............@..@.reloc..(............>..............@..B................................................................................................................................................................................................................................................

                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI68642\Crypto\Cipher\_raw_blowfish.pyd

                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                Process:C:\Users\user\Desktop\dipwo1iToJ.exe
                                                                                                                                                                                                                File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                Size (bytes):20992
                                                                                                                                                                                                                Entropy (8bit):6.041302713678401
                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                SSDEEP:384:kUX0JfbRz5MLZA0nmwzMDYpJgLa0Mp8NDBcxgprAM:6NbRzWXwDqgLa1uBfP
                                                                                                                                                                                                                MD5:B127CAE435AEB8A2A37D2A1BC1C27282
                                                                                                                                                                                                                SHA1:2A7BF8BF7F24B2381370BA6B41FB640EE42BDCCD
                                                                                                                                                                                                                SHA-256:538B1253B5929254ED92129FA0957DB26CDDF34A8372BA0BF19D20D01549ADA3
                                                                                                                                                                                                                SHA-512:4FE027E46D5132CA63973C67BD5394F2AC74DD4BBCFE93CB16136FAB4B6BF67BECB5A0D4CA359FF9426DA63CA81F793BBF1B79C8A9D8372C53DCB5796D17367E
                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                Antivirus:
                                                                                                                                                                                                                • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......~.g.:...:...:...3...>...h...8...q...9...:.......h...1...h...2...h...9.......;.......;.......;.......;...Rich:...................PE..d...W..f.........." .....$...0......P.....................................................`.........................................0Y.......Y..d............p..................0....Q...............................R..8............@...............................text....".......$.................. ..`.rdata.......@... ...(..............@..@.data...H....`.......H..............@....pdata.......p.......J..............@..@.rsrc................N..............@..@.reloc..0............P..............@..B................................................................................................................................................................................................................................................

                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI68642\Crypto\Cipher\_raw_cast.pyd

                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                Process:C:\Users\user\Desktop\dipwo1iToJ.exe
                                                                                                                                                                                                                File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                Size (bytes):24576
                                                                                                                                                                                                                Entropy (8bit):6.530656045206549
                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                SSDEEP:384:cEDwUBi9SPu71omZXmrfXA+UA10ol31tuXVYdAgYj:FsUBXmoEXmrXA+NNxWFYfo
                                                                                                                                                                                                                MD5:2E15AA6F97ED618A3236CFA920988142
                                                                                                                                                                                                                SHA1:A9D556D54519D3E91FA19A936ED291A33C0D1141
                                                                                                                                                                                                                SHA-256:516C5EA47A7B9A166F2226ECBA79075F1A35EFFF14D87E00006B34496173BB78
                                                                                                                                                                                                                SHA-512:A6C75C4A285753CC94E45500E8DD6B6C7574FB7F610FF65667F1BEC8D8B413FC10514B7D62F196C2B8D017C308C5E19E2AEF918021FA81D0CB3D8CED37D8549A
                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                Antivirus:
                                                                                                                                                                                                                • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......~.:...:...:...3.j.>...h...8...q...9...:.......h...1...h...2...h...9.......;.......;.......;.......;...Rich:...........................PE..d...W..f.........." .....$...>............................................................`..........................................h.......i..d...............................0....a...............................a..8............@...............................text....#.......$.................. ..`.rdata..:-...@.......(..............@..@.data...H....p.......V..............@....pdata...............X..............@..@.rsrc................\..............@..@.reloc..0............^..............@..B........................................................................................................................................................................................................................................

                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI68642\Crypto\Cipher\_raw_cbc.pyd

                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                Process:C:\Users\user\Desktop\dipwo1iToJ.exe
                                                                                                                                                                                                                File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                Size (bytes):12288
                                                                                                                                                                                                                Entropy (8bit):4.7080156150187396
                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                SSDEEP:192:lF/1n7Guqaj0ktfEJwX1fYwCODR3lncqg0Gd6l:RGXkJEm1feODxDg0Gd6
                                                                                                                                                                                                                MD5:40390F2113DC2A9D6CFAE7127F6BA329
                                                                                                                                                                                                                SHA1:9C886C33A20B3F76B37AA9B10A6954F3C8981772
                                                                                                                                                                                                                SHA-256:6BA9C910F755885E4D356C798A4DD32D2803EA4CFABB3D56165B3017D0491AE2
                                                                                                                                                                                                                SHA-512:617B963816838D649C212C5021D7D0C58839A85D4D33BBAF72C0EC6ECD98B609080E9E57AF06FA558FF302660619BE57CC974282826AB9F21AE0D80FBAA831A1
                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                Antivirus:
                                                                                                                                                                                                                • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......~.g.:...:...:...3...>...h...8...q...9...:.......h...1...h...2...h...9.......;.......;.......;.......;...Rich:...................PE..d...X..f.........." ................P.....................................................`..........................................8.......8..d....`.......P..X............p..(....1...............................1..8............0...............................text............................... ..`.rdata.......0......................@..@.data...H....@.......&..............@....pdata..X....P.......(..............@..@.rsrc........`.......,..............@..@.reloc..(....p......................@..B................................................................................................................................................................................................................................................

                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI68642\Crypto\Cipher\_raw_cfb.pyd

                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                Process:C:\Users\user\Desktop\dipwo1iToJ.exe
                                                                                                                                                                                                                File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                Size (bytes):12800
                                                                                                                                                                                                                Entropy (8bit):5.159963979391524
                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                SSDEEP:192:kblRgfeqfz0RP767fB4A84DgVD6eDcqgzbkLgmf:BwRj67p84Dg6eVgzbkLgmf
                                                                                                                                                                                                                MD5:899895C0ED6830C4C9A3328CC7DF95B6
                                                                                                                                                                                                                SHA1:C02F14EBDA8B631195068266BA20E03210ABEABC
                                                                                                                                                                                                                SHA-256:18D568C7BE3E04F4E6026D12B09B1FA3FAE50FF29AC3DEAF861F3C181653E691
                                                                                                                                                                                                                SHA-512:0B4C50E40AF92BC9589668E13DF417244274F46F5A66E1FC7D1D59BC281969BA319305BECEA119385F01CC4603439E4B37AFA2CF90645425210848A02839E3E7
                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                Antivirus:
                                                                                                                                                                                                                • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......r^..6?..6?..6?..?G..2?..dJ..4?..}G..5?..6?...?..dJ..<?..dJ..>?..dJ..5?...J..7?...J..7?...Jk.7?...J..7?..Rich6?..................PE..d...Y..f.........." ................P.....................................................`..........................................8......x9..d....`.......P..d............p..(....1...............................1..8............0...............................text............................... ..`.rdata.......0......................@..@.data...H....@.......(..............@....pdata..d....P.......*..............@..@.rsrc........`......................@..@.reloc..(....p.......0..............@..B................................................................................................................................................................................................................................................

                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI68642\Crypto\Cipher\_raw_ctr.pyd

                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                Process:C:\Users\user\Desktop\dipwo1iToJ.exe
                                                                                                                                                                                                                File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                Size (bytes):14848
                                                                                                                                                                                                                Entropy (8bit):5.270418334522813
                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                SSDEEP:192:vktJ1gifqQGRk0IP73AdXdmEEEEEm9uhiFEQayDZVMcqgnF6+6Lg:vkdU1ID3AdXd49urQPDggnUjLg
                                                                                                                                                                                                                MD5:C4C525B081F8A0927091178F5F2EE103
                                                                                                                                                                                                                SHA1:A1F17B5EA430ADE174D02ECC0B3CB79DBF619900
                                                                                                                                                                                                                SHA-256:4D86A90B2E20CDE099D6122C49A72BAE081F60EB2EEA0F76E740BE6C41DA6749
                                                                                                                                                                                                                SHA-512:7C06E3E6261427BC6E654B2B53518C7EAA5F860A47AE8E80DC3F8F0FED91E122CB2D4632188DC44123FB759749B5425F426CD1153A8F84485EF0491002B26555
                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                Antivirus:
                                                                                                                                                                                                                • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......r^z.6?..6?..6?..?G..2?..dJ..4?..}G..5?..6?...?..dJ..<?..dJ..>?..dJ..5?...J..7?...J..7?...J..7?...J..7?..Rich6?..........................PE..d...Y..f.........." ......... ......P.....................................................`.........................................`9.......:..d....`.......P...............p..(....1...............................1..8............0.. ............................text............................... ..`.rdata.......0....... ..............@..@.data........@.......0..............@....pdata.......P.......2..............@..@.rsrc........`.......6..............@..@.reloc..(....p.......8..............@..B........................................................................................................................................................................................................................................

                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI68642\Crypto\Cipher\_raw_des.pyd

                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                Process:C:\Users\user\Desktop\dipwo1iToJ.exe
                                                                                                                                                                                                                File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                Size (bytes):56832
                                                                                                                                                                                                                Entropy (8bit):4.231032526864278
                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                SSDEEP:384:0qcmHBeNL1dO/qHkpnYcZiGKdZHDLY84vnKAnK2rZA21agVF:fEiqHHx4vZDV
                                                                                                                                                                                                                MD5:F9E266F763175B8F6FD4154275F8E2F0
                                                                                                                                                                                                                SHA1:8BE457700D58356BC2FA7390940611709A0E5473
                                                                                                                                                                                                                SHA-256:14D2799BE604CBDC668FDE8834A896EEE69DAE0E0D43B37289FCCBA35CEF29EC
                                                                                                                                                                                                                SHA-512:EB3E37A3C3FF8A65DEF6FA20941C8672A8197A41977E35AE2DC6551B5587B84C2703758320559F2C93C0531AD5C9D0F6C36EC5037669DC5CE78EB3367D89877B
                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                Antivirus:
                                                                                                                                                                                                                • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........PK..1%..1%..1%..I...1%.D$..1%.I$..1%..1$..1%.D ..1%.D!..1%.D&..1%..D-..1%..D%..1%..D...1%..D'..1%.Rich.1%.........................PE..d...X..f.........." .....6...................................................0............`.................................................\...d...............l............ ..0... ...............................@...8............P...............................text....5.......6.................. ..`.rdata.......P.......:..............@..@.data...H...........................@....pdata..l...........................@..@.rsrc...............................@..@.reloc..0.... ......................@..B........................................................................................................................................................................................................................................

                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI68642\Crypto\Cipher\_raw_des3.pyd

                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                Process:C:\Users\user\Desktop\dipwo1iToJ.exe
                                                                                                                                                                                                                File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                Size (bytes):57344
                                                                                                                                                                                                                Entropy (8bit):4.252429732285762
                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                SSDEEP:384:J4cmHBeIzNweVy/CHkRnYcZiGKdZHDLq80vnKAnKBrZGsURygUX:GEO6CHnX0vZb7
                                                                                                                                                                                                                MD5:DECF524B2D53FCD7D4FA726F00B3E5FC
                                                                                                                                                                                                                SHA1:E87C6ED4004F2772B888C5B5758AA75FE99D2F6F
                                                                                                                                                                                                                SHA-256:58F7053EE70467D3384C73F299C0DFD63EEF9744D61D1980D9D2518974CA92D4
                                                                                                                                                                                                                SHA-512:EAFF4FD80843743E61CE635FBADF4E5D9CF2C3E97F3C48350BD9E755F4423AC6867F9FE8746BD5C54E1402B18E8A55AEEF7ACA098C7CF4186DC4C1235EB35DF2
                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                Antivirus:
                                                                                                                                                                                                                • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........PK..1%..1%..1%..I...1%.D$..1%.I$..1%..1$..1%.D ..1%.D!..1%.D&..1%..D-..1%..D%..1%..D...1%..D'..1%.Rich.1%.........................PE..d...X..f.........." .....8...................................................0............`.....................................................d............................ ..0... ...............................@...8............P...............................text...X7.......8.................. ..`.rdata......P.......<..............@..@.data...H...........................@....pdata..............................@..@.rsrc...............................@..@.reloc..0.... ......................@..B........................................................................................................................................................................................................................................

                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI68642\Crypto\Cipher\_raw_ecb.pyd

                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                Process:C:\Users\user\Desktop\dipwo1iToJ.exe
                                                                                                                                                                                                                File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                Size (bytes):10240
                                                                                                                                                                                                                Entropy (8bit):4.690163963718492
                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                SSDEEP:192:Yddz2KTnThIz0qfteRY4zp+D3PLui8p1cqgHCWt:k2E9RqfCXp+D3juRpLgiWt
                                                                                                                                                                                                                MD5:80BB1E0E06ACAF03A0B1D4EF30D14BE7
                                                                                                                                                                                                                SHA1:B20CAC0D2F3CD803D98A2E8A25FBF65884B0B619
                                                                                                                                                                                                                SHA-256:5D1C2C60C4E571B88F27D4AE7D22494BED57D5EC91939E5716AFA3EA7F6871F6
                                                                                                                                                                                                                SHA-512:2A13AB6715B818AD62267AB51E55CD54714AEBF21EC9EA61C2AEFD56017DC84A6B360D024F8682A2E105582B9C5FE892ECEBD2BEF8A492279B19FFD84BC83FA5
                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                Antivirus:
                                                                                                                                                                                                                • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........@................../....../...../......+.......*......-......&....................,....Rich...........................PE..d...X..f.........." ................P........................................p............`.........................................0'.......'..P....P.......@...............`..(....!...............................!..8............ ...............................text............................... ..`.rdata....... ......................@..@.data...H....0....... ..............@....pdata.......@......."..............@..@.rsrc........P.......$..............@..@.reloc..(....`.......&..............@..B........................................................................................................................................................................................................................................

                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI68642\Crypto\Cipher\_raw_eksblowfish.pyd

                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                Process:C:\Users\user\Desktop\dipwo1iToJ.exe
                                                                                                                                                                                                                File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                Size (bytes):22016
                                                                                                                                                                                                                Entropy (8bit):6.1215844022564285
                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                SSDEEP:384:nUX0JfbRwUtPMbNv37t6K5jwbDEpJgLa0Mp8xCkgJrAm:jNbRw8EbxwKBwbD+gLa1nh
                                                                                                                                                                                                                MD5:3727271FE04ECB6D5E49E936095E95BC
                                                                                                                                                                                                                SHA1:46182698689A849A8C210A8BF571D5F574C6F5B1
                                                                                                                                                                                                                SHA-256:3AF5B35DCD5A3B6C7E88CEE53F355AAFFF40F2C21DABD4DE27DBB57D1A29B63B
                                                                                                                                                                                                                SHA-512:5BED1F4DF678FE90B8E3F1B7C4F68198463E579209B079CB4A40DCAC01CE26AA2417DBE029B196F6F2C6AFAD560E2D1AF9F089ABE37EAD121CA10EE69D9659ED
                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                Antivirus:
                                                                                                                                                                                                                • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......~.g.:...:...:...3...>...h...8...q...9...:.......h...1...h...2...h...9.......;.......;.......;.......;...Rich:...................PE..d...W..f.........." .....(...0......P.....................................................`.........................................0Y.......Y..d............p..................0....Q...............................R..8............@...............................text...H'.......(.................. ..`.rdata.......@... ...,..............@..@.data...H....`.......L..............@....pdata.......p.......N..............@..@.rsrc................R..............@..@.reloc..0............T..............@..B................................................................................................................................................................................................................................................

                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI68642\Crypto\Cipher\_raw_ocb.pyd

                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                Process:C:\Users\user\Desktop\dipwo1iToJ.exe
                                                                                                                                                                                                                File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                Size (bytes):17920
                                                                                                                                                                                                                Entropy (8bit):5.293810509074883
                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                SSDEEP:384:4PHoDUntQjNB+/yw/pogeXOvXoTezczOo3p9iJgDQ3iNgnVbwhA:dUOhBcDRogeXOfoTezcio3pUJgDQ3i+
                                                                                                                                                                                                                MD5:78AEF441C9152A17DD4DC40C7CC9DF69
                                                                                                                                                                                                                SHA1:6BB6F8426AFA6522E647DFC82B1B64FAF3A9781F
                                                                                                                                                                                                                SHA-256:56E4E4B156295F1AAA22ECB5481841DE2A9EB84845A16E12A7C18C7C3B05B707
                                                                                                                                                                                                                SHA-512:27B27E77BE81B29D42359FE28531225383860BCD19A79044090C4EA58D9F98009A254BF63585979C60B3134D47B8233941ABB354A291F23C8641A4961FA33107
                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                Antivirus:
                                                                                                                                                                                                                • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......~.G.:.).:.).:.).3...>.).h.(.8.).q.(.9.).:.(...).h.,.1.).h.-.2.).h.*.9.)...!.;.)...).;.).....;.)...+.;.).Rich:.).........................PE..d...Y..f.........." .....(... ......P.....................................................`.........................................pI......lJ..d....p.......`..................(....A...............................A..8............@...............................text....'.......(.................. ..`.rdata.......@.......,..............@..@.data........P.......<..............@....pdata.......`.......>..............@..@.rsrc........p.......B..............@..@.reloc..(............D..............@..B........................................................................................................................................................................................................................................

                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI68642\Crypto\Cipher\_raw_ofb.pyd

                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                Process:C:\Users\user\Desktop\dipwo1iToJ.exe
                                                                                                                                                                                                                File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                Size (bytes):11776
                                                                                                                                                                                                                Entropy (8bit):4.862619033406922
                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                SSDEEP:96:0Ga+F/1NtJ9t4udqaj01rlALnNNJSS2sP+YEdMN+F9FdKaWDULk+VOmWbucX6gR7:PF/1n7Guqaj0ktfEON+bMDUlJcqg0Gd
                                                                                                                                                                                                                MD5:19E0ABF76B274C12FF624A16713F4999
                                                                                                                                                                                                                SHA1:A4B370F556B925F7126BF87F70263D1705C3A0DB
                                                                                                                                                                                                                SHA-256:D9FDA05AE16C5387AB46DC728C6EDCE6A3D0A9E1ABDD7ACB8B32FC2A17BE6F13
                                                                                                                                                                                                                SHA-512:D03033EA5CF37641FBD802EBEB5019CAEF33C9A78E01519FEA88F87E773DCA92C80B74BA80429B530694DAD0BFA3F043A7104234C7C961E18D48019D90277C8E
                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                Antivirus:
                                                                                                                                                                                                                • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......~.g.:...:...:...3...>...h...8...q...9...:.......h...1...h...2...h...9.......;.......;.......;.......;...Rich:...................PE..d...Y..f.........." ................P.....................................................`..........................................8.......8..d....`.......P..X............p..(....1...............................1..8............0...............................text............................... ..`.rdata.......0......................@..@.data...H....@.......$..............@....pdata..X....P.......&..............@..@.rsrc........`.......*..............@..@.reloc..(....p.......,..............@..B................................................................................................................................................................................................................................................

                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI68642\Crypto\Hash\_BLAKE2b.pyd

                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                Process:C:\Users\user\Desktop\dipwo1iToJ.exe
                                                                                                                                                                                                                File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                Size (bytes):14336
                                                                                                                                                                                                                Entropy (8bit):5.227045547076371
                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                SSDEEP:192:saF/1n7Guqaj0ktrE8o2o+V2rQnjt1wmg9jtveDn4clG6VcqgOvgdd:swGXkFE8Zo+AojO9jZeDf5rgOvgz
                                                                                                                                                                                                                MD5:309D6F6B0DD022EBD9214F445CAC7BB9
                                                                                                                                                                                                                SHA1:ABD22690B7AD77782CFC0D2393D0C038E16070B0
                                                                                                                                                                                                                SHA-256:4FBE188C20FB578D4B66349D50AA6FFE4AB86844FB6427C57738F36780D1E2E2
                                                                                                                                                                                                                SHA-512:D1951FE92F83E7774E8E877815BED6E6216D56EF18B7F1C369D678CB6E1814243659E9FA7ABC0D22FB5B34A9D50A51D5A89BA00AE1FDD32157FD0FF9902FB4B7
                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                Antivirus:
                                                                                                                                                                                                                • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......~.g.:...:...:...3...>...h...8...q...9...:.......h...1...h...2...h...9.......;.......;.......;.......;...Rich:...................PE..d...U..f.........." ................P.....................................................`..........................................8.......9..d....`.......P..@............p..(....2...............................2..8............0...............................text...x........................... ..`.rdata.......0....... ..............@..@.data...H....@......................@....pdata..@....P.......0..............@..@.rsrc........`.......4..............@..@.reloc..(....p.......6..............@..B................................................................................................................................................................................................................................................

                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI68642\Crypto\Hash\_BLAKE2s.pyd

                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                Process:C:\Users\user\Desktop\dipwo1iToJ.exe
                                                                                                                                                                                                                File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                Size (bytes):13824
                                                                                                                                                                                                                Entropy (8bit):5.176369829782773
                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                SSDEEP:192:rF/1n7Guqaj0ktrESsrUW+SBjsK5tcQmEreD2mf1AoxkVcqgOvgXQ:rGXkFE/UW575tA2eDp1Ao2rgOvgX
                                                                                                                                                                                                                MD5:D54FEB9A270B212B0CCB1937C660678A
                                                                                                                                                                                                                SHA1:224259E5B684C7AC8D79464E51503D302390C5C9
                                                                                                                                                                                                                SHA-256:032B83F1003A796465255D9B246050A196488BAC1260F628913E536314AFDED4
                                                                                                                                                                                                                SHA-512:29955A6569CA6D039B35BB40C56AEEB75FC765600525D0B469F72C97945970A428951BAB4AF9CD21B3161D5BBA932F853778E2674CA83B14F7ABA009FA53566F
                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                Antivirus:
                                                                                                                                                                                                                • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......~.g.:...:...:...3...>...h...8...q...9...:.......h...1...h...2...h...9.......;.......;.......;.......;...Rich:...................PE..d...U..f.........." ................P.....................................................`..........................................8.......9..d....`.......P..@............p..(....2...............................2..8............0...............................text...h........................... ..`.rdata.......0......................@..@.data...H....@.......,..............@....pdata..@....P......................@..@.rsrc........`.......2..............@..@.reloc..(....p.......4..............@..B................................................................................................................................................................................................................................................

                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI68642\Crypto\Hash\_MD2.pyd

                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                Process:C:\Users\user\Desktop\dipwo1iToJ.exe
                                                                                                                                                                                                                File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                Size (bytes):14336
                                                                                                                                                                                                                Entropy (8bit):5.047563322651927
                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                SSDEEP:384:6alCvH32p3/2pnEhKnLg9yH8puzoFaPERIQAvHD9CIg5kP:5CvHmp3OpnEhmLg9yH8puzoFaPERIQgI
                                                                                                                                                                                                                MD5:52DCD4151A9177CF685BE4DF48EA9606
                                                                                                                                                                                                                SHA1:F444A4A5CBAE9422B408420115F0D3FF973C9705
                                                                                                                                                                                                                SHA-256:D54375DC0652358A6E4E744F1A0EAEEAD87ACCD391A20D6FF324FE14E988A122
                                                                                                                                                                                                                SHA-512:64C54B89F2637759309ECC6655831C3A6755924ED70CBC51614061542EB9BA9A8AECF6951EB3AB92447247DC4D7D846C88F4957DBBE4484A9AB934343EE27178
                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                Antivirus:
                                                                                                                                                                                                                • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......~.G.:.).:.).:.).3...>.).h.(.8.).q.(.9.).:.(...).h.,.1.).h.-.2.).h.*.9.)...!.;.)...).;.).....;.)...+.;.).Rich:.).........................PE..d...Q..f.........." ......... ......P.....................................................`.........................................@9.......9..d....`.......P..(............p..(....2...............................2..8............0...............................text...X........................... ..`.rdata..@....0......................@..@.data...x....@......................@....pdata..(....P.......0..............@..@.rsrc........`.......4..............@..@.reloc..(....p.......6..............@..B........................................................................................................................................................................................................................................

                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI68642\Crypto\Hash\_MD4.pyd

                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                Process:C:\Users\user\Desktop\dipwo1iToJ.exe
                                                                                                                                                                                                                File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                Size (bytes):13824
                                                                                                                                                                                                                Entropy (8bit):5.09893680790018
                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                SSDEEP:192:xsiXeqVb0lwbH4P01sAD7I/9hAkwDWzBEbcqgqLg:valqH4M1sAD7KvpwDFtgqLg
                                                                                                                                                                                                                MD5:F929B1A3997427191E07CF52AC883054
                                                                                                                                                                                                                SHA1:C5EA5B68586C2FB09E5FDD20D4DD616D06F5CBA6
                                                                                                                                                                                                                SHA-256:5386908173074FABD95BF269A9DF0A4E1B21C0576923186F449ABF4A820F6A8E
                                                                                                                                                                                                                SHA-512:2C79DBCE2C21214D979AB86DD989D41A3AFA7FCB7F3B79BA9974E2EE8F832DD7CA20C1C87C0C380DB037D776FE6D0851D60AD55A08AFDE0003B7E59214DD2F3B
                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                Antivirus:
                                                                                                                                                                                                                • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......~.G.:.).:.).:.).3...>.).h.(.8.).q.(.9.).:.(...).h.,.1.).h.-.2.).h.*.9.)...!.;.)...).;.).....;.)...+.;.).Rich:.).........................PE..d...R..f.........." ................P.....................................................`.........................................08.......8..d....`.......P..(............p..(....1...............................2..8............0...............................text............................... ..`.rdata..0....0......................@..@.data........@.......,..............@....pdata..(....P......................@..@.rsrc........`.......2..............@..@.reloc..(....p.......4..............@..B........................................................................................................................................................................................................................................

                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI68642\Crypto\Hash\_MD5.pyd

                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                Process:C:\Users\user\Desktop\dipwo1iToJ.exe
                                                                                                                                                                                                                File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                Size (bytes):15360
                                                                                                                                                                                                                Entropy (8bit):5.451865349855574
                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                SSDEEP:384:KfwogDHER1wuiDSyoGTgDZOviNgEPrLg:ugDHELwuiDScTgDwi+EP
                                                                                                                                                                                                                MD5:1FA5E257A85D16E916E9C22984412871
                                                                                                                                                                                                                SHA1:1AC8EE98AD0A715A1B40AD25D2E8007CDC19871F
                                                                                                                                                                                                                SHA-256:D87A9B7CAD4C451D916B399B19298DC46AAACC085833C0793092641C00334B8E
                                                                                                                                                                                                                SHA-512:E4205355B647C6E28B7E4722328F51DC2EB3A109E9D9B90F7C53D7A80A5A4B10E40ABDDAB1BA151E73EF3EB56941F843535663F42DCE264830E6E17BB659EADF
                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                Antivirus:
                                                                                                                                                                                                                • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......~.G.:.).:.).:.).3...>.).h.(.8.).q.(.9.).:.(...).h.,.1.).h.-.2.).h.*.9.)...!.;.)...).;.).....;.)...+.;.).Rich:.).........................PE..d...R..f.........." ..... ..........P.....................................................`..........................................8......`9..d....`.......P..X............p..(....1...............................1..8............0...............................text............ .................. ..`.rdata.......0.......$..............@..@.data........@.......2..............@....pdata..X....P.......4..............@..@.rsrc........`.......8..............@..@.reloc..(....p.......:..............@..B........................................................................................................................................................................................................................................

                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI68642\Crypto\Hash\_RIPEMD160.pyd

                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                Process:C:\Users\user\Desktop\dipwo1iToJ.exe
                                                                                                                                                                                                                File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                Size (bytes):13824
                                                                                                                                                                                                                Entropy (8bit):5.104245335186531
                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                SSDEEP:192:3F/1n7Guqaj0kt7/Ev9kt0Qwac6QzD8iD0QocqgI4G0S:nGXkd/EvGt9wacNDvAgI4v
                                                                                                                                                                                                                MD5:FAD578A026F280C1AE6F787B1FA30129
                                                                                                                                                                                                                SHA1:9A3E93818A104314E172A304C3D117B6A66BEB55
                                                                                                                                                                                                                SHA-256:74A1FF0801F4704158684267CD8E123F83FB6334FE522C1890AC4A0926F80AB1
                                                                                                                                                                                                                SHA-512:ACF8F5B382F3B4C07386505BBDCAF625D13BCC10AA93ED641833E3548261B0AD1063E2F59BE2FCD2AFAF3D315CB3FC5EB629CEFC168B33CFD65A3A6F1120F7FF
                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                Antivirus:
                                                                                                                                                                                                                • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......~.g.:...:...:...3...>...h...8...q...9...:.......h...1...h...2...h...9.......;.......;.......;.......;...Rich:...................PE..d...U..f.........." ......... ......P.....................................................`..........................................9.......:..d....`.......P...............p..(...@3..............................`3..8............0...............................text...H........................... ..`.rdata.......0......................@..@.data...H....@.......,..............@....pdata.......P......................@..@.rsrc........`.......2..............@..@.reloc..(....p.......4..............@..B................................................................................................................................................................................................................................................

                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI68642\Crypto\Hash\_SHA1.pyd

                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                Process:C:\Users\user\Desktop\dipwo1iToJ.exe
                                                                                                                                                                                                                File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                Size (bytes):17920
                                                                                                                                                                                                                Entropy (8bit):5.671305741258107
                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                SSDEEP:384:APHoDUntQj0sKhDOJ+0QPSfu6rofDjiZzgE+kbwb:VUOYsKNO466DjoUE+
                                                                                                                                                                                                                MD5:556E6D0E5F8E4DA74C2780481105D543
                                                                                                                                                                                                                SHA1:7A49CDEF738E9FE9CD6CD62B0F74EAD1A1774A33
                                                                                                                                                                                                                SHA-256:247B0885CF83375211861F37B6DD1376AED5131D621EE0137A60FE7910E40F8B
                                                                                                                                                                                                                SHA-512:28FA0CE6BDBCC5E95B80AADC284C12658EF0C2BE63421AF5627776A55050EE0EA0345E30A15B744FC2B2F5B1B1BBB61E4881F27F6E3E863EBAAEED1073F4CDA1
                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                Antivirus:
                                                                                                                                                                                                                • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......~.G.:.).:.).:.).3...>.).h.(.8.).q.(.9.).:.(...).h.,.1.).h.-.2.).h.*.9.)...!.;.)...).;.).....;.)...+.;.).Rich:.).........................PE..d...R..f.........." .....*..........P.....................................................`..........................................H......hI..d....p.......`..X...............(....A...............................A..8............@...............................text....).......*.................. ..`.rdata.......@......................@..@.data........P.......<..............@....pdata..X....`.......>..............@..@.rsrc........p.......B..............@..@.reloc..(............D..............@..B........................................................................................................................................................................................................................................

                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI68642\Crypto\Hash\_SHA224.pyd

                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                Process:C:\Users\user\Desktop\dipwo1iToJ.exe
                                                                                                                                                                                                                File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                Size (bytes):21504
                                                                                                                                                                                                                Entropy (8bit):5.878701941774916
                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                SSDEEP:384:EJWo4IRCGHX1KXqHGcvYHp5RYcARQOj4MSTjqgPmJD1OhgkxEv:EcIRnHX1P/YtswvaD1Rk
                                                                                                                                                                                                                MD5:2F2655A7BBFE08D43013EDDA27E77904
                                                                                                                                                                                                                SHA1:33D51B6C423E094BE3E34E5621E175329A0C0914
                                                                                                                                                                                                                SHA-256:C734ABBD95EC120CB315C43021C0E1EB1BF2295AF9F1C24587334C3FCE4A5BE1
                                                                                                                                                                                                                SHA-512:8AF99ACC969B0E560022F75A0CDCAA85D0BDEADADEACD59DD0C4500F94A5843EA0D4107789C1A613181B1F4E5252134A485EF6B1D9D83CDB5676C5FEE4D49B90
                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                Antivirus:
                                                                                                                                                                                                                • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......~.G.:.).:.).:.).3...>.).h.(.8.).q.(.9.).:.(...).h.,.1.).h.-.2.).h.*.9.)...!.;.)...).;.).....;.)...+.;.).Rich:.).........................PE..d...S..f.........." .....6... ......P.....................................................`.........................................@Z......([..d............p..................(....R...............................R..8............P...............................text....5.......6.................. ..`.rdata..x....P.......:..............@..@.data........`.......J..............@....pdata.......p.......L..............@..@.rsrc................P..............@..@.reloc..(............R..............@..B........................................................................................................................................................................................................................................

                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI68642\Crypto\Hash\_SHA256.pyd

                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                Process:C:\Users\user\Desktop\dipwo1iToJ.exe
                                                                                                                                                                                                                File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                Size (bytes):21504
                                                                                                                                                                                                                Entropy (8bit):5.881781476285865
                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                SSDEEP:384:EJWo4IRCGHXfKXqHGcvYHp5RYcARQOj4MSTjqgPmJD12gkxEv:EcIRnHXfP/YtswvaD1zk
                                                                                                                                                                                                                MD5:CDE035B8AB3D046B1CE37EEE7EE91FA0
                                                                                                                                                                                                                SHA1:4298B62ED67C8D4F731D1B33E68D7DC9A58487FF
                                                                                                                                                                                                                SHA-256:16BEA322D994A553B293A724B57293D57DA62BC7EAF41F287956B306C13FD972
                                                                                                                                                                                                                SHA-512:C44FDEE5A210459CE4557351E56B2D357FD4937F8EC8EACEAB842FEE29761F66C2262FCBAAC837F39C859C67FA0E23D13E0F60B3AE59BE29EB9D8ABAB0A572BB
                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                Antivirus:
                                                                                                                                                                                                                • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......~.G.:.).:.).:.).3...>.).h.(.8.).q.(.9.).:.(...).h.,.1.).h.-.2.).h.*.9.)...!.;.)...).;.).....;.)...+.;.).Rich:.).........................PE..d...S..f.........." .....6... ......P.....................................................`.........................................@Z......([..d............p..................(....R...............................R..8............P...............................text....5.......6.................. ..`.rdata..x....P.......:..............@..@.data........`.......J..............@....pdata.......p.......L..............@..@.rsrc................P..............@..@.reloc..(............R..............@..B........................................................................................................................................................................................................................................

                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI68642\Crypto\Hash\_SHA384.pyd

                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                Process:C:\Users\user\Desktop\dipwo1iToJ.exe
                                                                                                                                                                                                                File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                Size (bytes):26624
                                                                                                                                                                                                                Entropy (8bit):5.837887867708438
                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                SSDEEP:768:e839Cc4itui0gel9soFdkO66MlPGXmXcyYDTzks:Ns4u/FZ6nPxMLDvk
                                                                                                                                                                                                                MD5:999D431197D7E06A30E0810F1F910B9A
                                                                                                                                                                                                                SHA1:9BFF781221BCFFD8E55485A08627EC2A37363C96
                                                                                                                                                                                                                SHA-256:AB242B9C9FB662C6F7CB57F7648F33983D6FA3BB0683C5D4329EC2CC51E8C875
                                                                                                                                                                                                                SHA-512:A5DD92DD471ADB44EEFE5919EF9CA3978724E21174DF5B3A9C1F0AB462F928E5A46A460D02417DB7522F5DE3BFEED5EEE6B1EAFAF3E621722E85E72675F7096F
                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                Antivirus:
                                                                                                                                                                                                                • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......~.G.:.).:.).:.).3...>.).h.(.8.).q.(.9.).:.(...).h.,.1.).h.-.2.).h.*.9.)...!.;.)...).;.).....;.)...+.;.).Rich:.).........................PE..d...T..f.........." .....H..."......P.....................................................`..........................................k.......l..d...............................(...pd...............................d..8............`...............................text....F.......H.................. ..`.rdata.......`.......L..............@..@.data................^..............@....pdata...............`..............@..@.rsrc................d..............@..@.reloc..(............f..............@..B........................................................................................................................................................................................................................................

                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI68642\Crypto\Hash\_SHA512.pyd

                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                Process:C:\Users\user\Desktop\dipwo1iToJ.exe
                                                                                                                                                                                                                File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                Size (bytes):26624
                                                                                                                                                                                                                Entropy (8bit):5.895310340516013
                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                SSDEEP:768:lcX9Nf4ttui0gel9soFdkO66MlPGXmXc/vDTOvk:a38u/FZ6nPxM3DAk
                                                                                                                                                                                                                MD5:0931ABBF3AED459B1A2138B551B1D3BB
                                                                                                                                                                                                                SHA1:9EC0296DDAF574A89766A2EC035FC30073863AB0
                                                                                                                                                                                                                SHA-256:1729A0DC6B80CB7A3C07372B98B10D3C6C613EA645240878E1FDE6A992FA06F1
                                                                                                                                                                                                                SHA-512:9F970BB4D10B94F525DDDDE307C7DA5E672BBFB3A3866A34B89B56ADA99476724FD690A4396857182749294F67F36DB471A048789FB715D2A7DAF46917FC1947
                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                Antivirus:
                                                                                                                                                                                                                • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......~.G.:.).:.).:.).3...>.).h.(.8.).q.(.9.).:.(...).h.,.1.).h.-.2.).h.*.9.)...!.;.)...).;.).....;.)...+.;.).Rich:.).........................PE..d...T..f.........." .....H..."......P.....................................................`.........................................@l......(m..d...............................(....d...............................e..8............`...............................text...hG.......H.................. ..`.rdata..x....`.......L..............@..@.data................^..............@....pdata...............`..............@..@.rsrc................d..............@..@.reloc..(............f..............@..B........................................................................................................................................................................................................................................

                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI68642\Crypto\Hash\_ghash_clmul.pyd

                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                Process:C:\Users\user\Desktop\dipwo1iToJ.exe
                                                                                                                                                                                                                File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                Size (bytes):12800
                                                                                                                                                                                                                Entropy (8bit):4.967737129255606
                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                SSDEEP:192:dMpWt/1nCuqaL0kt7TsEx2fiTgDZqGF0T7cqgkLgJ:k/k1Ts64DDJyBgkLg
                                                                                                                                                                                                                MD5:5F057A380BACBA4EF59C0611549C0E02
                                                                                                                                                                                                                SHA1:4B758D18372D71F0AA38075F073722A55B897F71
                                                                                                                                                                                                                SHA-256:BCB14DAC6C87C24269D3E60C46B49EFFB1360F714C353318F5BBAA48C79EC290
                                                                                                                                                                                                                SHA-512:E1C99E224745B86EE55822C1DBCB4555A11EC31B72D87B46514917EB61E0258A1C6D38C4F592969C17EB4F0F74DA04BCECA31CF1622720E95F0F20E9631792E8
                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                Antivirus:
                                                                                                                                                                                                                • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......r^J.6?$.6?$.6?$.?G..2?$.dJ%.4?$.}G%.5?$.6?%..?$.dJ!.<?$.dJ .>?$.dJ'.5?$..J,.7?$..J$.7?$..J..7?$..J&.7?$.Rich6?$.........................PE..d...V..f.........." ................P.....................................................`.........................................P8.......8..d....`.......P...............p..(....1...............................1..8............0...............................text............................... ..`.rdata..2....0......................@..@.data...H....@.......(..............@....pdata.......P.......*..............@..@.rsrc........`......................@..@.reloc..(....p.......0..............@..B........................................................................................................................................................................................................................................

                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI68642\Crypto\Hash\_ghash_portable.pyd

                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                Process:C:\Users\user\Desktop\dipwo1iToJ.exe
                                                                                                                                                                                                                File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                Size (bytes):13312
                                                                                                                                                                                                                Entropy (8bit):5.007867576025166
                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                SSDEEP:192:bMt/1nCuqaL0ktPH0T7fwtF4zDn2rGacqgRGd:1/kpU3Yv4zDXqgRGd
                                                                                                                                                                                                                MD5:49BCA1B7DF076D1A550EE1B7ED3BD997
                                                                                                                                                                                                                SHA1:47609C7102F5B1BCA16C6BAD4AE22CE0B8AEE9E9
                                                                                                                                                                                                                SHA-256:49E15461DCB76690139E71E9359F7FCF92269DCCA78E3BFE9ACB90C6271080B2
                                                                                                                                                                                                                SHA-512:8574D7FA133B72A4A8D1D7D9FDB61053BC88C2D238B7AC7D519BE19972B658C44EA1DE433885E3206927C75DD5D1028F74999E048AB73189585B87630F865466
                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                Antivirus:
                                                                                                                                                                                                                • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......~.:...:...:...3.j.>...h...8...q...9...:.......h...1...h...2...h...9.......;.......;.......;.......;...Rich:...........................PE..d...V..f.........." ................P.....................................................`..........................................8.......8..d....`.......P..X............p..(....1...............................1..8............0...............................text............................... ..`.rdata.......0......................@..@.data...H....@.......*..............@....pdata..X....P.......,..............@..@.rsrc........`.......0..............@..@.reloc..(....p.......2..............@..B........................................................................................................................................................................................................................................

                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI68642\Crypto\Hash\_keccak.pyd

                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                Process:C:\Users\user\Desktop\dipwo1iToJ.exe
                                                                                                                                                                                                                File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                Size (bytes):15872
                                                                                                                                                                                                                Entropy (8bit):5.226023387740053
                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                SSDEEP:384:rfRKTN+HLjRskTdf4WazSTkwjEvuY2bylHDiYIgovg:mcHfRl5pauoSjy5DiE
                                                                                                                                                                                                                MD5:CB5CFDD4241060E99118DEEC6C931CCC
                                                                                                                                                                                                                SHA1:1E7FED96CF26C9F4730A4621CA9D18CECE3E0BCE
                                                                                                                                                                                                                SHA-256:A8F809B6A417AF99B75EEEEA3ECD16BDA153CBDA4FFAB6E35CE1E8C884D899C4
                                                                                                                                                                                                                SHA-512:8A89E3563C14B81353D251F9F019D8CBF07CB98F78452B8522413C7478A0D77B9ABF2134E4438145D6363CDA39721D2BAE8AD13D1CDACCBB5026619D95F931CF
                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                Antivirus:
                                                                                                                                                                                                                • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......~.G.:.).:.).:.).3...>.).h.(.8.).q.(.9.).:.(...).h.,.1.).h.-.2.).h.*.9.)...!.;.)...).;.).....;.)...+.;.).Rich:.).........................PE..d...U..f.........." ..... ... ......P.....................................................`..........................................9.......9..d....`.......P..X............p..(...p2...............................2..8............0...............................text............ .................. ..`.rdata..@....0.......$..............@..@.data........@.......4..............@....pdata..X....P.......6..............@..@.rsrc........`.......:..............@..@.reloc..(....p.......<..............@..B........................................................................................................................................................................................................................................

                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI68642\Crypto\Hash\_poly1305.pyd

                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                Process:C:\Users\user\Desktop\dipwo1iToJ.exe
                                                                                                                                                                                                                File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                Size (bytes):14848
                                                                                                                                                                                                                Entropy (8bit):5.262055670423592
                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                SSDEEP:192:C/ZN2eq/b04PAHH41F6fnVS0sVn+5CA5Z1cD66WGcqgFjLg:vI4IHHaQfSVnCZyDImgFjLg
                                                                                                                                                                                                                MD5:18D2D96980802189B23893820714DA90
                                                                                                                                                                                                                SHA1:5DEE494D25EB79038CBC2803163E2EF69E68274C
                                                                                                                                                                                                                SHA-256:C2FD98C677436260ACB9147766258CB99780A007114AED37C87893DF1CF1A717
                                                                                                                                                                                                                SHA-512:0317B65D8F292332C5457A6B15A77548BE5B2705F34BB8F4415046E3E778580ABD17B233E6CC2755C991247E0E65B27B5634465646715657B246483817CACEB7
                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                Antivirus:
                                                                                                                                                                                                                • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......~.G.:.).:.).:.).3...>.).h.(.8.).q.(.9.).:.(...).h.,.1.).h.-.2.).h.*.9.)...!.;.)...).;.).....;.)...+.;.).Rich:.).........................PE..d...V..f.........." ................P.....................................................`..........................................8.......9..d....`.......P..|............p..(....1...............................1..8............0...............................text............................... ..`.rdata.......0......."..............@..@.data........@.......0..............@....pdata..|....P.......2..............@..@.rsrc........`.......6..............@..@.reloc..(....p.......8..............@..B........................................................................................................................................................................................................................................

                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI68642\Crypto\Math\_modexp.pyd

                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                Process:C:\Users\user\Desktop\dipwo1iToJ.exe
                                                                                                                                                                                                                File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                Size (bytes):36352
                                                                                                                                                                                                                Entropy (8bit):5.913843738203007
                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                SSDEEP:384:dspbXtHQY4ubrttQza9CHnZXQsnecAlOF0qZLAXxQI3Sya6XPpMg3Yx8MnDcCPSq:7Y44UagH6cAFCLUSYpMg3YDzPo5kG9G
                                                                                                                                                                                                                MD5:EF472BA63FD22922CA704B1E7B95A29E
                                                                                                                                                                                                                SHA1:700B68E7EF95514D5E94D3C6B10884E1E187ACD8
                                                                                                                                                                                                                SHA-256:66EEF4E6E0CEEEF2C23A758BFBEDAE7C16282FC93D0A56ACAFC40E871AC3F01C
                                                                                                                                                                                                                SHA-512:DC2060531C4153C43ABF30843BCB5F8FA082345CA1BB57F9AC8695EDDB28FF9FDA8132B6B6C67260F779D95FCADCAE2811091BCA300AB1E041FAE6CC7B50ABD8
                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                Antivirus:
                                                                                                                                                                                                                • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......:..P~...~...~...w.3.x...,...|...5...}...~...U...,...u...,...v...,...}.......|............._.............Rich~...................PE..d...^..f.........." .....`...0......`.....................................................`..........................................~..|...L...d...............<...............(....q...............................q..8............p..(............................text...X^.......`.................. ..`.rdata.......p.......d..............@..@.data................x..............@....pdata..<...........................@..@.rsrc...............................@..@.reloc..(...........................@..B................................................................................................................................................................................................................................................

                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI68642\Crypto\Protocol\_scrypt.pyd

                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                Process:C:\Users\user\Desktop\dipwo1iToJ.exe
                                                                                                                                                                                                                File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                Size (bytes):12288
                                                                                                                                                                                                                Entropy (8bit):4.735350805948923
                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                SSDEEP:192:rhsC3eqv6b0q3OQ3rHu5bc64OhD2I/p3cqgONLg:r/Hq3jHuY64OhDJJgONLg
                                                                                                                                                                                                                MD5:3B1CE70B0193B02C437678F13A335932
                                                                                                                                                                                                                SHA1:063BFD5A32441ED883409AAD17285CE405977D1F
                                                                                                                                                                                                                SHA-256:EB2950B6A2185E87C5318B55132DFE5774A5A579259AB50A7935A7FB143EA7B1
                                                                                                                                                                                                                SHA-512:0E02187F17DFCFD323F2F0E62FBFE35F326DCF9F119FC8B15066AFAEEE4EB7078184BC85D571B555E9E67A2DD909EC12D8A67E3D075E9B1283813EF274E05C0D
                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                Antivirus:
                                                                                                                                                                                                                • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......r^:.6?T.6?T.6?T.?G..2?T.dJU.4?T.}GU.5?T.6?U..?T.dJQ.<?T.dJP.>?T.dJW.5?T..J\.7?T..JT.7?T..J..7?T..JV.7?T.Rich6?T.........................PE..d...Z..f.........." ................P.....................................................`..........................................8..d....8..d....`.......P..4............p..(....1...............................1..8............0...............................text...H........................... ..`.rdata..0....0......................@..@.data........@.......&..............@....pdata..4....P.......(..............@..@.rsrc........`.......,..............@..@.reloc..(....p......................@..B........................................................................................................................................................................................................................................

                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI68642\Crypto\PublicKey\_curve25519.pyd

                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                Process:C:\Users\user\Desktop\dipwo1iToJ.exe
                                                                                                                                                                                                                File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                Size (bytes):22528
                                                                                                                                                                                                                Entropy (8bit):5.705606408072877
                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                SSDEEP:384:19BcRxBmau38CYIl9bhgIW0mvufueNr359/tjGGDEFSegqrA:NcRy38J+9dmvufFtaGDV
                                                                                                                                                                                                                MD5:FF33C306434DEC51D39C7BF1663E25DA
                                                                                                                                                                                                                SHA1:665FCF47501F1481534597C1EAC2A52886EF0526
                                                                                                                                                                                                                SHA-256:D0E3B6A2D0E073B2D9F0FCDB051727007943A17A4CA966D75EBA37BECDBA6152
                                                                                                                                                                                                                SHA-512:66A909DC9C3B7BD4050AA507CD89B0B3A661C85D33C881522EC9568744953B698722C1CBFF093F9CBCD6119BD527FECAB05A67F2E32EC479BE47AFFA4377362C
                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                Antivirus:
                                                                                                                                                                                                                • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......~.g.:...:...:...3...>...h...8...q...9...:.......h...1...h...2...h...9.......;.......;.......;.......;...Rich:...................PE..d...\..f.........." .....6...$......P.....................................................`.........................................`Y......`Z..d............p..................(....R..............................0R..8............P...............................text...(5.......6.................. ..`.rdata.......P.......:..............@..@.data........`.......J..............@....pdata.......p.......P..............@..@.rsrc................T..............@..@.reloc..(............V..............@..B................................................................................................................................................................................................................................................

                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI68642\Crypto\PublicKey\_curve448.pyd

                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                Process:C:\Users\user\Desktop\dipwo1iToJ.exe
                                                                                                                                                                                                                File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                Size (bytes):70656
                                                                                                                                                                                                                Entropy (8bit):6.0189903352673655
                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                SSDEEP:1536:Jfju4GgRMgWWnEDZiECgd/iwOXUQdbhov0Clb8Cx4hpK8ithLFIDullRPwDHxXOa:pXRMgWiEDZiECgd/iwOXUQdbhov0ClbU
                                                                                                                                                                                                                MD5:F267BF4256F4105DAD0D3E59023011ED
                                                                                                                                                                                                                SHA1:9BC6CA0F375CE49D5787C909D290C07302F58DA6
                                                                                                                                                                                                                SHA-256:1DDE8BE64164FF96B2BAB88291042EB39197D118422BEE56EB2846E7A2D2F010
                                                                                                                                                                                                                SHA-512:A335AF4DBF1658556ED5DC13EE741419446F7DAEC6BD2688B626A803FA5DD76463D6367C224E0B79B17193735E2C74BA417C26822DAEEF05AC3BAB1588E2DE83
                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                Antivirus:
                                                                                                                                                                                                                • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......:..P~...~...~...w.3.x...,...|...5...}...~...U...,...u...,...v...,...}.......|............._.............Rich~...................PE..d...\..f.........." .........8......`........................................P............`.............................................0.......d....0....... ..$............@..(.......................................8............................................text...8........................... ..`.rdata..............................@..@.data...............................@....pdata..$.... ......................@..@.rsrc........0......................@..@.reloc..(....@......................@..B................................................................................................................................................................................................................................................

                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI68642\Crypto\PublicKey\_ec_ws.pyd

                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                Process:C:\Users\user\Desktop\dipwo1iToJ.exe
                                                                                                                                                                                                                File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                Size (bytes):770560
                                                                                                                                                                                                                Entropy (8bit):7.613224993327352
                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                SSDEEP:12288:XtIrHoxJ8gf1266y8IXhJvCKAmqVLzcrZgYIMGv1iLD9yQvG6h:XtIrHoxJFf1p34hcrn5Go9yQO6
                                                                                                                                                                                                                MD5:1EFD7F7CB1C277416011DE6F09C355AF
                                                                                                                                                                                                                SHA1:C0F97652AC2703C325AB9F20826A6F84C63532F2
                                                                                                                                                                                                                SHA-256:AB45FA80A68DB1635D41DC1A4AAD980E6716DAC8C1778CB5F30CDB013B7DF6E6
                                                                                                                                                                                                                SHA-512:2EC4B88A1957733043BBD63CEAA6F5643D446DB607B3267FAD1EC611E6B0AF697056598AAC2AE5D44AB2B9396811D183C32BCE5A0FF34E583193A417D1C5226B
                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                Antivirus:
                                                                                                                                                                                                                • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........s.. .. .. ... .. ..!.. ..!.. .. .. ..!.. ..!.. ..!.. \..!.. \..!.. \.r .. \..!.. Rich.. ................PE..d...[..f.........." ................`.....................................................`.............................................h.......d...............................0......................................8...............(............................text............................... ..`.rdata..............................@..@.data...............................@....pdata..............................@..@.rsrc...............................@..@.reloc..0...........................@..B................................................................................................................................................................................................................................................

                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI68642\Crypto\PublicKey\_ed25519.pyd

                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                Process:C:\Users\user\Desktop\dipwo1iToJ.exe
                                                                                                                                                                                                                File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                Size (bytes):26112
                                                                                                                                                                                                                Entropy (8bit):5.8551858881598795
                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                SSDEEP:384:BczadRwoF2MZ81n0XTyMCYIl9bhgIW0mv8aeadRcwRwftjGLD2pRQNgQQ77k:2udRf2MuMJ+9dmv8aea34taLDcfQ
                                                                                                                                                                                                                MD5:C5FB377F736ED731B5578F57BB765F7A
                                                                                                                                                                                                                SHA1:5BA51E11F4DE1CAEDEBA0F7D4D10EC62EC109E01
                                                                                                                                                                                                                SHA-256:32073DF3D5C85ABCE7D370D6E341EF163A8350F6A9EDC775C39A23856CCFDD53
                                                                                                                                                                                                                SHA-512:D361BCDAF2C700D5A4AC956D96E00961432C05A1B692FC870DB53A90F233A6D24AA0C3BE99E40BD8E5B7C6C1B2BCDCDCFC545292EF321486FFC71C5EA7203E6A
                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                Antivirus:
                                                                                                                                                                                                                • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......~.G.:.).:.).:.).3...>.).h.(.8.).q.(.9.).:.(...).h.,.1.).h.-.2.).h.*.9.)...!.;.)...).;.).....;.)...+.;.).Rich:.).........................PE..d...]..f.........." .....B...&......P.....................................................`..........................................i..0....k..d...............................(... b..............................@b..8............`...............................text....A.......B.................. ..`.rdata..P....`.......F..............@..@.data........p.......V..............@....pdata...............^..............@..@.rsrc................b..............@..@.reloc..(............d..............@..B........................................................................................................................................................................................................................................

                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI68642\Crypto\PublicKey\_ed448.pyd

                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                Process:C:\Users\user\Desktop\dipwo1iToJ.exe
                                                                                                                                                                                                                File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                Size (bytes):84992
                                                                                                                                                                                                                Entropy (8bit):6.064677498000638
                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                SSDEEP:1536:BrYNvxcZeLrIeNs2qkTwe57DsuP45PqAqVDK9agdUiwOXyQdDrov0slb8gx4TBKW:Br4vxcZeLrIeN1TvHsuP45yAqVDK9ag3
                                                                                                                                                                                                                MD5:8A0C0AA820E98E83AC9B665A9FD19EAF
                                                                                                                                                                                                                SHA1:6BF5A14E94D81A55A164339F60927D5BF1BAD5C4
                                                                                                                                                                                                                SHA-256:4EE3D122DCFFE78E6E7E76EE04C38D3DC6A066E522EE9F7AF34A09649A3628B1
                                                                                                                                                                                                                SHA-512:52496AE7439458DEDB58A65DF9FFDCC3A7F31FC36FE7202FB43570F9BB03ABC0565F5EF32E5E6C048ED3EBC33018C19712E58FF43806119B2FB5918612299E7E
                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                Antivirus:
                                                                                                                                                                                                                • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......:..P~...~...~...w.3.x...,...|...5...}...~...U...,...u...,...v...,...}.......|............._.............Rich~...................PE..d...^..f.........." .........8......`.....................................................`..........................................C..h...HE..d....p.......`..l...............(....1...............................1..8............0...............................text............................... ..`.rdata.......0......................@..@.data........P.......4..............@....pdata..l....`.......>..............@..@.rsrc........p.......H..............@..@.reloc..(............J..............@..B................................................................................................................................................................................................................................................

                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI68642\Crypto\Util\_cpuid_c.pyd

                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                Process:C:\Users\user\Desktop\dipwo1iToJ.exe
                                                                                                                                                                                                                File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                Size (bytes):10240
                                                                                                                                                                                                                Entropy (8bit):4.675380950473425
                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                SSDEEP:96:frQRpBddzAvzrqTOy/ThIz014mlxuLnkC75JiSBhsPeSztllIDpqf4AZaRcX6gnO:Qddz2KTnThIz0qfteRIDgRWcqgnCWt
                                                                                                                                                                                                                MD5:44B930B89CE905DB4716A548C3DB8DEE
                                                                                                                                                                                                                SHA1:948CBFF12A243C8D17A7ACD3C632EE232DF0F0ED
                                                                                                                                                                                                                SHA-256:921C2D55179C0968535B20E9FD7AF55AD29F4CE4CF87A90FE258C257E2673AA5
                                                                                                                                                                                                                SHA-512:79DF755BE8B01D576557A4CB3F3200E5EE1EDE21809047ABB9FF8D578C535AC1EA0277EDA97109839A7607AF043019F2C297E767441C7E11F81FDC87FD1B6EFC
                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                Antivirus:
                                                                                                                                                                                                                • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........@................../....../...../......+.......*......-......&....................,....Rich...........................PE..d...X..f.........." ................P........................................p............`.........................................@'..|....'..P....P.......@...............`..(....!...............................!..8............ ...............................text............................... ..`.rdata....... ......................@..@.data...H....0....... ..............@....pdata.......@......."..............@..@.rsrc........P.......$..............@..@.reloc..(....`.......&..............@..B........................................................................................................................................................................................................................................

                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI68642\Crypto\Util\_strxor.pyd

                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                Process:C:\Users\user\Desktop\dipwo1iToJ.exe
                                                                                                                                                                                                                File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                Size (bytes):10240
                                                                                                                                                                                                                Entropy (8bit):4.625428549874022
                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                SSDEEP:96:flipBddzAvzrqTOy/ThIz014mlxuLnkC75JiSBhsPeSzteXuDVZqYNIfcX6gHCWx:Cddz2KTnThIz0qfteR5DVwYkcqgHCWt
                                                                                                                                                                                                                MD5:F24F9356A6BDD29B9EF67509A8BC3A96
                                                                                                                                                                                                                SHA1:A26946E938304B4E993872C6721EB8CC1DCBE43B
                                                                                                                                                                                                                SHA-256:034BB8EFE3068763D32C404C178BD88099192C707A36F5351F7FDB63249C7F81
                                                                                                                                                                                                                SHA-512:C4D3F92D7558BE1A714388C72F5992165DD7A9E1B4FA83B882536030542D93FDAD9148C981F76FFF7868192B301AC9256EDB8C3D5CE5A1A2ACAC183F96C1028B
                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                Antivirus:
                                                                                                                                                                                                                • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........@................../....../...../......+.......*......-......&....................,....Rich...........................PE..d...Z..f.........." ................P........................................p............`......................................... '..t....'..P....P.......@...............`..(....!...............................!..8............ ...............................text...h........................... ..`.rdata..`.... ......................@..@.data...H....0....... ..............@....pdata.......@......."..............@..@.rsrc........P.......$..............@..@.reloc..(....`.......&..............@..B........................................................................................................................................................................................................................................

                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI68642\VCRUNTIME140.dll

                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                Process:C:\Users\user\Desktop\dipwo1iToJ.exe
                                                                                                                                                                                                                File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                Size (bytes):109392
                                                                                                                                                                                                                Entropy (8bit):6.641929675972235
                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                SSDEEP:1536:GcghbEGyzXJZDWnEzWG9q4lVOiVgXjO5/woecbq8qZHg2zuCS+zuecL:GV3iC0h9q4v6XjKwoecbq8qBTq+1cL
                                                                                                                                                                                                                MD5:4585A96CC4EEF6AAFD5E27EA09147DC6
                                                                                                                                                                                                                SHA1:489CFFF1B19ABBEC98FDA26AC8958005E88DD0CB
                                                                                                                                                                                                                SHA-256:A8F950B4357EC12CFCCDDC9094CCA56A3D5244B95E09EA6E9A746489F2D58736
                                                                                                                                                                                                                SHA-512:D78260C66331FE3029D2CC1B41A5D002EC651F2E3BBF55076D65839B5E3C6297955AFD4D9AB8951FBDC9F929DBC65EB18B14B59BCE1F2994318564EB4920F286
                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                Antivirus:
                                                                                                                                                                                                                • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........u...u...u.E.t...u.....u...t...u..v...u..q...u..p...u..u...u......u..w...u.Rich..u.........PE..d..._#;..........." ...".....`......................................................=.....`A........................................`C..4....K...............p.......\..PO...........-..p............................,..@............................................text............................... ..`.rdata...A.......B..................@..@.data...0....`.......D..............@....pdata.......p.......H..............@..@_RDATA..\............T..............@..@.rsrc................V..............@..@.reloc...............Z..............@..B................................................................................................................................................................................................................................

                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI68642\VCRUNTIME140_1.dll

                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                Process:C:\Users\user\Desktop\dipwo1iToJ.exe
                                                                                                                                                                                                                File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                Size (bytes):49520
                                                                                                                                                                                                                Entropy (8bit):6.65700274508223
                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                SSDEEP:768:YEgYXUcHJcUJSDW/tfxL1qBSHGm6Ub/I2Hi09z0XQKBcRmuU9zuKl:YvGS8fZ1esJwUpz0X3B+d8zuKl
                                                                                                                                                                                                                MD5:7E668AB8A78BD0118B94978D154C85BC
                                                                                                                                                                                                                SHA1:DBAC42A02A8D50639805174AFD21D45F3C56E3A0
                                                                                                                                                                                                                SHA-256:E4B533A94E02C574780E4B333FCF0889F65ED00D39E32C0FBBDA2116F185873F
                                                                                                                                                                                                                SHA-512:72BB41DB17256141B06E2EAEB8FC65AD4ABDB65E4B5F604C82B9E7E7F60050734137D602E0F853F1A38201515655B6982F2761EE0FA77C531AA58591C95F0032
                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                Antivirus:
                                                                                                                                                                                                                • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..............L...L...L...M...L...M...L.FL...L...L...L...M...L...M...L...M...L...M...L..*L...L...M...LRich...L........................PE..d....J.$.........." ...".<...8.......A....................................................`A........................................0m.......m..x....................r..pO......D....c..p...........................pb..@............P..h............................text...0:.......<.................. ..`.rdata..."...P...$...@..............@..@.data................d..............@....pdata...............f..............@..@.rsrc................l..............@..@.reloc..D............p..............@..B................................................................................................................................................................................................................................................

                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI68642\_asyncio.pyd

                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                Process:C:\Users\user\Desktop\dipwo1iToJ.exe
                                                                                                                                                                                                                File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                Size (bytes):71448
                                                                                                                                                                                                                Entropy (8bit):6.243013214204417
                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                SSDEEP:1536:nhaPPkvDcBlqCTFFQ/ObfW11swNIGOnL7SyaeCxT:hanCDcnqCJFOObfW11swNIGOnLoeE
                                                                                                                                                                                                                MD5:2CD68FF636394D3019411611E27D0A3B
                                                                                                                                                                                                                SHA1:DA369C5D1A32F68639170D8A265A9EA49C2C8EBD
                                                                                                                                                                                                                SHA-256:0D4FBD46F922E548060EA74C95E99DC5F19B1DF69BE17706806760515C1C64FE
                                                                                                                                                                                                                SHA-512:37388D137454F52057B2376D95ABCC955FA1EDC3E20B96445FA45D1860544E811DF0C547F221C8671DC1A4D90262BB20F3B9F114252F3C47A8C3829951A2CE51
                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                Antivirus:
                                                                                                                                                                                                                • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......B:.T.[...[...[...#*..[...'...[...'...[...'...[...'...[...&...[..M#...[...[...[...&...[...&...[...&F..[...&...[..Rich.[..........................PE..d...Q..e.........." ...#.f................................................... ......A&....`.............................................P......d......................../..............T...........................@...@............................................text...)d.......f.................. ..`.rdata..`O.......P...j..............@..@.data...(...........................@....pdata..............................@..@.rsrc...............................@..@.reloc..............................@..B................................................................................................................................................................................................................................

                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI68642\_bz2.pyd

                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                Process:C:\Users\user\Desktop\dipwo1iToJ.exe
                                                                                                                                                                                                                File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                Size (bytes):84760
                                                                                                                                                                                                                Entropy (8bit):6.584507188180646
                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                SSDEEP:1536:FFzZz757cav+IuK66nlxX8W8LsANVIGCV87SyixL7:DzZzq6n3MhLsMVIGCV8O7
                                                                                                                                                                                                                MD5:C7CE973F261F698E3DB148CCAD057C96
                                                                                                                                                                                                                SHA1:59809FD48E8597A73211C5DF64C7292C5D120A10
                                                                                                                                                                                                                SHA-256:02D772C03704FE243C8DE2672C210A5804D075C1F75E738D6130A173D08DFCDE
                                                                                                                                                                                                                SHA-512:A924750B1825747A622EEF93331FD764D824C954297E37E8DC93A450C11AA7AB3AD7C3B823B11656B86E64DE3CD5D409FDA15DB472488DFAA4BB50341F0B29D1
                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                Antivirus:
                                                                                                                                                                                                                • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......w.l.3...3...3...:...9......1......0......>......;......7.......0...x...1...3...l.......;.......2.......2.......2...Rich3...................PE..d...f..e.........." ...#.....^...............................................P.......@....`.............................................H............0....... ..,......../...@..........T...........................p...@............................................text............................... ..`.rdata..p>.......@..................@..@.data...............................@....pdata..,.... ......................@..@.rsrc........0......................@..@.reloc.......@......................@..B................................................................................................................................................................................................................................

                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI68642\_cffi_backend.cp312-win_amd64.pyd

                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                Process:C:\Users\user\Desktop\dipwo1iToJ.exe
                                                                                                                                                                                                                File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                Size (bytes):179712
                                                                                                                                                                                                                Entropy (8bit):6.180800197956408
                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                SSDEEP:3072:IULjhBCx8qImKrUltSfGzdMcbb9CF8OS7jkSTLkKWlgeml:IgCeqImzSfIMcNCvOkSTLLWWem
                                                                                                                                                                                                                MD5:FCB71CE882F99EC085D5875E1228BDC1
                                                                                                                                                                                                                SHA1:763D9AFA909C15FEA8E016D321F32856EC722094
                                                                                                                                                                                                                SHA-256:86F136553BA301C70E7BADA8416B77EB4A07F76CCB02F7D73C2999A38FA5FA5B
                                                                                                                                                                                                                SHA-512:4A0E98AB450453FD930EDC04F0F30976ABB9214B693DB4B6742D784247FB062C57FAFAFB51EB04B7B4230039AB3B07D2FFD3454D6E261811F34749F2E35F04D6
                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                Antivirus:
                                                                                                                                                                                                                • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                Preview:MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$.......a..#%p.p%p.p%p.p,..p)p.p5.q'p.p5.zp!p.p5.q!p.p5.q-p.p5.q)p.pn..q!p.p6.q&p.p%p.p.p.pm..q!p.p,..p$p.pm..q$p.pm.xp$p.pm..q$p.pRich%p.p........................PE..d...W..f.........." ...).....B......`........................................0............`..........................................h..l....i..................T............ .......O...............................M..@............................................text............................... ..`.rdata..............................@..@.data....].......0...p..............@....pdata..T...........................@..@.rsrc...............................@..@.reloc....... ......................@..B................................................................................................................................................................................................................

                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI68642\_ctypes.pyd

                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                Process:C:\Users\user\Desktop\dipwo1iToJ.exe
                                                                                                                                                                                                                File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                Size (bytes):124696
                                                                                                                                                                                                                Entropy (8bit):6.1345016966871455
                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                SSDEEP:3072:kuiS11BYNd+5AWdu41qOqJ/f/EX4lCPIWu1ptpIGLP+z:Pl1U+Ke/16f/ExWI
                                                                                                                                                                                                                MD5:10FDCF63D1C3C3B7E5861FBB04D64557
                                                                                                                                                                                                                SHA1:1AA153EFEC4F583643046618B60E495B6E03B3D7
                                                                                                                                                                                                                SHA-256:BC3B83D2DC9E2F0E6386ED952384C6CF48F6EED51129A50DFD5EF6CBBC0A8FB3
                                                                                                                                                                                                                SHA-512:DC702F4100ED835E198507CD06FA5389A063D4600FC08BE780690D729AB62114FD5E5B201D511B5832C14E90A5975ED574FC96EDB5A9AB9EB83F607C7A712C7F
                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                Antivirus:
                                                                                                                                                                                                                • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......>...z.z.z.s...|....x....v....r....~.....x.1...{.1...|.....y.z.......|.....{...o.{.....{.Richz.................PE..d...c..e.........." ...#............p^..............................................".....`..........................................`.......a.........................../......p.......T...............................@............................................text............................... ..`.rdata...l.......n..................@..@.data....4.......0...h..............@....pdata..............................@..@.rsrc...............................@..@.reloc..p...........................@..B........................................................................................................................................................................................................................

                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI68642\_decimal.pyd

                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                Process:C:\Users\user\Desktop\dipwo1iToJ.exe
                                                                                                                                                                                                                File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                Size (bytes):253208
                                                                                                                                                                                                                Entropy (8bit):6.567915765795386
                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                SSDEEP:6144:DV0lmIvcruIDCiryrjqPBTn9qWM53pLW1AuDRRRctULoT3TdTx:SN0rQiryr8TaV+QTdTx
                                                                                                                                                                                                                MD5:21C73E7E0D7DAD7A1FE728E3B80CE073
                                                                                                                                                                                                                SHA1:7B363AF01E83C05D0EA75299B39C31D948BBFE01
                                                                                                                                                                                                                SHA-256:A28C543976AA4B6D37DA6F94A280D72124B429F458D0D57B7DBCF71B4BEA8F73
                                                                                                                                                                                                                SHA-512:0357102BFFC2EC2BC6FF4D9956D6B8E77ED8558402609E558F1C1EBC1BACA6AEAA5220A7781A69B783A54F3E76362D1F74D817E4EE22AAC16C7F8C86B6122390
                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                Antivirus:
                                                                                                                                                                                                                • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........@.R.!...!...!...Y=..!..+]...!..+]...!..+]...!..+]...!..M\...!...Y...!...!...!..M\...!..M\...!..M\...!..M\Q..!..M\...!..Rich.!..........PE..d...T..e.........." ...#.v...<......|.....................................................`..........................................T..P....T...................'......./......P...`...T........................... ...@............................................text....t.......v.................. ..`.rdata...............z..............@..@.data....*...p...$...R..............@....pdata...'.......(...v..............@..@.rsrc...............................@..@.reloc..P...........................@..B........................................................................................................................................................................................................................................

                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI68642\_hashlib.pyd

                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                Process:C:\Users\user\Desktop\dipwo1iToJ.exe
                                                                                                                                                                                                                File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                Size (bytes):64792
                                                                                                                                                                                                                Entropy (8bit):6.219813461442214
                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                SSDEEP:1536:CQGllrIdcGuzZc94cVM7gDX4NIGOI67Sy+xzn1:I6cvz+9IgDX4NIGOI6Sn1
                                                                                                                                                                                                                MD5:F495D1897A1B52A2B15C20DCECB84B47
                                                                                                                                                                                                                SHA1:8CB65590A8815BDA58C86613B6386B5982D9EC3F
                                                                                                                                                                                                                SHA-256:E47E76D70D508B62924FE480F30E615B12FDD7745C0AAC68A2CDDABD07B692AE
                                                                                                                                                                                                                SHA-512:725D408892887BEBD5BCF040A0ECC6A4E4B608815B9DEA5B6F7B95C812715F82079896DF33B0830C9F787FFE149B8182E529BB1F78AADD89DF264CF8853EE4C4
                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                Antivirus:
                                                                                                                                                                                                                • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........u...&...&...&.U&...&u..'...&u..'...&u..'...&u..'...&...'...&...'...&...&M..&...'...&...'...&..9&...&...'...&Rich...&........PE..d......e.........." ...#.R...~.......>..............................................'.....`.............................................P.............................../......X....|..T............................{..@............p..(............................text...7P.......R.................. ..`.rdata...N...p...P...V..............@..@.data...............................@....pdata..............................@..@.rsrc...............................@..@.reloc..X...........................@..B................................................................................................................................................................................................................................................

                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI68642\_lzma.pyd

                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                Process:C:\Users\user\Desktop\dipwo1iToJ.exe
                                                                                                                                                                                                                File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                Size (bytes):159512
                                                                                                                                                                                                                Entropy (8bit):6.841828996170163
                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                SSDEEP:3072:RmuEE9tZBoI+1hINrznfB9mNoNSn2Vh/VDxuVIGZ1L6E:RmuFPobkNpYONnvfuCE
                                                                                                                                                                                                                MD5:4E2239ECE266230ECB231B306ADDE070
                                                                                                                                                                                                                SHA1:E807A078B71C660DB10A27315E761872FFD01443
                                                                                                                                                                                                                SHA-256:34130D8ABE27586EE315262D69AF4E27429B7EAB1F3131EA375C2BB62CF094BE
                                                                                                                                                                                                                SHA-512:86E6A1EAB3529E600DD5CAAB6103E34B0F618D67322A5ECF1B80839FAA028150C492A5CF865A2292CC8584FBA008955DA81A50B92301583424401D249C5F1401
                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                Antivirus:
                                                                                                                                                                                                                • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........TB#.5,p.5,p.5,p.M.p.5,p.I-q.5,p.I)q.5,p.I(q.5,p.I/q.5,pnH-q.5,p.M-q.5,p.5-p.5,pnH!q.5,pnH,q.5,pnH.p.5,pnH.q.5,pRich.5,p........PE..d......e.........." ...#.d..........06....................................................`......................................... %..L...l%..x....p.......P.......@.../......4.......T...........................p...@............................................text...:b.......d.................. ..`.rdata..............h..............@..@.data...(....@......................@....pdata.......P....... ..............@..@.rsrc........p.......4..............@..@.reloc..4............>..............@..B................................................................................................................................................................................................................................................

                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI68642\_multiprocessing.pyd

                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                Process:C:\Users\user\Desktop\dipwo1iToJ.exe
                                                                                                                                                                                                                File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                Size (bytes):35096
                                                                                                                                                                                                                Entropy (8bit):6.456173627081832
                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                SSDEEP:768:VAIvrenSE0PkA9c0ji+m9IGWte5YiSyv2pAAMxkEn:6ITQSH9c0jlm9IGWtU7SyOOxj
                                                                                                                                                                                                                MD5:811BCEE2F4246265898167B103FC699B
                                                                                                                                                                                                                SHA1:AE3DE8ACBA56CDE71001D3796A48730E1B9C7CCE
                                                                                                                                                                                                                SHA-256:FB69005B972DC3703F9EF42E8E0FDDF8C835CB91F57EF9B6C66BBDF978C00A8C
                                                                                                                                                                                                                SHA-512:1F71E23CE4B6BC35FE772542D7845DCBEA2A34522BA0468B61CB05F9ABAB7732CBF524BCFF498D1BD0B13B5E8A45C373CCA19AD20E5370F17259E281EDF344BE
                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                Antivirus:
                                                                                                                                                                                                                • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........)*.wGy.wGy.wGy...y.wGy'.Fx.wGy'.Bx.wGy'.Cx.wGy'.Dx.wGyA.Fx.wGy.wFy.wGy..Fx.wGyA.Jx.wGyA.Gx.wGyA..y.wGyA.Ex.wGyRich.wGy........................PE..d...W..e.........." ...#.....>......P.....................................................`.........................................0E..`....E..x............p.......Z.../...........4..T............................3..@............0...............................text............................... ..`.rdata..r ...0..."..."..............@..@.data........`.......D..............@....pdata.......p.......J..............@..@.rsrc................N..............@..@.reloc...............X..............@..B................................................................................................................................................................................................................................

                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI68642\_overlapped.pyd

                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                Process:C:\Users\user\Desktop\dipwo1iToJ.exe
                                                                                                                                                                                                                File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                Size (bytes):55576
                                                                                                                                                                                                                Entropy (8bit):6.3454178187323755
                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                SSDEEP:1536:2ND3ua5sIRL9EiqXxpNdtrtBIGXtz7SyNxM:2NjOiUpNdPBIGXtzi
                                                                                                                                                                                                                MD5:F9C67280538408411BE9A7341B93B5B0
                                                                                                                                                                                                                SHA1:CCF776CD2483BC83B48B1DB322D7B6FCAB48356E
                                                                                                                                                                                                                SHA-256:5D298BB811037B583CFF6C88531F1742FAE5EEE47C290ADB47DDBD0D6126B9CC
                                                                                                                                                                                                                SHA-512:AF2156738893EF504D582ACE6750B25BC42AD1EC8A92E0550CE54810706D854F37A82F38EB965A537CAD5D35C0178C5EB7B4D20DB2A95BEBFECF9A13C0592646
                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                Antivirus:
                                                                                                                                                                                                                • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........|!{X.O(X.O(X.O(Qe.(\.O(.aN)Z.O(.aJ)T.O(.aK)P.O(.aL)[.O(.`N)Z.O(X.N(/.O(.eN)].O(.eK)Y.O(.`B)Y.O(.`O)Y.O(.`.(Y.O(.`M)Y.O(RichX.O(................PE..d...V..e.........." ...#.L...`......P...............................................wC....`.............................................X...X............................/......(....f..T...........................`e..@............`...............................text....J.......L.................. ..`.rdata..D8...`...:...P..............@..@.data...............................@....pdata..............................@..@.rsrc...............................@..@.reloc..(...........................@..B................................................................................................................................................................................................................................

                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI68642\_queue.pyd

                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                Process:C:\Users\user\Desktop\dipwo1iToJ.exe
                                                                                                                                                                                                                File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                Size (bytes):32536
                                                                                                                                                                                                                Entropy (8bit):6.464181935983508
                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                SSDEEP:768:/k+Ea6rfMkAYY0J/MpIGQUG5YiSyvHAMxkEJ5YSv:8tfHY0JEpIGQU87SyPx/Y+
                                                                                                                                                                                                                MD5:6E00E0821BB519333CCFD4E61A83CB38
                                                                                                                                                                                                                SHA1:3550A41BB2EA54F456940C4D1940ACAB36815949
                                                                                                                                                                                                                SHA-256:2AD02D49691A629F038F48FCDEE46A07C4FCC2CB0620086E7B09AC11915AE6B7
                                                                                                                                                                                                                SHA-512:C3F8332C10B58F30E292676B48ECF1860C5EF9546367B87E90789F960C91EAE4D462DD3EE9CB14F603B9086E81B6701AAB56DA5B635B22DB1E758ED0A983E562
                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                Antivirus:
                                                                                                                                                                                                                • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......B:W\.[9..[9..[9..#...[9..'8..[9..'<..[9..'=..[9..':..[9..&8..[9.M#8..[9..[8.M[9..&4..[9..&9..[9..&...[9..&;..[9.Rich.[9.........................PE..d...Y..e.........." ...#.....8.......................................................a....`..........................................C..L....C..d....p.......`.......P.../..........p4..T...........................03..@............0..8............................text............................... ..`.rdata.......0......................@..@.data........P.......<..............@....pdata.......`.......@..............@..@.rsrc........p.......D..............@..@.reloc...............N..............@..B................................................................................................................................................................................................................................

                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI68642\_socket.pyd

                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                Process:C:\Users\user\Desktop\dipwo1iToJ.exe
                                                                                                                                                                                                                File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                Size (bytes):83224
                                                                                                                                                                                                                Entropy (8bit):6.340320871656589
                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                SSDEEP:1536:ZUuhzLx79flWrqcqtpjly+uCo9/s+S+pzcHQ6B48/VI9dsSbxntpIGLwIU7SyZxL:ZU6zLRNawRy+uCo9/sT+pzuXxVIbsSde
                                                                                                                                                                                                                MD5:899380B2D48DF53414B974E11BB711E3
                                                                                                                                                                                                                SHA1:F1D11F7E970A7CD476E739243F8F197FCB3AD590
                                                                                                                                                                                                                SHA-256:B38E66E6EE413E5955EF03D619CADD40FCA8BE035B43093D2342B6F3739E883E
                                                                                                                                                                                                                SHA-512:7426CA5E7A404B9628E2966DAE544F3E8310C697145567B361825DC0B5C6CD87F2CAF567DEF8CD19E73D68643F2F38C08FF4FF0BB0A459C853F241B8FDF40024
                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                Antivirus:
                                                                                                                                                                                                                • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........J./.+z|.+z|.+z|.S.|.+z|.W{}.+z|.W.}.+z|.W~}.+z|.Wy}.+z|}V{}.+z|.+{|.+z|.S{}.+z|}Vw}.+z|}Vz}.+z|}V.|.+z|}Vx}.+z|Rich.+z|................PE..d......e.........." ...#.v...........-.......................................`...........`.............................................P............@.......0.........../...P..........T...............................@............................................text....u.......v.................. ..`.rdata...x.......z...z..............@..@.data...H...........................@....pdata.......0......................@..@.rsrc........@......................@..@.reloc.......P......................@..B........................................................................................................................................................................................................................................

                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI68642\_sqlite3.pyd

                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                Process:C:\Users\user\Desktop\dipwo1iToJ.exe
                                                                                                                                                                                                                File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                Size (bytes):124696
                                                                                                                                                                                                                Entropy (8bit):6.2652662506859444
                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                SSDEEP:3072:fZIPlR6TxhNO7/9CO4w5yIFGcXcpVNIGOQyl:RjFHO7kC56cXuo
                                                                                                                                                                                                                MD5:CEE93C920951C1169B615CB6330CEDDA
                                                                                                                                                                                                                SHA1:EF2ABF9F760DB2DE0BD92AFE8766A0B798CF8167
                                                                                                                                                                                                                SHA-256:FF25BDBEEF34D2AA420A79D3666C2660E7E3E96259D1F450F1AF5268553380EC
                                                                                                                                                                                                                SHA-512:999D324448BB39793E4807432C697F01F8922B0ABA4519A21D5DC4F4FC8E9E4737D7E104B205B931AF753EDA65F61D0C744F12BE84446F9C6CB3C2A5B35B773C
                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                Antivirus:
                                                                                                                                                                                                                • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........@.g...g...g.......g..../..g......g....+..g....*..g....-..g..q./..g..../..g...g/..f..q.#..g..q....g..q...g..q.,..g..Rich.g..........PE..d......e.........." ...#.............................................................-....`.........................................po..P....o..................8......../.......... ...T...............................@............................................text............................... ..`.rdata..............................@..@.data...8............|..............@....pdata..8...........................@..@.rsrc...............................@..@.reloc..............................@..B........................................................................................................................................................................................................................................

                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI68642\_ssl.pyd

                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                Process:C:\Users\user\Desktop\dipwo1iToJ.exe
                                                                                                                                                                                                                File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                Size (bytes):177432
                                                                                                                                                                                                                Entropy (8bit):5.975354635226847
                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                SSDEEP:3072:KXGEr/16/nJxNOJW5NT6X3l44K5WOSCSVRJNI7IM/cbP7RHs3J7VIGC7hN:Y/r/16/nDNPT6X3l1CMVS7i
                                                                                                                                                                                                                MD5:9B4E74FD1DE0F8A197E4AA1E16749186
                                                                                                                                                                                                                SHA1:833179B49EB27C9474B5189F59ED7ECF0E6DC9EA
                                                                                                                                                                                                                SHA-256:A4CE52A9E0DADDBBE7A539D1A7EDA787494F2173DDCC92A3FAF43B7CF597452B
                                                                                                                                                                                                                SHA-512:AE72B39CB47A859D07A1EE3E73DE655678FE809C5C17FFD90797B5985924DDB47CEB5EBE896E50216FB445526C4CBB95E276E5F3810035B50E4604363EB61CD4
                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                Antivirus:
                                                                                                                                                                                                                • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........U.k.4.8.4.8.4.8.L)8.4.8.H.9.4.8.H.9.4.8.H.9.4.8.H.9.4.8kI.9.4.8.4.8#5.8.L.9.4.8kI.9.4.8kI.9.4.8kIE8.4.8kI.9.4.8Rich.4.8........................PE..d......e.........." ...#............\,....................................................`......................................... ...d.......................8......../......x...@...T...............................@............................................text.............................. ..`.rdata...!......."..................@..@.data...(...........................@....pdata..8............^..............@..@.rsrc................j..............@..@.reloc..x............t..............@..B................................................................................................................................................................................................................................

                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI68642\_uuid.pyd

                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                Process:C:\Users\user\Desktop\dipwo1iToJ.exe
                                                                                                                                                                                                                File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                Size (bytes):25368
                                                                                                                                                                                                                Entropy (8bit):6.6272949891352315
                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                SSDEEP:384:lrfwHnEWGQiAQVIGZwJXHQIYiSy1pCQ4XAM+o/8E9VF0NyqzJSj:dQnEIHQVIGZw95YiSyv8AMxkEqw
                                                                                                                                                                                                                MD5:3C8737723A903B08D5D718336900FD8C
                                                                                                                                                                                                                SHA1:2AD2D0D50F6B52291E59503222B665B1823B0838
                                                                                                                                                                                                                SHA-256:BB418E91E543C998D11F9E65FD2A4899B09407FF386E059A88FE2A16AED2556B
                                                                                                                                                                                                                SHA-512:1D974EC1C96E884F30F4925CC9A03FB5AF78687A267DEC0D1582B5D7561D251FB733CF733E0CC00FAEE86F0FEF6F73D36A348F3461C6D34B0238A75F69320D10
                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                Antivirus:
                                                                                                                                                                                                                • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........<p.R#.R#.R#...#.R#i.S".R#i.W".R#i.V".R#i.Q".R#..S".R#..S".R#.S#..R#..Z".R#..R".R#...#.R#..P".R#Rich.R#........................PE..d...]..e.........." ...#.....&...... ........................................p......wz....`.........................................`)..L....)..x....P.......@.......4.../...`..@...`#..T........................... "..@............ ..8............................text...h........................... ..`.rdata....... ......................@..@.data........0.......$..............@....pdata.......@.......&..............@..@.rsrc........P.......(..............@..@.reloc..@....`.......2..............@..B................................................................................................................................................................................................................................

                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI68642\_wmi.pyd

                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                Process:C:\Users\user\Desktop\dipwo1iToJ.exe
                                                                                                                                                                                                                File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                Size (bytes):36632
                                                                                                                                                                                                                Entropy (8bit):6.364173312940401
                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                SSDEEP:768:PgMwnWGwMtUTA7LlVIGCilx5YiSyvzAMxkEaFy:PgMwWGJtGA7LlVIGCih7Syrx+g
                                                                                                                                                                                                                MD5:EE33F4C8D17D17AD62925E85097B0109
                                                                                                                                                                                                                SHA1:8C4A03531CF3DBFE6F378FDAB9699D51E7888796
                                                                                                                                                                                                                SHA-256:79ADCA5037D9145309D3BD19F7A26F7BB7DA716EE86E01073C6F2A9681E33DAD
                                                                                                                                                                                                                SHA-512:60B0705A371AD2985DB54A91F0E904EEA502108663EA3C3FB18ED54671BE1932F4F03E8E3FD687A857A5E3500545377B036276C69E821A7D6116B327F5B3D5C1
                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                Antivirus:
                                                                                                                                                                                                                • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......._\...=.@.=.@.=.@.En@.=.@.A.A.=.@.A.A.=.@.A.A.=.@.@.A.=.@.A.A.=.@PE.A.=.@.=.@A=.@PE.A.=.@.@.A.=.@.@.A.=.@.@.@.=.@.@.A.=.@Rich.=.@........PE..d..._..e.........." ...#.(...:.......&....................................................`..........................................T..H....T...............p..`....`.../......t...DG..T............................C..@............@.......S..@....................text...>&.......(.................. ..`.rdata..D....@... ...,..............@..@.data........`.......L..............@....pdata..`....p.......P..............@..@.rsrc................T..............@..@.reloc..t............^..............@..B........................................................................................................................................................................................................................................

                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI68642\aiohttp\_http_parser.cp312-win_amd64.pyd

                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                Process:C:\Users\user\Desktop\dipwo1iToJ.exe
                                                                                                                                                                                                                File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                Size (bytes):264192
                                                                                                                                                                                                                Entropy (8bit):6.209859454972578
                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                SSDEEP:6144:qV3aFwGtxiTjweCKvJ1+jLjJML5wir++JTCuG:qV3mxi3wDArolq5wiC
                                                                                                                                                                                                                MD5:40E99EAA1A21C1AA24F575855B52EEC0
                                                                                                                                                                                                                SHA1:0FE9B3B93F77D045B248C36BC5B5D5117C0176B3
                                                                                                                                                                                                                SHA-256:5F93DB706E799D00A3774CE14D078E272F8808867318C1183FDBE60D075D5F5D
                                                                                                                                                                                                                SHA-512:FAD6BF5BBCC7C54DC792A2AB9FAEFAB77DD15233BC86A566AB0B6F27128C0B0609D0E17469F373778A7122E5015D57AE8CA67BAD1D4BD47B92FCE95A47A7AA2C
                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                Antivirus:
                                                                                                                                                                                                                • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.............zY..zY..zY...Y..zY.q{X..zY.v{X..zY.r{X..zY..{Y..zY.qyX..zY.q~X..zY.q.X..zYuqrX..zYuqzX..zYuq.Y..zYuqxX..zYRich..zY........................PE..d....H?g.........." ...*.(...........+....................................................`.........................................@...........x....`.......@..$............p..\...P...................................@............@...............................text....'.......(.................. ..`.rdata......@.......,..............@..@.data....@..........................@....pdata..$....@......................@..@.rsrc........`......................@..@.reloc..\....p......................@..B................................................................................................................................................................................................................................

                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI68642\aiohttp\_http_writer.cp312-win_amd64.pyd

                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                Process:C:\Users\user\Desktop\dipwo1iToJ.exe
                                                                                                                                                                                                                File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                Size (bytes):49664
                                                                                                                                                                                                                Entropy (8bit):5.798696651761287
                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                SSDEEP:768:oPriCeqBiVwVJAQ8mK4fE0UYq0olSgEDmYgRE8tJQ:oprimVJtFxEqqAmYg20JQ
                                                                                                                                                                                                                MD5:1412E133574C3D73B77B4964A2A18FE3
                                                                                                                                                                                                                SHA1:240E4A6149FA4AFCE7E857D5544A2A0772F9C9EB
                                                                                                                                                                                                                SHA-256:9E33CAFEA557265EE254373F662ABCE9466952F0CCAE81F774A7F0D0CD34099F
                                                                                                                                                                                                                SHA-512:07C50CADDF6AE80E6CD30DD810F755656D6F6965DB0F9586FD9D339FB551D1F086209495B5AB69DF6339698F585372B4459F14D9AEBF316F4E242B2D0DBD0B94
                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......~..T:...:...:...3.].8...+d..8...Hc..8...+d..9...+d..2...+d..6...rg..9...:........d..;....d..;....d1.;....d..;...Rich:...........PE..d....H?g.........." ...*.z...........|.......................................P............`............................................h...H...d....0....... ...............@......p...............................0...@...............P............................text....x.......z.................. ..`.rdata..20.......2...~..............@..@.data....N..........................@....pdata....... ......................@..@.rsrc........0......................@..@.reloc.......@......................@..B................................................................................................................................................................................................................................................

                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI68642\aiohttp\_websocket\mask.cp312-win_amd64.pyd

                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                Process:C:\Users\user\Desktop\dipwo1iToJ.exe
                                                                                                                                                                                                                File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                Size (bytes):36352
                                                                                                                                                                                                                Entropy (8bit):5.654316966286352
                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                SSDEEP:384:3FIKmzsyA2+kEyrMxA91WZqJ91cL9U0WJtqpTHl2zwu9L6lBw81eLaZ4Y1exetk0:3ehzcnygxA91bryrczTGbw8kLssqqTH
                                                                                                                                                                                                                MD5:1D59358DA065743D07FB455DE273A25E
                                                                                                                                                                                                                SHA1:82E99FF22B104ED0FE067A20C1B18C04B3155254
                                                                                                                                                                                                                SHA-256:148E0CFFDBCD02E3EB65A6BF2F2B9A8C45BC36C113D92CCDA40408A7D01A6DC9
                                                                                                                                                                                                                SHA-512:FE21A0010A543053919419FB31DD39E810F6EBAF1BC57DC5F89645F195901F354A57EA931AA464A208BB39C1AB0A7D1AC61D60D1B5F5EFED78570FAEC46B2DE6
                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......v..T2...2...2...;.M.0...#d..0...@c..0...#d..1...#d..:...#d..>...zg..1...2........d..3....d..3....d!.3....d..3...Rich2...........................PE..d....H?g.........." ...*.N...B......`P....................................................`......................................... {..X...x{..d...................................0s...............................q..@............`...............................text....L.......N.................. ..`.rdata...)...`...*...R..............@..@.data................|..............@....pdata..............................@..@.rsrc...............................@..@.reloc..............................@..B................................................................................................................................................................................................................................

                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI68642\aiohttp\_websocket\reader_c.cp312-win_amd64.pyd

                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                Process:C:\Users\user\Desktop\dipwo1iToJ.exe
                                                                                                                                                                                                                File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                Size (bytes):161792
                                                                                                                                                                                                                Entropy (8bit):6.09154494600188
                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                SSDEEP:1536:WWN8oZXh2Y/m2/0+AMvRSDFxNYH/9Iw89qV406AgGkbJT0N6ctLU+XqiasgzvtaR:/GoVwY8M5bFIwoqRkYU0qikVXMNkqB
                                                                                                                                                                                                                MD5:5B741F2BCB063D276534D43979FC8945
                                                                                                                                                                                                                SHA1:7E4B63D4856BA1A720BD2CA68F0317B827E30886
                                                                                                                                                                                                                SHA-256:52009B3A55DC0721D7DD70A25C04CC714CE33A954EB2964AC47E527977EECF25
                                                                                                                                                                                                                SHA-512:A246CFAAC9C8D6F21C08EB9CF2F6D311747AF2F67EA6C38D6EE0C8C6CF8C78174425785C3F048038914DE1E93562697E6FEE435AFA5DF7372E0CE43DC67E72A9
                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......b..E&...&...&.../.G."...7U..$...TR..$...7U.."...7U......7U..*...nV..%...&........U..'....U..'....U+.'....U..'...Rich&...........PE..d....H?g.........." ...*..................................................................`......................................... N..`....N..x...............D...................`<.............................. ;..@............................................text............................... ..`.rdata...f.......h..................@..@.data...X$...p.......P..............@....pdata..D............f..............@..@.rsrc................t..............@..@.reloc...............v..............@..B................................................................................................................................................................................................................................................

                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI68642\attrs-24.2.0.dist-info\INSTALLER

                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                Process:C:\Users\user\Desktop\dipwo1iToJ.exe
                                                                                                                                                                                                                File Type:ASCII text
                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                Size (bytes):4
                                                                                                                                                                                                                Entropy (8bit):1.5
                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                SSDEEP:3:Mn:M
                                                                                                                                                                                                                MD5:365C9BFEB7D89244F2CE01C1DE44CB85
                                                                                                                                                                                                                SHA1:D7A03141D5D6B1E88B6B59EF08B6681DF212C599
                                                                                                                                                                                                                SHA-256:CEEBAE7B8927A3227E5303CF5E0F1F7B34BB542AD7250AC03FBCDE36EC2F1508
                                                                                                                                                                                                                SHA-512:D220D322A4053D84130567D626A9F7BB2FB8F0B854DA1621F001826DC61B0ED6D3F91793627E6F0AC2AC27AEA2B986B6A7A63427F05FE004D8A2ADFBDADC13C1
                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                Preview:pip.

                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI68642\attrs-24.2.0.dist-info\METADATA

                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                Process:C:\Users\user\Desktop\dipwo1iToJ.exe
                                                                                                                                                                                                                File Type:Unicode text, UTF-8 text, with very long lines (411)
                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                Size (bytes):11524
                                                                                                                                                                                                                Entropy (8bit):5.211520136058075
                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                SSDEEP:192:ERsUfi6bkQk+k/kKkegToJWicnJsPVA1oz2dv7COmoKTACoEJdQ/0G6lWg+JdQV5:ERsXpLs3VoJWRnJsPvz2dDCHoKsLgA6z
                                                                                                                                                                                                                MD5:49CABCB5F8DA14C72C8C3D00ADB3C115
                                                                                                                                                                                                                SHA1:F575BECF993ECDF9C6E43190C1CB74D3556CF912
                                                                                                                                                                                                                SHA-256:DC9824E25AFD635480A8073038B3CDFE6A56D3073A54E1A6FB21EDD4BB0F207C
                                                                                                                                                                                                                SHA-512:923DAEEE0861611D230DF263577B3C382AE26400CA5F1830EE309BD6737EED2AD934010D61CDD4796618BEDB3436CD772D9429A5BED0A106EF7DE60E114E505C
                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                Preview:Metadata-Version: 2.3.Name: attrs.Version: 24.2.0.Summary: Classes Without Boilerplate.Project-URL: Documentation, https://www.attrs.org/.Project-URL: Changelog, https://www.attrs.org/en/stable/changelog.html.Project-URL: GitHub, https://github.com/python-attrs/attrs.Project-URL: Funding, https://github.com/sponsors/hynek.Project-URL: Tidelift, https://tidelift.com/subscription/pkg/pypi-attrs?utm_source=pypi-attrs&utm_medium=pypi.Author-email: Hynek Schlawack <hs@ox.cx>.License-Expression: MIT.License-File: LICENSE.Keywords: attribute,boilerplate,class.Classifier: Development Status :: 5 - Production/Stable.Classifier: License :: OSI Approved :: MIT License.Classifier: Programming Language :: Python :: 3.7.Classifier: Programming Language :: Python :: 3.8.Classifier: Programming Language :: Python :: 3.9.Classifier: Programming Language :: Python :: 3.10.Classifier: Programming Language :: Python :: 3.11.Classifier: Programming Language :: Python :: 3.12.Classifier: Programming Languag

                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI68642\attrs-24.2.0.dist-info\RECORD

                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                Process:C:\Users\user\Desktop\dipwo1iToJ.exe
                                                                                                                                                                                                                File Type:CSV text
                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                Size (bytes):3556
                                                                                                                                                                                                                Entropy (8bit):5.809424313364516
                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                SSDEEP:96:Q9ewBtnJT/oPynEddwBbCobXm9qGmR5VXzskcGD+qLtxO:2ewnXJCKXGeR/XzKiO
                                                                                                                                                                                                                MD5:4B6973D2285295CF5E3A45E64EB7A455
                                                                                                                                                                                                                SHA1:1089F2F3C35303D6D5DD19F0C0F707B9609EE3F2
                                                                                                                                                                                                                SHA-256:2B368DFC37283970C33CC8D4EEC129F668EB99EBF9D3AA27F49A1B149658F2B0
                                                                                                                                                                                                                SHA-512:A5150ECB625A3CFDC3F22C60EB7B16FDBED01CD47505BD520491B477AE24E8C59FFAE2334948122E656F6F0A5F2AF0635B6D976241745583A3D7AF9E3781718D
                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                Preview:attr/__init__.py,sha256=l8Ewh5KZE7CCY0i1iDfSCnFiUTIkBVoqsXjX9EZnIVA,2087..attr/__init__.pyi,sha256=aTVHBPX6krCGvbQvOl_UKqEzmi2HFsaIVm2WKmAiqVs,11434..attr/__pycache__/__init__.cpython-312.pyc,,..attr/__pycache__/_cmp.cpython-312.pyc,,..attr/__pycache__/_compat.cpython-312.pyc,,..attr/__pycache__/_config.cpython-312.pyc,,..attr/__pycache__/_funcs.cpython-312.pyc,,..attr/__pycache__/_make.cpython-312.pyc,,..attr/__pycache__/_next_gen.cpython-312.pyc,,..attr/__pycache__/_version_info.cpython-312.pyc,,..attr/__pycache__/converters.cpython-312.pyc,,..attr/__pycache__/exceptions.cpython-312.pyc,,..attr/__pycache__/filters.cpython-312.pyc,,..attr/__pycache__/setters.cpython-312.pyc,,..attr/__pycache__/validators.cpython-312.pyc,,..attr/_cmp.py,sha256=3umHiBtgsEYtvNP_8XrQwTCdFoZIX4DEur76N-2a3X8,4123..attr/_cmp.pyi,sha256=U-_RU_UZOyPUEQzXE6RMYQQcjkZRY25wTH99sN0s7MM,368..attr/_compat.py,sha256=n2Uk3c-ywv0PkFfGlvqR7SzDXp4NOhWmNV_ZK6YfWoM,2958..attr/_config.py,sha256=z81Vt-GeT_2taxs1XZfmHx9TWlSxjP

                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI68642\attrs-24.2.0.dist-info\WHEEL

                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                Process:C:\Users\user\Desktop\dipwo1iToJ.exe
                                                                                                                                                                                                                File Type:ASCII text
                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                Size (bytes):87
                                                                                                                                                                                                                Entropy (8bit):4.730668933656452
                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                SSDEEP:3:RtEeXAaCTQnP+tPCCfA5I:Rt2PcnWBB3
                                                                                                                                                                                                                MD5:52ADFA0C417902EE8F0C3D1CA2372AC3
                                                                                                                                                                                                                SHA1:B67635615EEF7E869D74F4813B5DC576104825DD
                                                                                                                                                                                                                SHA-256:D7215D7625CC9AF60AED0613AAD44DB57EBA589D0CCFC3D8122114A0E514C516
                                                                                                                                                                                                                SHA-512:BFA87E7B0E76E544C2108EF40B9FAC8C5FF4327AB8EDE9FEB2891BD5D38FEA117BD9EEBAF62F6C357B4DEADDAD5A5220E0B4A54078C8C2DE34CB1DD5E00F2D62
                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                Preview:Wheel-Version: 1.0.Generator: hatchling 1.25.0.Root-Is-Purelib: true.Tag: py3-none-any.

                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI68642\attrs-24.2.0.dist-info\licenses\LICENSE

                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                Process:C:\Users\user\Desktop\dipwo1iToJ.exe
                                                                                                                                                                                                                File Type:ASCII text
                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                Size (bytes):1109
                                                                                                                                                                                                                Entropy (8bit):5.104415762129373
                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                SSDEEP:24:bGf8rUrmJHHH0yN3gtsHw1hC09QHOsUv4eOk4/+/m3oqLFh:bW8rUaJHlxE3dQHOs5exm3ogFh
                                                                                                                                                                                                                MD5:5E55731824CF9205CFABEAB9A0600887
                                                                                                                                                                                                                SHA1:243E9DD038D3D68C67D42C0C4BA80622C2A56246
                                                                                                                                                                                                                SHA-256:882115C95DFC2AF1EEB6714F8EC6D5CBCABF667CAFF8729F42420DA63F714E9F
                                                                                                                                                                                                                SHA-512:21B242BF6DCBAFA16336D77A40E69685D7E64A43CC30E13E484C72A93CD4496A7276E18137DC601B6A8C3C193CB775DB89853ECC6D6EB2956DEEE36826D5EBFE
                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                Preview:The MIT License (MIT)..Copyright (c) 2015 Hynek Schlawack and the attrs contributors..Permission is hereby granted, free of charge, to any person obtaining a copy.of this software and associated documentation files (the "Software"), to deal.in the Software without restriction, including without limitation the rights.to use, copy, modify, merge, publish, distribute, sublicense, and/or sell.copies of the Software, and to permit persons to whom the Software is.furnished to do so, subject to the following conditions:..The above copyright notice and this permission notice shall be included in all.copies or substantial portions of the Software...THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR.IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,.FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE.AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER.LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHE

                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI68642\base_library.zip

                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                Process:C:\Users\user\Desktop\dipwo1iToJ.exe
                                                                                                                                                                                                                File Type:Zip archive data, at least v2.0 to extract, compression method=store
                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                Size (bytes):1329520
                                                                                                                                                                                                                Entropy (8bit):5.586627513342047
                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                SSDEEP:12288:uttcY+b+2OGgRF1+fYNXPh26UZWAzCu7jqD9KwdgkVDdYuP0whsA9gCCaYchQ:uttcY+PnCiCAqoNqDdYuPVzEaYchQ
                                                                                                                                                                                                                MD5:9B3C32B54CF69405030D2F787FB0C7DF
                                                                                                                                                                                                                SHA1:B2D906EF86EECEB934E84ACA6985599854B70AE1
                                                                                                                                                                                                                SHA-256:7A55058782C4FEBED8EA12B4CAFF9257ED22F22B3E25BA80593E4265A1E099E8
                                                                                                                                                                                                                SHA-512:40ABBAFA11E80E83514DB17342B0271C4FD23C2380EC7BCAE97F318101561EF64F964BAEC7A6D2AD74111572473C6A728277CEBDEA8BDBEC3192D6A0A958A462
                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                Preview:PK..........!.x[_C............_collections_abc.pyc......................................Z.....d.Z.d.d.l.m.Z.m.Z...d.d.l.Z...e.e.e.............Z...e.d.........Z.d...Z...e.e.........Z.[.g.d...Z.d.Z...e...e.d.................Z...e...e...e.........................Z...e...e.i.j%..........................................Z...e...e.i.j)..........................................Z...e...e.i.j-..........................................Z...e...e.g.................Z...e...e...e.g.........................Z...e...e...e.d.........................Z...e...e...e.d.d.z...........................Z...e...e...e.........................Z...e...e.d.................Z ..e...e.d.................Z!..e...e...e"........................Z#..e.i.j%..................................Z$..e.i.j)..................................Z%..e.i.j-..................................Z&..e.e.jN..........................Z(..e...d...................Z)d...Z*..e*........Z*..e.e*........Z+e*jY............................[*d...Z-..e-........

                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI68642\certifi\cacert.pem

                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                Process:C:\Users\user\Desktop\dipwo1iToJ.exe
                                                                                                                                                                                                                File Type:ASCII text
                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                Size (bytes):299427
                                                                                                                                                                                                                Entropy (8bit):6.047872935262006
                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                SSDEEP:6144:QW1x/M8fRR1jplkXURrVADwYCuCigT/QRSRqNb7d8iu5Nahx:QWb/TRJLWURrI5RWavdF08/
                                                                                                                                                                                                                MD5:50EA156B773E8803F6C1FE712F746CBA
                                                                                                                                                                                                                SHA1:2C68212E96605210EDDF740291862BDF59398AEF
                                                                                                                                                                                                                SHA-256:94EDEB66E91774FCAE93A05650914E29096259A5C7E871A1F65D461AB5201B47
                                                                                                                                                                                                                SHA-512:01ED2E7177A99E6CB3FBEF815321B6FA036AD14A3F93499F2CB5B0DAE5B713FD2E6955AA05F6BDA11D80E9E0275040005E5B7D616959B28EFC62ABB43A3238F0
                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                Preview:.# Issuer: CN=GlobalSign Root CA O=GlobalSign nv-sa OU=Root CA.# Subject: CN=GlobalSign Root CA O=GlobalSign nv-sa OU=Root CA.# Label: "GlobalSign Root CA".# Serial: 4835703278459707669005204.# MD5 Fingerprint: 3e:45:52:15:09:51:92:e1:b7:5d:37:9f:b1:87:29:8a.# SHA1 Fingerprint: b1:bc:96:8b:d4:f4:9d:62:2a:a8:9a:81:f2:15:01:52:a4:1d:82:9c.# SHA256 Fingerprint: eb:d4:10:40:e4:bb:3e:c7:42:c9:e3:81:d3:1e:f2:a4:1a:48:b6:68:5c:96:e7:ce:f3:c1:df:6c:d4:33:1c:99.-----BEGIN CERTIFICATE-----.MIIDdTCCAl2gAwIBAgILBAAAAAABFUtaw5QwDQYJKoZIhvcNAQEFBQAwVzELMAkG.A1UEBhMCQkUxGTAXBgNVBAoTEEdsb2JhbFNpZ24gbnYtc2ExEDAOBgNVBAsTB1Jv.b3QgQ0ExGzAZBgNVBAMTEkdsb2JhbFNpZ24gUm9vdCBDQTAeFw05ODA5MDExMjAw.MDBaFw0yODAxMjgxMjAwMDBaMFcxCzAJBgNVBAYTAkJFMRkwFwYDVQQKExBHbG9i.YWxTaWduIG52LXNhMRAwDgYDVQQLEwdSb290IENBMRswGQYDVQQDExJHbG9iYWxT.aWduIFJvb3QgQ0EwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDaDuaZ.jc6j40+Kfvvxi4Mla+pIH/EqsLmVEQS98GPR4mdmzxzdzxtIK+6NiY6arymAZavp.xy0Sy6scTHAHoT0KMM0VjU/43dSMUBUc71DuxC73/OlS8pF94G3VNTCOXkNz

                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI68642\charset_normalizer\md.cp312-win_amd64.pyd

                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                Process:C:\Users\user\Desktop\dipwo1iToJ.exe
                                                                                                                                                                                                                File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                Size (bytes):10752
                                                                                                                                                                                                                Entropy (8bit):4.817893239381772
                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                SSDEEP:192:MRv9XFCk2z1/t12iwU5usJFcCyD9cqgE:aVVC5djuUFJKtgE
                                                                                                                                                                                                                MD5:71D96F1DBFCD6F767D81F8254E572751
                                                                                                                                                                                                                SHA1:E70B74430500ED5117547E0CD339D6E6F4613503
                                                                                                                                                                                                                SHA-256:611E1B4B9ED6788640F550771744D83E404432830BB8E3063F0B8EC3B98911AF
                                                                                                                                                                                                                SHA-512:7B10E13B3723DB0E826B7C7A52090DE999626D5FA6C8F9B4630FDEEF515A58C40660FA90589532A6D4377F003B3CB5B9851E276A0B3C83B9709E28E6A66A1D32
                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........k............r_...........r................................................3..........Rich....................PE..d... $.g.........." ...).....................................................p............`..........................................'..p...`(..d....P.......@...............`..,...`#.............................. "..@............ ...............................text............................... ..`.rdata....... ......................@..@.data........0......."..............@....pdata.......@.......$..............@..@.rsrc........P.......&..............@..@.reloc..,....`.......(..............@..B........................................................................................................................................................................................................................................

                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI68642\charset_normalizer\md__mypyc.cp312-win_amd64.pyd

                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                Process:C:\Users\user\Desktop\dipwo1iToJ.exe
                                                                                                                                                                                                                File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                Size (bytes):124928
                                                                                                                                                                                                                Entropy (8bit):5.935676608756784
                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                SSDEEP:1536:BETt3OiaqGB7QNX6Pq4a461TDqFRgMzrOH+d3gdy2iIeP/j3bhouROm:Bmt+is7QNqP1ab1TGb9g/iI4bhouROm
                                                                                                                                                                                                                MD5:D8F690EAE02332A6898E9C8B983C56DD
                                                                                                                                                                                                                SHA1:112C1FE25E0D948F767E02F291801C0E4AE592F0
                                                                                                                                                                                                                SHA-256:C6BB8CAD80B8D7847C52931F11D73BA64F78615218398B2C058F9B218FF21CA9
                                                                                                                                                                                                                SHA-512:E732F79F39BA9721CC59DBE8C4785FFD74DF84CA00D13D72AFA3F96B97B8C7ADF4EA9344D79EE2A1C77D58EF28D3DDCC855F3CB13EDDA928C17B1158ABCC5B4A
                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........yB....................7...............7.......7.......7.......6..........C....6.......6.......6.......6......Rich............................PE..d....$.g.........." ...).@...........B.......................................0............`.............................................d.................................... ......@...................................@............P...............................text....>.......@.................. ..`.rdata..PY...P...Z...D..............@..@.data....=.......0..................@....pdata..............................@..@.rsrc...............................@..@.reloc....... ......................@..B................................................................................................................................................................................................................................

                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI68642\cryptography-43.0.3.dist-info\INSTALLER

                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                Process:C:\Users\user\Desktop\dipwo1iToJ.exe
                                                                                                                                                                                                                File Type:ASCII text
                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                Size (bytes):4
                                                                                                                                                                                                                Entropy (8bit):1.5
                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                SSDEEP:3:Mn:M
                                                                                                                                                                                                                MD5:365C9BFEB7D89244F2CE01C1DE44CB85
                                                                                                                                                                                                                SHA1:D7A03141D5D6B1E88B6B59EF08B6681DF212C599
                                                                                                                                                                                                                SHA-256:CEEBAE7B8927A3227E5303CF5E0F1F7B34BB542AD7250AC03FBCDE36EC2F1508
                                                                                                                                                                                                                SHA-512:D220D322A4053D84130567D626A9F7BB2FB8F0B854DA1621F001826DC61B0ED6D3F91793627E6F0AC2AC27AEA2B986B6A7A63427F05FE004D8A2ADFBDADC13C1
                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                Preview:pip.

                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI68642\cryptography-43.0.3.dist-info\METADATA

                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                Process:C:\Users\user\Desktop\dipwo1iToJ.exe
                                                                                                                                                                                                                File Type:ASCII text
                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                Size (bytes):5440
                                                                                                                                                                                                                Entropy (8bit):5.074230645519915
                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                SSDEEP:96:DloQIUQIhQIKQILbQIRIaMPktjaVxsxA2TLLDmplH7dwnqTIvrUmA0JQTQCQx5KN:RcPuP1srTLLDmplH7JTIvYX0JQTQ9x54
                                                                                                                                                                                                                MD5:C891CD93024AF027647E6DE89D0FFCE2
                                                                                                                                                                                                                SHA1:01D8D6F93F1B922A91C82D4711BCEFB885AD47B0
                                                                                                                                                                                                                SHA-256:EB36E0E4251E8479EF36964440755EF22BEDD411BA87A93F726FA8E5BB0E64B0
                                                                                                                                                                                                                SHA-512:3386FBB3DCF7383B2D427093624C531C50BE34E3E0AA0984547B953E04776D0D431D5267827F4194A9B0AD1AB897869115623E802A6A1C5D2AE1AD82C96CCE71
                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                Preview:Metadata-Version: 2.3.Name: cryptography.Version: 43.0.3.Classifier: Development Status :: 5 - Production/Stable.Classifier: Intended Audience :: Developers.Classifier: License :: OSI Approved :: Apache Software License.Classifier: License :: OSI Approved :: BSD License.Classifier: Natural Language :: English.Classifier: Operating System :: MacOS :: MacOS X.Classifier: Operating System :: POSIX.Classifier: Operating System :: POSIX :: BSD.Classifier: Operating System :: POSIX :: Linux.Classifier: Operating System :: Microsoft :: Windows.Classifier: Programming Language :: Python.Classifier: Programming Language :: Python :: 3.Classifier: Programming Language :: Python :: 3 :: Only.Classifier: Programming Language :: Python :: 3.7.Classifier: Programming Language :: Python :: 3.8.Classifier: Programming Language :: Python :: 3.9.Classifier: Programming Language :: Python :: 3.10.Classifier: Programming Language :: Python :: 3.11.Classifier: Programming Language :: Python :: 3.12.Classif

                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI68642\cryptography-43.0.3.dist-info\RECORD

                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                Process:C:\Users\user\Desktop\dipwo1iToJ.exe
                                                                                                                                                                                                                File Type:CSV text
                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                Size (bytes):15579
                                                                                                                                                                                                                Entropy (8bit):5.5664904316569785
                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                SSDEEP:192:1XeTBL1z5jF4E9VqhXJZ4WPB6s7B0Ppz+NX6in5Lqw/I+B:1XkL1hCEsJrPB6s7B0Ppz+96innVB
                                                                                                                                                                                                                MD5:4DECFB7B4491D572BFEF7359B48F44FC
                                                                                                                                                                                                                SHA1:A4A4D4BF35021D7402922CA58E1E29AE564524FD
                                                                                                                                                                                                                SHA-256:2538AB429E324FDDEAC70C8C511E24E9FAF5DC8D531D910B1A6FF17C13C5D536
                                                                                                                                                                                                                SHA-512:CE05550E47B778EAB691191A9B08C53F4BE8C3F371C5831B901D17535237A45E46F8362A1BC365DBDEF45FF7AFF475EAA4517FB43F715A4F92481F014EF2E18F
                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                Preview:cryptography-43.0.3.dist-info/INSTALLER,sha256=zuuue4knoyJ-UwPPXg8fezS7VCrXJQrAP7zeNuwvFQg,4..cryptography-43.0.3.dist-info/METADATA,sha256=6zbg5CUehHnvNpZEQHVe8ivt1BG6h6k_cm-o5bsOZLA,5440..cryptography-43.0.3.dist-info/RECORD,,..cryptography-43.0.3.dist-info/REQUESTED,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0..cryptography-43.0.3.dist-info/WHEEL,sha256=8_4EnrLvbhzH224YH8WypoB7HFn-vpbwr_zHlr3XUBI,94..cryptography-43.0.3.dist-info/license_files/LICENSE,sha256=Pgx8CRqUi4JTO6mP18u0BDLW8amsv4X1ki0vmak65rs,197..cryptography-43.0.3.dist-info/license_files/LICENSE.APACHE,sha256=qsc7MUj20dcRHbyjIJn2jSbGRMaBOuHk8F9leaomY_4,11360..cryptography-43.0.3.dist-info/license_files/LICENSE.BSD,sha256=YCxMdILeZHndLpeTzaJ15eY9dz2s0eymiSMqtwCPtPs,1532..cryptography/__about__.py,sha256=-FkHKD9mSuEfH37wsSKnQzJZmL5zUAUTpB5OeUQjPE0,445..cryptography/__init__.py,sha256=mthuUrTd4FROCpUYrTIqhjz6s6T9djAZrV7nZ1oMm2o,364..cryptography/__pycache__/__about__.cpython-312.pyc,,..cryptography/__pycache__/__ini

                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI68642\cryptography-43.0.3.dist-info\WHEEL

                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                Process:C:\Users\user\Desktop\dipwo1iToJ.exe
                                                                                                                                                                                                                File Type:ASCII text
                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                Size (bytes):94
                                                                                                                                                                                                                Entropy (8bit):5.016084900984752
                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                SSDEEP:3:RtEeX5pGogP+tkKciH/KQb:RtvoTWKTQb
                                                                                                                                                                                                                MD5:C869D30012A100ADEB75860F3810C8C9
                                                                                                                                                                                                                SHA1:42FD5CFA75566E8A9525E087A2018E8666ED22CB
                                                                                                                                                                                                                SHA-256:F3FE049EB2EF6E1CC7DB6E181FC5B2A6807B1C59FEBE96F0AFFCC796BDD75012
                                                                                                                                                                                                                SHA-512:B29FEAF6587601BBE0EDAD3DF9A87BFC82BB2C13E91103699BABD7E039F05558C0AC1EF7D904BCFAF85D791B96BC26FA9E39988DD83A1CE8ECCA85029C5109F0
                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                Preview:Wheel-Version: 1.0.Generator: maturin (1.7.0).Root-Is-Purelib: false.Tag: cp39-abi3-win_amd64.

                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI68642\cryptography-43.0.3.dist-info\license_files\LICENSE

                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                Process:C:\Users\user\Desktop\dipwo1iToJ.exe
                                                                                                                                                                                                                File Type:ASCII text
                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                Size (bytes):197
                                                                                                                                                                                                                Entropy (8bit):4.61968998873571
                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                SSDEEP:3:hWDncJhByZmJgXPForADu1QjygQuaAJygT2d5GeWreLRuOFEXAYeBKmJozlMHuO:h9Co8FyQjkDYc5tWreLBF/pn2mH1
                                                                                                                                                                                                                MD5:8C3617DB4FB6FAE01F1D253AB91511E4
                                                                                                                                                                                                                SHA1:E442040C26CD76D1B946822CAF29011A51F75D6D
                                                                                                                                                                                                                SHA-256:3E0C7C091A948B82533BA98FD7CBB40432D6F1A9ACBF85F5922D2F99A93AE6BB
                                                                                                                                                                                                                SHA-512:77A1919E380730BCCE5B55D76FBFFBA2F95874254FAD955BD2FE1DE7FC0E4E25B5FDAAB0FEFFD6F230FA5DC895F593CF8BFEDF8FDC113EFBD8E22FADAB0B8998
                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                Preview:This software is made available under the terms of *either* of the licenses.found in LICENSE.APACHE or LICENSE.BSD. Contributions to cryptography are made.under the terms of *both* these licenses..

                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI68642\cryptography-43.0.3.dist-info\license_files\LICENSE.APACHE

                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                Process:C:\Users\user\Desktop\dipwo1iToJ.exe
                                                                                                                                                                                                                File Type:ASCII text
                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                Size (bytes):11360
                                                                                                                                                                                                                Entropy (8bit):4.426756947907149
                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                SSDEEP:192:nUDG5KXSD9VYUKhu1JVF9hFGvV/QiGkS594drFjuHYx5dvTrLh3kTSEnQHbHR:UIvlKM1zJlFvmNz5VrlkTS0QHt
                                                                                                                                                                                                                MD5:4E168CCE331E5C827D4C2B68A6200E1B
                                                                                                                                                                                                                SHA1:DE33EAD2BEE64352544CE0AA9E410C0C44FDF7D9
                                                                                                                                                                                                                SHA-256:AAC73B3148F6D1D7111DBCA32099F68D26C644C6813AE1E4F05F6579AA2663FE
                                                                                                                                                                                                                SHA-512:F451048E81A49FBFA11B49DE16FF46C52A8E3042D1BCC3A50AAF7712B097BED9AE9AED9149C21476C2A1E12F1583D4810A6D36569E993FE1AD3879942E5B0D52
                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                Preview:. Apache License. Version 2.0, January 2004. https://www.apache.org/licenses/.. TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION.. 1. Definitions... "License" shall mean the terms and conditions for use, reproduction,. and distribution as defined by Sections 1 through 9 of this document... "Licensor" shall mean the copyright owner or entity authorized by. the copyright owner that is granting the License... "Legal Entity" shall mean the union of the acting entity and all. other entities that control, are controlled by, or are under common. control with that entity. For the purposes of this definition,. "control" means (i) the power, direct or indirect, to cause the. direction or management of such entity, whether by contract or. otherwise, or (ii) ownership of fifty percent (50%) or more of the. outstanding shares, or (iii) beneficial ow

                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI68642\cryptography-43.0.3.dist-info\license_files\LICENSE.BSD

                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                Process:C:\Users\user\Desktop\dipwo1iToJ.exe
                                                                                                                                                                                                                File Type:ASCII text
                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                Size (bytes):1532
                                                                                                                                                                                                                Entropy (8bit):5.058591167088024
                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                SSDEEP:24:MjUnoorbOFFTJJyRrYFTjzMbmqEvBTP4m96432s4EOkUTKQROJ32s3yxsITf+3tY:MkOFJSrYJsaN5P406432svv32s3EsIqm
                                                                                                                                                                                                                MD5:5AE30BA4123BC4F2FA49AA0B0DCE887B
                                                                                                                                                                                                                SHA1:EA5B412C09F3B29BA1D81A61B878C5C16FFE69D8
                                                                                                                                                                                                                SHA-256:602C4C7482DE6479DD2E9793CDA275E5E63D773DACD1ECA689232AB7008FB4FB
                                                                                                                                                                                                                SHA-512:DDBB20C80ADBC8F4118C10D3E116A5CD6536F72077C5916D87258E155BE561B89EB45C6341A1E856EC308B49A4CB4DBA1408EABD6A781FBE18D6C71C32B72C41
                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                Preview:Copyright (c) Individual contributors..All rights reserved...Redistribution and use in source and binary forms, with or without.modification, are permitted provided that the following conditions are met:.. 1. Redistributions of source code must retain the above copyright notice,. this list of conditions and the following disclaimer... 2. Redistributions in binary form must reproduce the above copyright. notice, this list of conditions and the following disclaimer in the. documentation and/or other materials provided with the distribution... 3. Neither the name of PyCA Cryptography nor the names of its contributors. may be used to endorse or promote products derived from this software. without specific prior written permission...THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND.ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED.WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOS

                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI68642\cryptography\hazmat\bindings\_rust.pyd

                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                Process:C:\Users\user\Desktop\dipwo1iToJ.exe
                                                                                                                                                                                                                File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                Size (bytes):7834624
                                                                                                                                                                                                                Entropy (8bit):6.517862303223651
                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                SSDEEP:49152:oFNZj7fIo9W67PapgzJTkrXyzNzpXAbuiqCgIns3mYEXEqMrIU6i7GtlqdVwASO/:QI9X/gIFYEXME+oFNr5VQCJheq4BsxH
                                                                                                                                                                                                                MD5:BFD28B03A4C32A9BCB001451FD002F67
                                                                                                                                                                                                                SHA1:DD528FD5F4775E16B2E743D3188B66F1174807B2
                                                                                                                                                                                                                SHA-256:8EF0F404A8BFF12FD6621D8F4F209499613F565777FE1C2A680E8A18F312D5A7
                                                                                                                                                                                                                SHA-512:6DC39638435F147B399826E34F78571D7ED2ED1232275E213A2B020224C0645E379F74A0CA5DE86930D3348981C8BB03BBBECFA601F8BA781417E7114662DDEE
                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......r.b.6...6...6...?..$...&9..4...&9..2...&9..>...&9..'...}...8...Y<..5...6...2...~8..I...6.......~8..7...~8..7...Rich6...........PE..d......g.........." ...)..Y..$........W.......................................w...........`..........................................q.....l.q.............. s...............w......zi.T....................{i.(...Pyi.@.............Y..............................text...k.Y.......Y................. ..`.rdata...A....Y..B....Y.............@..@.data...@+....q.......q.............@....pdata....... s.......r.............@..@.reloc........w.......v.............@..B........................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI68642\frozenlist\_frozenlist.cp312-win_amd64.pyd

                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                Process:C:\Users\user\Desktop\dipwo1iToJ.exe
                                                                                                                                                                                                                File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                Size (bytes):87040
                                                                                                                                                                                                                Entropy (8bit):5.9471652810047235
                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                SSDEEP:1536:NIf505ZC316pwJV0Jzn4pyOJ8RMrpLkFb0GZi8fR3px7F:Q66gFlmrpLkFwGTp3pt
                                                                                                                                                                                                                MD5:5A5BD0B8845F5A47ECFC2C55ABE7413C
                                                                                                                                                                                                                SHA1:D4B2E85D30480573FEFBC413C4F7B81FA67115E1
                                                                                                                                                                                                                SHA-256:8BE6E6CC104018C0DC1AE0694330F44B94FABB6C50EEC086373DDF24117D78A7
                                                                                                                                                                                                                SHA-512:B2C24C3C5D59A4987F36DFCF677227C020BB632B7155E99D7405516BD855B03965F3FC3558E8637DA1B4E65E7EF7C5D2EA33B338BAEAE72F62017ED682D19651
                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........*.5VK.fVK.fVK.f_3DfRK.fF..gTK.f.3.gTK.fF..gUK.fF..g^K.fF..g[K.f...gUK.fVK.f.K.f...gWK.f...gWK.f..(fWK.f...gWK.fRichVK.f........PE..d.....g.........." ...).....v............................................................`..........................................7..h...x7..x............p..(....................&..............................P%..@...............@............................text............................... ..`.rdata...J.......L..................@..@.data...h....P.......6..............@....pdata..(....p.......D..............@..@.rsrc................P..............@..@.reloc...............R..............@..B................................................................................................................................................................................................................................................

                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI68642\libcrypto-3.dll

                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                Process:C:\Users\user\Desktop\dipwo1iToJ.exe
                                                                                                                                                                                                                File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                Size (bytes):5162776
                                                                                                                                                                                                                Entropy (8bit):5.958207976652471
                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                SSDEEP:98304:S3+FRtLtlVriXpshX179Cahd4tC9P1+1CPwDvt3uFlDCi:ASRtLtvd99Cahd4tC9w1CPwDvt3uFlDz
                                                                                                                                                                                                                MD5:51E8A5281C2092E45D8C97FBDBF39560
                                                                                                                                                                                                                SHA1:C499C810ED83AAADCE3B267807E593EC6B121211
                                                                                                                                                                                                                SHA-256:2A234B5AA20C3FAECF725BBB54FB33F3D94543F78FA7045408E905593E49960A
                                                                                                                                                                                                                SHA-512:98B91719B0975CB38D3B3C7B6F820D184EF1B64D38AD8515BE0B8B07730E2272376B9E51631FE9EFD9B8A1709FEA214CF3F77B34EEB9FD282EB09E395120E7CB
                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......./',.kFB.kFB.kFB.b>..yFB..:C.iFB..:G.gFB..:F.cFB..:A.oFB.kFC..FB. >C.`FB.;A.KFB.;F..EB.;B.jFB.;..jFB.;@.jFB.RichkFB.........................PE..d...x..e.........." ...#..6..*......v.........................................O.......O...`.........................................0.G.0.....M.@....0N.|.....K.\.....N../...@N.....PsC.8............................qC.@.............M..............................text...4.6.......6................. ..`.rdata..`.....6.......6.............@..@.data....n....J..<....J.............@....pdata........K.......J.............@..@.idata...%....M..&....M.............@..@.00cfg..u.... N.......M.............@..@.rsrc...|....0N.......M.............@..@.reloc..k....@N.......M.............@..B................................................................................................................................................

                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI68642\libffi-8.dll

                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                Process:C:\Users\user\Desktop\dipwo1iToJ.exe
                                                                                                                                                                                                                File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                Size (bytes):39696
                                                                                                                                                                                                                Entropy (8bit):6.641880464695502
                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                SSDEEP:768:NiQfxQemQJNrPN+moyijAc5YiSyvkIPxWEqG:dfxIQvPkmoyijP7SytPxF
                                                                                                                                                                                                                MD5:0F8E4992CA92BAAF54CC0B43AACCCE21
                                                                                                                                                                                                                SHA1:C7300975DF267B1D6ADCBAC0AC93FD7B1AB49BD2
                                                                                                                                                                                                                SHA-256:EFF52743773EB550FCC6CE3EFC37C85724502233B6B002A35496D828BD7B280A
                                                                                                                                                                                                                SHA-512:6E1B223462DC124279BFCA74FD2C66FE18B368FFBCA540C84E82E0F5BCBEA0E10CC243975574FA95ACE437B9D8B03A446ED5EE0C9B1B094147CEFAF704DFE978
                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........iV...8...8...8..p....8.t9...8.p9...8...9...8.t=...8.t<...8.t;...8.1t<...8.1t;...8.1t8...8.1t:...8.Rich..8.........................PE..d...Sh.c.........." ...".H...(.......L...............................................n....`......................................... l.......p..P...............P....l.../......,...@d...............................c..@............`.. ............................text....G.......H.................. ..`.rdata..h....`.......L..............@..@.data................b..............@....pdata..P............d..............@..@.reloc..,............j..............@..B................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI68642\libssl-3.dll

                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                Process:C:\Users\user\Desktop\dipwo1iToJ.exe
                                                                                                                                                                                                                File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                Size (bytes):790296
                                                                                                                                                                                                                Entropy (8bit):5.607732992846443
                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                SSDEEP:6144:7aO1lo7USZGjweMMHO4+xuVg7gCl2VdhMd1DdwMVn4TERUr3zgKpJJ/wknofFe9A:FkeMKOr97gCAE35gEGzLpwknofFe9XbE
                                                                                                                                                                                                                MD5:BFC834BB2310DDF01BE9AD9CFF7C2A41
                                                                                                                                                                                                                SHA1:FB1D601B4FCB29FF1B13B0D2ED7119BD0472205C
                                                                                                                                                                                                                SHA-256:41AD1A04CA27A7959579E87FBBDA87C93099616A64A0E66260C983381C5570D1
                                                                                                                                                                                                                SHA-512:6AF473C7C0997F2847EBE7CEE8EF67CD682DEE41720D4F268964330B449BA71398FDA8954524F9A97CC4CDF9893B8BDC7A1CF40E9E45A73F4F35A37F31C6A9C3
                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........T..T..T..].3.Z....V......V....X....\....P....W..T..I....e....U.._.U....U..RichT..........PE..d......e.........." ...#.6..........K........................................0.......w....`..........................................w...Q..............s.... ..pM......./......`... ...8...............................@............................................text....4.......6.................. ..`.rdata...y...P...z...:..............@..@.data....N.......H..................@....pdata..XV... ...X..................@..@.idata..bc.......d...T..............@..@.00cfg..u...........................@..@.rsrc...s...........................@..@.reloc..?...........................@..B................................................................................................................................................................

                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI68642\multidict\_multidict.cp312-win_amd64.pyd

                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                Process:C:\Users\user\Desktop\dipwo1iToJ.exe
                                                                                                                                                                                                                File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                Size (bytes):46592
                                                                                                                                                                                                                Entropy (8bit):5.417086235508803
                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                SSDEEP:768:67CE1/NMVzMoCQVbrw0k6To3OOG/B+jPSrSRNj4bSM2V:QruzMoNrNTo3OOG/eRF4be
                                                                                                                                                                                                                MD5:4EED96BBB1C4B6D63F50C433E9C0A16A
                                                                                                                                                                                                                SHA1:CDE34E8F1DAC7F4E98D2B0AAF1186C6938DE06C3
                                                                                                                                                                                                                SHA-256:B521B7E3B6BED424A0719C36735BC4BF2BB8B0926370B31C221C604E81F8D78B
                                                                                                                                                                                                                SHA-512:1CACB250D867FCBBC5224C3F66CB23A93F818BC1D0524CAD6D1C52295D243AF10F454FDE13FA58671D3EE62281A2A3F71A69F28B08FD942FCEDBA3C9B09A774A
                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......v`.2...2...2...;y..0..."...0...yy..0..."...1..."...:..."...9...!...1...2...G...z...3...z...3...z.s.3...z...3...Rich2...................PE..d....}.f.........." ...).\...^...... `....................................................`.............................................d...$...d...............x...............,...................................P...@............p...............................text....[.......\.................. ..`.rdata...+...p...,...`..............@..@.data...."..........................@....pdata..x...........................@..@.rsrc...............................@..@.reloc..,...........................@..B........................................................................................................................................................................................................................................

                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI68642\propcache\_helpers_c.cp312-win_amd64.pyd

                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                Process:C:\Users\user\Desktop\dipwo1iToJ.exe
                                                                                                                                                                                                                File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                Size (bytes):75264
                                                                                                                                                                                                                Entropy (8bit):5.884143909360528
                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                SSDEEP:1536:lqJRuicm7rbNAx366qHC2ajmjZ1mQpheRx/gF:lqJRuiTHpq5qi2amd1XpheRx/gF
                                                                                                                                                                                                                MD5:93CCD2B7284BDC745F1ADBB8F0927F26
                                                                                                                                                                                                                SHA1:30043D4DAD9A909B2D0841D279F5266F00315AD9
                                                                                                                                                                                                                SHA-256:C8C7C9259A47961321B6D913B3CB70215A37B9CFF1DBDE9E9CBC3250C1B5AD77
                                                                                                                                                                                                                SHA-512:1DD365345FF334183A1A4AD959EC07A732836D6F1768E935462F0EA62F24F50EE62FB1324FCD813EF7BC40ED092C33F5D5BF70B8D016B67BE9A9274DAD2868D6
                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........T........?..............................................W.................S.........Rich..........................PE..d...V..g.........." ...).....l...............................................p............`.............................................d.......d....P.......@...............`..T...@...................................@............................................text...H........................... ..`.rdata..*E.......F..................@..@.data........ ......................@....pdata.......@......................@..@.rsrc........P......."..............@..@.reloc..T....`.......$..............@..B................................................................................................................................................................................................................................

                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI68642\psutil\_psutil_windows.pyd

                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                Process:C:\Users\user\Desktop\dipwo1iToJ.exe
                                                                                                                                                                                                                File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                Size (bytes):67072
                                                                                                                                                                                                                Entropy (8bit):5.909456553599775
                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                SSDEEP:1536:j3sHmR02IvVxv7WCyKm7c5Th4JBHTOvyyaZE:jnIvryCyKx5Th4J5OvyyO
                                                                                                                                                                                                                MD5:49AC12A1F10AB93FAFAB064FD0523A63
                                                                                                                                                                                                                SHA1:3AD6923AB0FB5D3DD9D22ED077DB15B42C2FBD4F
                                                                                                                                                                                                                SHA-256:BA033B79E858DBFCBA6BF8FB5AFE10DEFD1CB03957DBBC68E8E62E4DE6DF492D
                                                                                                                                                                                                                SHA-512:1BC0F50E0BB0A9D9DDDAD31390E5C73B0D11C2B0A8C5462065D477E93FF21F7EDC7AA2B2B36E478BE0A797A38F43E3FBEB6AAABEF0BADEC1D8D16EB73DF67255
                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......nT..*5..*5..*5..#M2. 5..x@..(5..x@..&5..x@.."5..x@...5...k..(5..aM..;5..*5...5...@..:5...@..+5...@^.+5...@..+5..Rich*5..................PE..d...._.g.........." .........h......\........................................@............`.........................................0...`.......@.... .......................0..(.......................................8............................................text...h........................... ..`.rdata..\I.......J..................@..@.data...x...........................@....pdata..............................@..@.rsrc........ ......................@..@.reloc..(....0......................@..B........................................................................................................................................................................................................................................

                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI68642\pyexpat.pyd

                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                Process:C:\Users\user\Desktop\dipwo1iToJ.exe
                                                                                                                                                                                                                File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                Size (bytes):200472
                                                                                                                                                                                                                Entropy (8bit):6.382659996286758
                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                SSDEEP:3072:mhaQEuYCUDWuc7VmkqrgVrLJEKAAKJadAT0nIgjWdopPb/+mVApIGLhSZ:yaJh6v7VRVrLJEKAABiuXKd4GE
                                                                                                                                                                                                                MD5:F554064233C082F98EF01195693D967D
                                                                                                                                                                                                                SHA1:F191D42807867E0174DDC66D04C45250D9F6561E
                                                                                                                                                                                                                SHA-256:E1D56FFBF5E5FAB481D7A14691481B8FF5D2F4C6BF5D1A4664C832756C5942FE
                                                                                                                                                                                                                SHA-512:3573A226305CEC45333FC4D0E6FC0C3357421AD77CD8A1899C90515994351292EE5D1C445412B5563AA02520736E870A9EE879909CD992F5BE32E877792BDB88
                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........................g.................................h.......................h.......h.......h.......h.......Rich....................PE..d...Z..e.........." ...#............0...............................................2.....`.............................................P...`............................/..........P4..T............................3..@............ ...............................text.../........................... ..`.rdata..4.... ......................@..@.data...............................@....pdata..............................@..@.rsrc...............................@..@.reloc..............................@..B........................................................................................................................................................................................................................................

                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI68642\python3.dll

                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                Process:C:\Users\user\Desktop\dipwo1iToJ.exe
                                                                                                                                                                                                                File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                Size (bytes):68376
                                                                                                                                                                                                                Entropy (8bit):6.14883904573939
                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                SSDEEP:768:3V1EbYGVXq6KC/prVHBN0cW18itCQDFPnOMFn+gikF/nFX14uewjBcCCC0yamM/J:3DmF61JFn+/OipIGL0m7Sy0xG
                                                                                                                                                                                                                MD5:77896345D4E1C406EEFF011F7A920873
                                                                                                                                                                                                                SHA1:EE8CDD531418CFD05C1A6792382D895AC347216F
                                                                                                                                                                                                                SHA-256:1E9224BA7190B6301EF47BEFA8E383D0C55700255D04A36F7DAC88EA9573F2FB
                                                                                                                                                                                                                SHA-512:3E98B1B605D70244B42A13A219F9E124944DA199A88AD4302308C801685B0C45A037A76DED319D08DBF55639591404665BEFE2091F0F4206A9472FEE58D55C22
                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........C..."e.."e.."e.0_m.."e.0_e.."e.0_..."e.0_g.."e.Rich."e.................PE..d...@..e.........." ...#............................................................q.....`.........................................`...H................................/..............T............................................................................rdata..............................@..@.rsrc...............................@..@........................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI68642\python312.dll

                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                Process:C:\Users\user\Desktop\dipwo1iToJ.exe
                                                                                                                                                                                                                File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                Size (bytes):6972184
                                                                                                                                                                                                                Entropy (8bit):5.774196030396665
                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                SSDEEP:98304:B6vwRS7fYzmSSVlLWyJVT7OQvxHDMiEPlk:8vwRHTSVlfJVmir
                                                                                                                                                                                                                MD5:5C5602CDA7AB8418420F223366FFF5DB
                                                                                                                                                                                                                SHA1:52F81EE0AEF9B6906F7751FD2BBD4953E3F3B798
                                                                                                                                                                                                                SHA-256:E7890E38256F04EE0B55AC5276BBF3AC61392C3A3CE150BB5497B709803E17CE
                                                                                                                                                                                                                SHA-512:51C3B4F29781BB52C137DDB356E1BC5A37F3A25F0ED7D89416B14ED994121F884CB3E40CCDBB211A8989E3BD137B8DF8B28E232F98DE8F35B03965CFCE4B424F
                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......................................................m.................x...s...x......x......x......Rich............PE..d...=..e.........." ...#..(..6B.....l........................................@k.......k...`......................................... .O.......O.......i......``..V...4j../....i..X.. I3.T....................7I.(....G3.@.............(..............................text...V.(.......(................. ..`.rdata...A'...(..B'...(.............@..@.data....4... P..x....O.............@....pdata...V...``..X...v_.............@..@PyRuntim......b.......a.............@....rsrc.........i.......h.............@..@.reloc...X....i..Z....h.............@..B........................................................................................................................................................................................................

                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI68642\pywin32_system32\pywintypes312.dll

                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                Process:C:\Users\user\Desktop\dipwo1iToJ.exe
                                                                                                                                                                                                                File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                Size (bytes):136192
                                                                                                                                                                                                                Entropy (8bit):6.007891413043079
                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                SSDEEP:3072:ZaklTxm5xclSlX8fY/r06Yr0UWm63ELUAXkXrT4:wklTxm5xAhY/rkwNm2E4AXk
                                                                                                                                                                                                                MD5:DA0E290BA30FE8CC1A44EEEFCF090820
                                                                                                                                                                                                                SHA1:D38FCCD7D6F54AA73BD21F168289D7DCE1A9D192
                                                                                                                                                                                                                SHA-256:2D1D60B996D1D5C56C24313D97E0FCDA41A8BD6BF0299F6EA4EB4A1E25D490B7
                                                                                                                                                                                                                SHA-512:BC031D61E5772C60CBAC282D05F76D81AF1AA2A29A8602C2EFA05FC0CE1079390999336237560B408E6539A77C732F5066C1590B7FEAEDB24BAA9371783F2A8F
                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......A.I+.z'x.z'x.z'x...x.z'xW.&y.z'xc..x.z'xW."y.z'xW.#y.z'xW.$y.z'xN.#y.z'xM.&y.z'xN.&y.z'x.z&x.z'x...y.z'x..'y.z'x..%y.z'xRich.z'x................PE..d......g.........." .........................................................`............`.........................................0...lB......,....@..l.... ...............P..0....a..T............................b..8............................................text...I........................... ..`.rdata..(...........................@..@.data....-.......(..................@....pdata....... ......................@..@.rsrc...l....@......................@..@.reloc..0....P......................@..B................................................................................................................................................................................................................................

                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI68642\select.pyd

                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                Process:C:\Users\user\Desktop\dipwo1iToJ.exe
                                                                                                                                                                                                                File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                Size (bytes):31000
                                                                                                                                                                                                                Entropy (8bit):6.531624163477087
                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                SSDEEP:768:s7ENJKHq1vv38pIGQGE5YiSyvTcAMxkEMrX:s7ENJKK1vv38pIGQGO7Syb6xuX
                                                                                                                                                                                                                MD5:BFFFF83A000BAF559F3EB2B599A1B7E8
                                                                                                                                                                                                                SHA1:7F9238BDA6D0C7CC5399C6B6AB3B42D21053F467
                                                                                                                                                                                                                SHA-256:BC71FBDFD1441D62DD86D33FF41B35DC3CC34875F625D885C58C8DC000064DAB
                                                                                                                                                                                                                SHA-512:3C0BA0CF356A727066AE0D0D6523440A882AAFB3EBDF70117993EFFD61395DEEBF179948F8C7F5222D59D1ED748C71D9D53782E16BD2F2ECCC296F2F8B4FC948
                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........t.q|'.q|'.q|'...'.q|'q.}&.q|'q.y&.q|'q.x&.q|'q..&.q|'..}&.q|'.q}'.q|'..}&.q|'..q&.q|'..|&.q|'...'.q|'..~&.q|'Rich.q|'........PE..d...Z..e.........." ...#.....2............................................................`..........................................@..L...,A..x....p.......`.......J.../......L....3..T............................2..@............0...............................text...v........................... ..`.rdata.......0......................@..@.data........P.......8..............@....pdata.......`.......:..............@..@.rsrc........p.......>..............@..@.reloc..L............H..............@..B................................................................................................................................................................................................................................................

                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI68642\setuptools\_vendor\importlib_metadata-8.0.0.dist-info\INSTALLER

                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                Process:C:\Users\user\Desktop\dipwo1iToJ.exe
                                                                                                                                                                                                                File Type:ASCII text
                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                Size (bytes):4
                                                                                                                                                                                                                Entropy (8bit):1.5
                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                SSDEEP:3:Mn:M
                                                                                                                                                                                                                MD5:365C9BFEB7D89244F2CE01C1DE44CB85
                                                                                                                                                                                                                SHA1:D7A03141D5D6B1E88B6B59EF08B6681DF212C599
                                                                                                                                                                                                                SHA-256:CEEBAE7B8927A3227E5303CF5E0F1F7B34BB542AD7250AC03FBCDE36EC2F1508
                                                                                                                                                                                                                SHA-512:D220D322A4053D84130567D626A9F7BB2FB8F0B854DA1621F001826DC61B0ED6D3F91793627E6F0AC2AC27AEA2B986B6A7A63427F05FE004D8A2ADFBDADC13C1
                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                Preview:pip.

                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI68642\setuptools\_vendor\importlib_metadata-8.0.0.dist-info\LICENSE

                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                Process:C:\Users\user\Desktop\dipwo1iToJ.exe
                                                                                                                                                                                                                File Type:ASCII text
                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                Size (bytes):11358
                                                                                                                                                                                                                Entropy (8bit):4.4267168336581415
                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                SSDEEP:192:nU6G5KXSD9VYUKhu1JVF9hFGvV/QiGkS594drFjuHYx5dvTrLh3kTSEn7HbHR:U9vlKM1zJlFvmNz5VrlkTS07Ht
                                                                                                                                                                                                                MD5:3B83EF96387F14655FC854DDC3C6BD57
                                                                                                                                                                                                                SHA1:2B8B815229AA8A61E483FB4BA0588B8B6C491890
                                                                                                                                                                                                                SHA-256:CFC7749B96F63BD31C3C42B5C471BF756814053E847C10F3EB003417BC523D30
                                                                                                                                                                                                                SHA-512:98F6B79B778F7B0A15415BD750C3A8A097D650511CB4EC8115188E115C47053FE700F578895C097051C9BC3DFB6197C2B13A15DE203273E1A3218884F86E90E8
                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                Preview:. Apache License. Version 2.0, January 2004. http://www.apache.org/licenses/.. TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION.. 1. Definitions... "License" shall mean the terms and conditions for use, reproduction,. and distribution as defined by Sections 1 through 9 of this document... "Licensor" shall mean the copyright owner or entity authorized by. the copyright owner that is granting the License... "Legal Entity" shall mean the union of the acting entity and all. other entities that control, are controlled by, or are under common. control with that entity. For the purposes of this definition,. "control" means (i) the power, direct or indirect, to cause the. direction or management of such entity, whether by contract or. otherwise, or (ii) ownership of fifty percent (50%) or more of the. outstanding shares, or (iii) beneficial own

                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI68642\setuptools\_vendor\importlib_metadata-8.0.0.dist-info\METADATA

                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                Process:C:\Users\user\Desktop\dipwo1iToJ.exe
                                                                                                                                                                                                                File Type:ASCII text
                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                Size (bytes):4648
                                                                                                                                                                                                                Entropy (8bit):5.006900644756252
                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                SSDEEP:96:Dx2ZSaCSmS8R902Vpnu386eLQ9Ac+fFZpDN00x2jZ2SBXZJSwTE:9Smzf02Vpnu386mQ9B+TP0vJHJSwTE
                                                                                                                                                                                                                MD5:98ABEAACC0E0E4FC385DFF67B607071A
                                                                                                                                                                                                                SHA1:E8C830D8B0942300C7C87B3B8FD15EA1396E07BD
                                                                                                                                                                                                                SHA-256:6A7B90EFFEE1E09D5B484CDF7232016A43E2D9CC9543BCBB8E494B1EC05E1F59
                                                                                                                                                                                                                SHA-512:F1D59046FFA5B0083A5259CEB03219CCDB8CC6AAC6247250CBD83E70F080784391FCC303F7630E1AD40E5CCF5041A57CB9B68ADEFEC1EBC6C31FCF7FFC65E9B7
                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                Preview:Metadata-Version: 2.1.Name: importlib_metadata.Version: 8.0.0.Summary: Read metadata from Python packages.Author-email: "Jason R. Coombs" <jaraco@jaraco.com>.Project-URL: Source, https://github.com/python/importlib_metadata.Classifier: Development Status :: 5 - Production/Stable.Classifier: Intended Audience :: Developers.Classifier: License :: OSI Approved :: Apache Software License.Classifier: Programming Language :: Python :: 3.Classifier: Programming Language :: Python :: 3 :: Only.Requires-Python: >=3.8.Description-Content-Type: text/x-rst.License-File: LICENSE.Requires-Dist: zipp >=0.5.Requires-Dist: typing-extensions >=3.6.4 ; python_version < "3.8".Provides-Extra: doc.Requires-Dist: sphinx >=3.5 ; extra == 'doc'.Requires-Dist: jaraco.packaging >=9.3 ; extra == 'doc'.Requires-Dist: rst.linker >=1.9 ; extra == 'doc'.Requires-Dist: furo ; extra == 'doc'.Requires-Dist: sphinx-lint ; extra == 'doc'.Requires-Dist: jaraco.tidelift >=1.4 ; extra == 'doc'.Provides-Extra: perf.Requires-D

                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI68642\setuptools\_vendor\importlib_metadata-8.0.0.dist-info\RECORD

                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                Process:C:\Users\user\Desktop\dipwo1iToJ.exe
                                                                                                                                                                                                                File Type:CSV text
                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                Size (bytes):2518
                                                                                                                                                                                                                Entropy (8bit):5.6307766747793275
                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                SSDEEP:48:UnuXTg06U5J/Vw9l/gfNX7/XzBk9pvJq/fwJOfYrBfnJ/V0XJnzN/3WJV:bXzP/EgdzzBkDJsoIYrBfJ/CXNz9qV
                                                                                                                                                                                                                MD5:EB513CAFA5226DDA7D54AFDCC9AD8A74
                                                                                                                                                                                                                SHA1:B394C7AEC158350BAF676AE3197BEF4D7158B31C
                                                                                                                                                                                                                SHA-256:0D8D3C6EEB9EBBE86CAC7D60861552433C329DA9EA51248B61D02BE2E5E64030
                                                                                                                                                                                                                SHA-512:A0017CFAFF47FDA6067E3C31775FACEE4728C3220C2D4BD70DEF328BD20AA71A343E39DA15CD6B406F62311894C518DFCF5C8A4AE6F853946F26A4B4E767924E
                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                Preview:importlib_metadata-8.0.0.dist-info/INSTALLER,sha256=zuuue4knoyJ-UwPPXg8fezS7VCrXJQrAP7zeNuwvFQg,4..importlib_metadata-8.0.0.dist-info/LICENSE,sha256=z8d0m5b2O9McPEK1xHG_dWgUBT6EfBDz6wA0F7xSPTA,11358..importlib_metadata-8.0.0.dist-info/METADATA,sha256=anuQ7_7h4J1bSEzfcjIBakPi2cyVQ7y7jklLHsBeH1k,4648..importlib_metadata-8.0.0.dist-info/RECORD,,..importlib_metadata-8.0.0.dist-info/REQUESTED,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0..importlib_metadata-8.0.0.dist-info/WHEEL,sha256=mguMlWGMX-VHnMpKOjjQidIo1ssRlCFu4a4mBpz1s2M,91..importlib_metadata-8.0.0.dist-info/top_level.txt,sha256=CO3fD9yylANiXkrMo4qHLV_mqXL2sC5JFKgt1yWAT-A,19..importlib_metadata/__init__.py,sha256=tZNB-23h8Bixi9uCrQqj9Yf0aeC--Josdy3IZRIQeB0,33798..importlib_metadata/__pycache__/__init__.cpython-312.pyc,,..importlib_metadata/__pycache__/_adapters.cpython-312.pyc,,..importlib_metadata/__pycache__/_collections.cpython-312.pyc,,..importlib_metadata/__pycache__/_compat.cpython-312.pyc,,..importlib_metadata/__pycac

                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI68642\setuptools\_vendor\importlib_metadata-8.0.0.dist-info\WHEEL

                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                Process:C:\Users\user\Desktop\dipwo1iToJ.exe
                                                                                                                                                                                                                File Type:ASCII text
                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                Size (bytes):91
                                                                                                                                                                                                                Entropy (8bit):4.687870576189661
                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                SSDEEP:3:RtEeXMRYFAVLMvhRRP+tPCCfA5S:RtC1VLMvhjWBBf
                                                                                                                                                                                                                MD5:7D09837492494019EA51F4E97823D79F
                                                                                                                                                                                                                SHA1:7829B4324BB542799494131A270EC3BDAD4DEDEF
                                                                                                                                                                                                                SHA-256:9A0B8C95618C5FE5479CCA4A3A38D089D228D6CB1194216EE1AE26069CF5B363
                                                                                                                                                                                                                SHA-512:A0063220ECDD22C3E735ACFF6DE559ACF3AC4C37B81D37633975A22A28B026F1935CD1957C0FF7D2ECC8B7F83F250310795EECC5273B893FFAB115098F7B9C38
                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                Preview:Wheel-Version: 1.0.Generator: setuptools (70.1.1).Root-Is-Purelib: true.Tag: py3-none-any..

                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI68642\setuptools\_vendor\importlib_metadata-8.0.0.dist-info\top_level.txt

                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                Process:C:\Users\user\Desktop\dipwo1iToJ.exe
                                                                                                                                                                                                                File Type:ASCII text
                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                Size (bytes):19
                                                                                                                                                                                                                Entropy (8bit):3.536886723742169
                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                SSDEEP:3:JSej0EBERG:50o4G
                                                                                                                                                                                                                MD5:A24465F7850BA59507BF86D89165525C
                                                                                                                                                                                                                SHA1:4E61F9264DE74783B5924249BCFE1B06F178B9AD
                                                                                                                                                                                                                SHA-256:08EDDF0FDCB29403625E4ACCA38A872D5FE6A972F6B02E4914A82DD725804FE0
                                                                                                                                                                                                                SHA-512:ECF1F6B777970F5257BDDD353305447083008CEBD8E5A27C3D1DA9C7BDC3F9BF3ABD6881265906D6D5E11992653185C04A522F4DB5655FF75EEDB766F93D5D48
                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                Preview:importlib_metadata.

                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI68642\setuptools\_vendor\jaraco\text\Lorem ipsum.txt

                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                Process:C:\Users\user\Desktop\dipwo1iToJ.exe
                                                                                                                                                                                                                File Type:ASCII text, with very long lines (888)
                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                Size (bytes):1335
                                                                                                                                                                                                                Entropy (8bit):4.226823573023539
                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                SSDEEP:24:FP6Hbz+g9RPZ14bJi04L6GEbX4UQF4UkZQhxI2EIhNyu:9E+i6bJmLm43+Uxxnh0u
                                                                                                                                                                                                                MD5:4CE7501F6608F6CE4011D627979E1AE4
                                                                                                                                                                                                                SHA1:78363672264D9CD3F72D5C1D3665E1657B1A5071
                                                                                                                                                                                                                SHA-256:37FEDCFFBF73C4EB9F058F47677CB33203A436FF9390E4D38A8E01C9DAD28E0B
                                                                                                                                                                                                                SHA-512:A4CDF92725E1D740758DA4DD28DF5D1131F70CEF46946B173FE6956CC0341F019D7C4FECC3C9605F354E1308858721DADA825B4C19F59C5AD1CE01AB84C46B24
                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                Preview:Lorem ipsum dolor sit amet, consectetur adipiscing elit, sed do eiusmod tempor incididunt ut labore et dolore magna aliqua. Ut enim ad minim veniam, quis nostrud exercitation ullamco laboris nisi ut aliquip ex ea commodo consequat. Duis aute irure dolor in reprehenderit in voluptate velit esse cillum dolore eu fugiat nulla pariatur. Excepteur sint occaecat cupidatat non proident, sunt in culpa qui officia deserunt mollit anim id est laborum..Curabitur pretium tincidunt lacus. Nulla gravida orci a odio. Nullam varius, turpis et commodo pharetra, est eros bibendum elit, nec luctus magna felis sollicitudin mauris. Integer in mauris eu nibh euismod gravida. Duis ac tellus et risus vulputate vehicula. Donec lobortis risus a elit. Etiam tempor. Ut ullamcorper, ligula eu tempor congue, eros est euismod turpis, id tincidunt sapien risus a quam. Maecenas fermentum consequat mi. Donec fermentum. Pellentesque malesuada nulla a mi. Duis sapien sem, aliquet nec, commodo eget, consequat quis, neque.

                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI68642\setuptools\_vendor\wheel-0.43.0.dist-info\INSTALLER

                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                Process:C:\Users\user\Desktop\dipwo1iToJ.exe
                                                                                                                                                                                                                File Type:ASCII text
                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                Size (bytes):4
                                                                                                                                                                                                                Entropy (8bit):1.5
                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                SSDEEP:3:Mn:M
                                                                                                                                                                                                                MD5:365C9BFEB7D89244F2CE01C1DE44CB85
                                                                                                                                                                                                                SHA1:D7A03141D5D6B1E88B6B59EF08B6681DF212C599
                                                                                                                                                                                                                SHA-256:CEEBAE7B8927A3227E5303CF5E0F1F7B34BB542AD7250AC03FBCDE36EC2F1508
                                                                                                                                                                                                                SHA-512:D220D322A4053D84130567D626A9F7BB2FB8F0B854DA1621F001826DC61B0ED6D3F91793627E6F0AC2AC27AEA2B986B6A7A63427F05FE004D8A2ADFBDADC13C1
                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                Preview:pip.

                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI68642\setuptools\_vendor\wheel-0.43.0.dist-info\LICENSE.txt

                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                Process:C:\Users\user\Desktop\dipwo1iToJ.exe
                                                                                                                                                                                                                File Type:ASCII text
                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                Size (bytes):1107
                                                                                                                                                                                                                Entropy (8bit):5.115074330424529
                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                SSDEEP:24:PWmrRONJHLH0cPP3gtkHw1h39QHOsUv4eOk4/+jvho3nPz:ttONJbbvE/NQHOs5eNS3n7
                                                                                                                                                                                                                MD5:7FFB0DB04527CFE380E4F2726BD05EBF
                                                                                                                                                                                                                SHA1:5B39C45A91A556E5F1599604F1799E4027FA0E60
                                                                                                                                                                                                                SHA-256:30C23618679108F3E8EA1D2A658C7CA417BDFC891C98EF1A89FA4FF0C9828654
                                                                                                                                                                                                                SHA-512:205F284F3A7E8E696C70ED7B856EE98C1671C68893F0952EEC40915A383BC452B99899BDC401F9FE161A1BF9B6E2CEA3BCD90615EEE9173301657A2CE4BAFE14
                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                Preview:MIT License..Copyright (c) 2012 Daniel Holth <dholth@fastmail.fm> and contributors..Permission is hereby granted, free of charge, to any person obtaining a.copy of this software and associated documentation files (the "Software"),.to deal in the Software without restriction, including without limitation.the rights to use, copy, modify, merge, publish, distribute, sublicense,.and/or sell copies of the Software, and to permit persons to whom the.Software is furnished to do so, subject to the following conditions:..The above copyright notice and this permission notice shall be included.in all copies or substantial portions of the Software...THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR.IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,.FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL.THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR.OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERW

                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI68642\setuptools\_vendor\wheel-0.43.0.dist-info\METADATA

                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                Process:C:\Users\user\Desktop\dipwo1iToJ.exe
                                                                                                                                                                                                                File Type:Unicode text, UTF-8 text
                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                Size (bytes):2153
                                                                                                                                                                                                                Entropy (8bit):5.088249746074878
                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                SSDEEP:48:DEhpFu5MktjaywDK48d+md+7uT8RfkD1UKd+mOl1Awry:DEhpiMktjayq/7kOfsUzmbYy
                                                                                                                                                                                                                MD5:EBEA27DA14E3F453119DC72D84343E8C
                                                                                                                                                                                                                SHA1:7CEB6DBE498B69ABF4087637C6F500742FF7E2B4
                                                                                                                                                                                                                SHA-256:59BAC22B00A59D3E5608A56B8CF8EFC43831A36B72792EE4389C9CD4669C7841
                                                                                                                                                                                                                SHA-512:A41593939B9325D40CB67FD3F41CD1C9E9978F162487FB469094C41440B5F48016B9A66BE2E6E4A0406D6EEDB25CE4F5A860BA1E3DC924B81F63CEEE3AE31117
                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                Preview:Metadata-Version: 2.1.Name: wheel.Version: 0.43.0.Summary: A built-package format for Python.Keywords: wheel,packaging.Author-email: Daniel Holth <dholth@fastmail.fm>.Maintainer-email: Alex Gr.nholm <alex.gronholm@nextday.fi>.Requires-Python: >=3.8.Description-Content-Type: text/x-rst.Classifier: Development Status :: 5 - Production/Stable.Classifier: Intended Audience :: Developers.Classifier: Topic :: System :: Archiving :: Packaging.Classifier: License :: OSI Approved :: MIT License.Classifier: Programming Language :: Python.Classifier: Programming Language :: Python :: 3 :: Only.Classifier: Programming Language :: Python :: 3.8.Classifier: Programming Language :: Python :: 3.9.Classifier: Programming Language :: Python :: 3.10.Classifier: Programming Language :: Python :: 3.11.Classifier: Programming Language :: Python :: 3.12.Requires-Dist: pytest >= 6.0.0 ; extra == "test".Requires-Dist: setuptools >= 65 ; extra == "test".Project-URL: Changelog, https://wheel.readthedocs.io/en/s

                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI68642\setuptools\_vendor\wheel-0.43.0.dist-info\RECORD

                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                Process:C:\Users\user\Desktop\dipwo1iToJ.exe
                                                                                                                                                                                                                File Type:CSV text
                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                Size (bytes):4557
                                                                                                                                                                                                                Entropy (8bit):5.714200636114494
                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                SSDEEP:96:QXVuEmegx01TQIvFCiq9H/H7vp88FxTXiJPkGJP4CWweXQHmnDpMI78IegK5EeZR:QXVxAbYkU4CWweXQHmnDpMeV2BvTRqQF
                                                                                                                                                                                                                MD5:44D352C4997560C7BFB82D9360F5985A
                                                                                                                                                                                                                SHA1:BE58C7B8AB32790384E4E4F20865C4A88414B67A
                                                                                                                                                                                                                SHA-256:783E654742611AF88CD9F00BF01A431A219DB536556E63FF981C7BD673070AC9
                                                                                                                                                                                                                SHA-512:281B1D939A560E6A08D0606E5E8CE15F086B4B45738AB41ED6B5821968DC8D764CD6B25DB6BA562A07018C271ABF17A6BC5A380FAD05696ADF1D11EE2C5749C8
                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                Preview:../../bin/wheel,sha256=cT2EHbrv-J-UyUXu26cDY-0I7RgcruysJeHFanT1Xfo,249..wheel-0.43.0.dist-info/INSTALLER,sha256=zuuue4knoyJ-UwPPXg8fezS7VCrXJQrAP7zeNuwvFQg,4..wheel-0.43.0.dist-info/LICENSE.txt,sha256=MMI2GGeRCPPo6h0qZYx8pBe9_IkcmO8aifpP8MmChlQ,1107..wheel-0.43.0.dist-info/METADATA,sha256=WbrCKwClnT5WCKVrjPjvxDgxo2tyeS7kOJyc1GaceEE,2153..wheel-0.43.0.dist-info/RECORD,,..wheel-0.43.0.dist-info/REQUESTED,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0..wheel-0.43.0.dist-info/WHEEL,sha256=EZbGkh7Ie4PoZfRQ8I0ZuP9VklN_TvcZ6DSE5Uar4z4,81..wheel-0.43.0.dist-info/entry_points.txt,sha256=rTY1BbkPHhkGMm4Q3F0pIzJBzW2kMxoG1oriffvGdA0,104..wheel/__init__.py,sha256=D6jhH00eMzbgrXGAeOwVfD5i-lCAMMycuG1L0useDlo,59..wheel/__main__.py,sha256=NkMUnuTCGcOkgY0IBLgBCVC_BGGcWORx2K8jYGS12UE,455..wheel/__pycache__/__init__.cpython-312.pyc,,..wheel/__pycache__/__main__.cpython-312.pyc,,..wheel/__pycache__/_setuptools_logging.cpython-312.pyc,,..wheel/__pycache__/bdist_wheel.cpython-312.pyc,,..wheel/__pycache

                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI68642\setuptools\_vendor\wheel-0.43.0.dist-info\WHEEL

                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                Process:C:\Users\user\Desktop\dipwo1iToJ.exe
                                                                                                                                                                                                                File Type:ASCII text
                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                Size (bytes):81
                                                                                                                                                                                                                Entropy (8bit):4.672346887071811
                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                SSDEEP:3:RtEeX/QFM+vxP+tPCCfA5I:Rt1Qq2WBB3
                                                                                                                                                                                                                MD5:24019423EA7C0C2DF41C8272A3791E7B
                                                                                                                                                                                                                SHA1:AAE9ECFB44813B68CA525BA7FA0D988615399C86
                                                                                                                                                                                                                SHA-256:1196C6921EC87B83E865F450F08D19B8FF5592537F4EF719E83484E546ABE33E
                                                                                                                                                                                                                SHA-512:09AB8E4DAA9193CFDEE6CF98CCAE9DB0601F3DCD4944D07BF3AE6FA5BCB9DC0DCAFD369DE9A650A38D1B46C758DB0721EBA884446A8A5AD82BB745FD5DB5F9B1
                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                Preview:Wheel-Version: 1.0.Generator: flit 3.9.0.Root-Is-Purelib: true.Tag: py3-none-any.

                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI68642\setuptools\_vendor\wheel-0.43.0.dist-info\entry_points.txt

                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                Process:C:\Users\user\Desktop\dipwo1iToJ.exe
                                                                                                                                                                                                                File Type:ASCII text
                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                Size (bytes):104
                                                                                                                                                                                                                Entropy (8bit):4.271713330022269
                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                SSDEEP:3:1SSAnAYgh+MWTMhk6WjrAM5t5ln:1Jb9WTMhk9jUM5t5ln
                                                                                                                                                                                                                MD5:6180E17C30BAE5B30DB371793FCE0085
                                                                                                                                                                                                                SHA1:E3A12C421562A77D90A13D8539A3A0F4D3228359
                                                                                                                                                                                                                SHA-256:AD363505B90F1E1906326E10DC5D29233241CD6DA4331A06D68AE27DFBC6740D
                                                                                                                                                                                                                SHA-512:69EAE7B1E181D7BA1D3E2864D31E1320625A375E76D3B2FBF8856B3B6515936ACE3138D4D442CABDE7576FCFBCBB0DEED054D90B95CFA1C99829DB12A9031E26
                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                Preview:[console_scripts].wheel=wheel.cli:main..[distutils.commands].bdist_wheel=wheel.bdist_wheel:bdist_wheel..

                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI68642\sqlite3.dll

                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                Process:C:\Users\user\Desktop\dipwo1iToJ.exe
                                                                                                                                                                                                                File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                Size (bytes):1504024
                                                                                                                                                                                                                Entropy (8bit):6.578874733366613
                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                SSDEEP:24576:95WQyUuqjJVKMXijWRwtHHofIyEcL/2m75i5zxHWc9C08lY8ore60hH:9b0yVKMyjWR6nofQm7U59HWKYY8
                                                                                                                                                                                                                MD5:82EA0259009FF75BBA817BD8C15C7588
                                                                                                                                                                                                                SHA1:04C49687D8241B43AE61A6C59299255EF09A7B39
                                                                                                                                                                                                                SHA-256:8AA8B909A39FCC33D1EC2AD51EAC6714A318C6EFD04F963D21B75D8F64809AD6
                                                                                                                                                                                                                SHA-512:1F8B3343898462E385D25E1820A3D7D971D633933E482EA9FFC596E7E1F902F5657A9F2C104CF320EEEF34CCE814261304E2E1C063BE4C6A807ADC9B75F3E670
                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........W..W..W..^.P.[....U....Z...._.....S.....T..W........V.....V....<.V......V..RichW..........................PE..d......e.........." ...#..................................................................`.........................................Px...".............................../...........*..T............................(..@...............8............................text............................... ..`.rdata..............................@..@.data...PG.......>..................@....pdata..............................@..@.rsrc...............................@..@.reloc..............................@..B........................................................................................................................................................................................................................................

                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI68642\unicodedata.pyd

                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                Process:C:\Users\user\Desktop\dipwo1iToJ.exe
                                                                                                                                                                                                                File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                Size (bytes):1137944
                                                                                                                                                                                                                Entropy (8bit):5.462221778372869
                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                SSDEEP:12288:IFrEHdcM6hbZCjJ43w9hIpCQvb0QN8MdIEQ+U2BNNmD+99FfctZq:IFrEXcCjfk7bPNfv42BN6yzUtZq
                                                                                                                                                                                                                MD5:A1388676824CE6347D31D6C6A7A1D1B5
                                                                                                                                                                                                                SHA1:27DD45A5C9B7E61BB894F13193212C6D5668085B
                                                                                                                                                                                                                SHA-256:2480A78815F619A631210E577E733C9BAFECB7F608042E979423C5850EE390FF
                                                                                                                                                                                                                SHA-512:26EA1B33F14F08BB91027E0D35AC03F6203B4DFEEE602BB592C5292AB089B27FF6922DA2804A9E8A28E47D4351B32CF93445D894F00B4AD6E2D0C35C6C7F1D89
                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......w...3m..3m..3m..:...5m......1m......>m......;m......0m......0m..x...1m..3m..cm......2m......2m....j.2m......2m..Rich3m..................PE..d...]..e.........." ...#.>..........`*.......................................p.......%....`.........................................p...X............P.......@.........../...`......P^..T............................]..@............P..p............................text....=.......>.................. ..`.rdata..\....P.......B..............@..@.data...X.... ......................@....pdata.......@......................@..@.rsrc........P......."..............@..@.reloc.......`.......,..............@..B........................................................................................................................................................................................................................................

                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI68642\win32\win32api.pyd

                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                Process:C:\Users\user\Desktop\dipwo1iToJ.exe
                                                                                                                                                                                                                File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                Size (bytes):133632
                                                                                                                                                                                                                Entropy (8bit):5.874056262688227
                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                SSDEEP:3072:LqnAWHjDQCj8ilDiv+zQQoMlRVFhLaNzvvA5sqQvml1RhkmrAte:L1ojDHjllCrMlRVgvY5sqQeRhkmrA
                                                                                                                                                                                                                MD5:E9D8AB0E7867F5E0D40BD474A5CA288C
                                                                                                                                                                                                                SHA1:E7BDF1664099C069CEEA18C2922A8DB049B4399A
                                                                                                                                                                                                                SHA-256:DF724F6ABD66A0549415ABAA3FDF490680E6E0CE07584E964B8BFD01E187B487
                                                                                                                                                                                                                SHA-512:49B17E11D02AE99583F835B8ECF526CF1CF9CEAB5D8FAC0FBFAF45411AC43F0594F93780AE7F6CB3EBBC169A91E81DD57A37C48A8CD5E2653962FFBDCF9879BB
                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........V.........................................+..........................................Rich...........PE..d...!..g.........." .........................................................P............`......................................... ................0..\.......X............@..X....v..T............................;..8............0..........@....................text............................... ..`.rdata..2....0......................@..@.data...X(......."..................@....pdata..X...........................@..@.rsrc...\....0......................@..@.reloc..X....@......................@..B................................................................................................................................................................................................................................................

                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI68642\yarl\_quoting_c.cp312-win_amd64.pyd

                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                Process:C:\Users\user\Desktop\dipwo1iToJ.exe
                                                                                                                                                                                                                File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                Size (bytes):97280
                                                                                                                                                                                                                Entropy (8bit):6.009362786457499
                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                SSDEEP:1536:hA6zeuPEpCbl4DlaAw/AlDNTXBUhF5dYLprRD0WcpipPmlK:hA6jPEUbOwajI5dsOWcpipPe
                                                                                                                                                                                                                MD5:34BEE8FDC3AB28504FE568D886F846DA
                                                                                                                                                                                                                SHA1:C43EE4ADBE83571E17867DD277DD18CB42E1A6B7
                                                                                                                                                                                                                SHA-256:B4C2ADF4BD70A41C0CBB6D1296303AB66169CD52633F514164E755711F0648FB
                                                                                                                                                                                                                SHA-512:1C1013B0EF7D7BA3B01D7CA19A06F808234F3E51C1346AAC57641D2FCC03B4F4E129066D17135F91E56D3092E18FFF77740D4B5E323B5E670ADB8B3E69BDF36C
                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........]..............*.........................................................^.....................F.............Rich............................PE..d....@?g.........." ...*..................................................................`.........................................0X..d....X..x...............................,...0H...............................F..@............ ...............................text............................... ..`.rdata...M... ...N..................@..@.data....6...p.......`..............@....pdata...............l..............@..@.rsrc................x..............@..@.reloc..,............z..............@..B................................................................................................................................................................................................................................

                                                                                                                                                                                                                Static File Info

                                                                                                                                                                                                                General

                                                                                                                                                                                                                File type:PE32+ executable (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                Entropy (8bit):7.996811520130873
                                                                                                                                                                                                                TrID:
                                                                                                                                                                                                                • Win64 Executable GUI (202006/5) 92.65%
                                                                                                                                                                                                                • Win64 Executable (generic) (12005/4) 5.51%
                                                                                                                                                                                                                • Generic Win/DOS Executable (2004/3) 0.92%
                                                                                                                                                                                                                • DOS Executable Generic (2002/1) 0.92%
                                                                                                                                                                                                                • Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
                                                                                                                                                                                                                File name:dipwo1iToJ.exe
                                                                                                                                                                                                                File size:18'082'384 bytes
                                                                                                                                                                                                                MD5:f40d72b602d086c3724048c5df9cc6f0
                                                                                                                                                                                                                SHA1:1cb21b5dda39cc0101e3a140701a670981e562be
                                                                                                                                                                                                                SHA256:d86949ec11d850f940b1ce58eb7a32f1381401fbb27137b6736345ce07ce4501
                                                                                                                                                                                                                SHA512:154001df20640a037c25d07444c495972924fdccda94b80cde2cada595abeb1b0d7659f3d228e97dc07e45af065b74f689c9bc00325e983f03c058c4d5aa3329
                                                                                                                                                                                                                SSDEEP:393216:69Yi54urLe63hucnW+eGQRn9josCBGcZvW7JTXN6u6K2:69Yi5Rr73hrnW+e5Rn9MVa96u6p
                                                                                                                                                                                                                TLSH:51073398E5D85CC1D4B2993FC9E68107DA77FC1117A0CE8B57B9A5A31EA71C04A3EF20
                                                                                                                                                                                                                File Content Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......t=.30\.`0\.`0\.`{$.a7\.`{$.a.\.`{$.a:\.` ..`3\.` ..a9\.` ..a!\.` ..a.\.`{$.a;\.`0\.`.\.`{..a)\.`{..a1\.`Rich0\.`........PE..d..

                                                                                                                                                                                                                File Icon

                                                                                                                                                                                                                Icon Hash:4a464cd47461e179

                                                                                                                                                                                                                Static PE Info

                                                                                                                                                                                                                General

                                                                                                                                                                                                                Entrypoint:0x14000ce20
                                                                                                                                                                                                                Entrypoint Section:.text
                                                                                                                                                                                                                Digitally signed:false
                                                                                                                                                                                                                Imagebase:0x140000000
                                                                                                                                                                                                                Subsystem:windows gui
                                                                                                                                                                                                                Image File Characteristics:EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE
                                                                                                                                                                                                                DLL Characteristics:HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, GUARD_CF, TERMINAL_SERVER_AWARE
                                                                                                                                                                                                                Time Stamp:0x6745D788 [Tue Nov 26 14:13:28 2024 UTC]
                                                                                                                                                                                                                TLS Callbacks:
                                                                                                                                                                                                                CLR (.Net) Version:
                                                                                                                                                                                                                OS Version Major:6
                                                                                                                                                                                                                OS Version Minor:0
                                                                                                                                                                                                                File Version Major:6
                                                                                                                                                                                                                File Version Minor:0
                                                                                                                                                                                                                Subsystem Version Major:6
                                                                                                                                                                                                                Subsystem Version Minor:0
                                                                                                                                                                                                                Import Hash:72c4e339b7af8ab1ed2eb3821c98713a

                                                                                                                                                                                                                Entrypoint Preview

                                                                                                                                                                                                                Instruction
                                                                                                                                                                                                                dec eax
                                                                                                                                                                                                                sub esp, 28h
                                                                                                                                                                                                                call 00007F0BC8B14C4Ch
                                                                                                                                                                                                                dec eax
                                                                                                                                                                                                                add esp, 28h
                                                                                                                                                                                                                jmp 00007F0BC8B1486Fh
                                                                                                                                                                                                                int3
                                                                                                                                                                                                                int3
                                                                                                                                                                                                                int3
                                                                                                                                                                                                                int3
                                                                                                                                                                                                                int3
                                                                                                                                                                                                                int3
                                                                                                                                                                                                                int3
                                                                                                                                                                                                                int3
                                                                                                                                                                                                                int3
                                                                                                                                                                                                                int3
                                                                                                                                                                                                                int3
                                                                                                                                                                                                                int3
                                                                                                                                                                                                                int3
                                                                                                                                                                                                                int3
                                                                                                                                                                                                                dec eax
                                                                                                                                                                                                                sub esp, 28h
                                                                                                                                                                                                                call 00007F0BC8B15018h
                                                                                                                                                                                                                test eax, eax
                                                                                                                                                                                                                je 00007F0BC8B14A13h
                                                                                                                                                                                                                dec eax
                                                                                                                                                                                                                mov eax, dword ptr [00000030h]
                                                                                                                                                                                                                dec eax
                                                                                                                                                                                                                mov ecx, dword ptr [eax+08h]
                                                                                                                                                                                                                jmp 00007F0BC8B149F7h
                                                                                                                                                                                                                dec eax
                                                                                                                                                                                                                cmp ecx, eax
                                                                                                                                                                                                                je 00007F0BC8B14A06h
                                                                                                                                                                                                                xor eax, eax
                                                                                                                                                                                                                dec eax
                                                                                                                                                                                                                cmpxchg dword ptr [0003570Ch], ecx
                                                                                                                                                                                                                jne 00007F0BC8B149E0h
                                                                                                                                                                                                                xor al, al
                                                                                                                                                                                                                dec eax
                                                                                                                                                                                                                add esp, 28h
                                                                                                                                                                                                                ret
                                                                                                                                                                                                                mov al, 01h
                                                                                                                                                                                                                jmp 00007F0BC8B149E9h
                                                                                                                                                                                                                int3
                                                                                                                                                                                                                int3
                                                                                                                                                                                                                int3
                                                                                                                                                                                                                dec eax
                                                                                                                                                                                                                sub esp, 28h
                                                                                                                                                                                                                test ecx, ecx
                                                                                                                                                                                                                jne 00007F0BC8B149F9h
                                                                                                                                                                                                                mov byte ptr [000356F5h], 00000001h
                                                                                                                                                                                                                call 00007F0BC8B14145h
                                                                                                                                                                                                                call 00007F0BC8B15430h
                                                                                                                                                                                                                test al, al
                                                                                                                                                                                                                jne 00007F0BC8B149F6h
                                                                                                                                                                                                                xor al, al
                                                                                                                                                                                                                jmp 00007F0BC8B14A06h
                                                                                                                                                                                                                call 00007F0BC8B21F4Fh
                                                                                                                                                                                                                test al, al
                                                                                                                                                                                                                jne 00007F0BC8B149FBh
                                                                                                                                                                                                                xor ecx, ecx
                                                                                                                                                                                                                call 00007F0BC8B15440h
                                                                                                                                                                                                                jmp 00007F0BC8B149DCh
                                                                                                                                                                                                                mov al, 01h
                                                                                                                                                                                                                dec eax
                                                                                                                                                                                                                add esp, 28h
                                                                                                                                                                                                                ret
                                                                                                                                                                                                                int3
                                                                                                                                                                                                                int3
                                                                                                                                                                                                                inc eax
                                                                                                                                                                                                                push ebx
                                                                                                                                                                                                                dec eax
                                                                                                                                                                                                                sub esp, 20h
                                                                                                                                                                                                                cmp byte ptr [000356BCh], 00000000h
                                                                                                                                                                                                                mov ebx, ecx
                                                                                                                                                                                                                jne 00007F0BC8B14A59h
                                                                                                                                                                                                                cmp ecx, 01h
                                                                                                                                                                                                                jnbe 00007F0BC8B14A5Ch
                                                                                                                                                                                                                call 00007F0BC8B14F8Eh
                                                                                                                                                                                                                test eax, eax
                                                                                                                                                                                                                je 00007F0BC8B14A1Ah
                                                                                                                                                                                                                test ebx, ebx
                                                                                                                                                                                                                jne 00007F0BC8B14A16h
                                                                                                                                                                                                                dec eax
                                                                                                                                                                                                                lea ecx, dword ptr [000356A6h]
                                                                                                                                                                                                                call 00007F0BC8B21D42h

                                                                                                                                                                                                                Data Directories

                                                                                                                                                                                                                NameVirtual AddressVirtual Size Is in Section
                                                                                                                                                                                                                IMAGE_DIRECTORY_ENTRY_EXPORT0x00x0
                                                                                                                                                                                                                IMAGE_DIRECTORY_ENTRY_IMPORT0x3ca340x78.rdata
                                                                                                                                                                                                                IMAGE_DIRECTORY_ENTRY_RESOURCE0x470000xf41c.rsrc
                                                                                                                                                                                                                IMAGE_DIRECTORY_ENTRY_EXCEPTION0x440000x2238.pdata
                                                                                                                                                                                                                IMAGE_DIRECTORY_ENTRY_SECURITY0x00x0
                                                                                                                                                                                                                IMAGE_DIRECTORY_ENTRY_BASERELOC0x570000x764.reloc
                                                                                                                                                                                                                IMAGE_DIRECTORY_ENTRY_DEBUG0x3a0800x1c.rdata
                                                                                                                                                                                                                IMAGE_DIRECTORY_ENTRY_COPYRIGHT0x00x0
                                                                                                                                                                                                                IMAGE_DIRECTORY_ENTRY_GLOBALPTR0x00x0
                                                                                                                                                                                                                IMAGE_DIRECTORY_ENTRY_TLS0x00x0
                                                                                                                                                                                                                IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG0x39f400x140.rdata
                                                                                                                                                                                                                IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT0x00x0
                                                                                                                                                                                                                IMAGE_DIRECTORY_ENTRY_IAT0x2b0000x4a0.rdata
                                                                                                                                                                                                                IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT0x00x0
                                                                                                                                                                                                                IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR0x00x0
                                                                                                                                                                                                                IMAGE_DIRECTORY_ENTRY_RESERVED0x00x0

                                                                                                                                                                                                                Sections

                                                                                                                                                                                                                NameVirtual AddressVirtual SizeRaw SizeMD5Xored PEZLIB ComplexityFile TypeEntropyCharacteristics
                                                                                                                                                                                                                .text0x10000x29f700x2a000b8c3814c5fb0b18492ad4ec2ffe0830aFalse0.5518740699404762data6.489205819736506IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
                                                                                                                                                                                                                .rdata0x2b0000x12a280x12c0019a8c53a63a4b6a7cc35860ab09ee5e1False0.5242838541666667data5.750770753221784IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
                                                                                                                                                                                                                .data0x3e0000x53f80xe00dba0caeecab624a0ccc0d577241601d1False0.134765625data1.8392217063172436IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
                                                                                                                                                                                                                .pdata0x440000x22380x24009cd1eac931545f28ab09329f8bfce843False0.4697265625data5.2645170849678795IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
                                                                                                                                                                                                                .rsrc0x470000xf41c0xf600455788c285fcfdcb4008bc77e762818aFalse0.803099593495935data7.5549760623589695IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
                                                                                                                                                                                                                .reloc0x570000x7640x800816c68eeb419ee2c08656c31c06a0fffFalse0.5576171875data5.2809528666624175IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

                                                                                                                                                                                                                Resources

                                                                                                                                                                                                                NameRVASizeTypeLanguageCountryZLIB Complexity
                                                                                                                                                                                                                RT_ICON0x472080xea8Device independent bitmap graphic, 48 x 96 x 8, image size 00.585820895522388
                                                                                                                                                                                                                RT_ICON0x480b00x8a8Device independent bitmap graphic, 32 x 64 x 8, image size 00.7360108303249098
                                                                                                                                                                                                                RT_ICON0x489580x568Device independent bitmap graphic, 16 x 32 x 8, image size 00.755057803468208
                                                                                                                                                                                                                RT_ICON0x48ec00x952cPNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced0.9975384937676757
                                                                                                                                                                                                                RT_ICON0x523ec0x25a8Device independent bitmap graphic, 48 x 96 x 32, image size 00.3887966804979253
                                                                                                                                                                                                                RT_ICON0x549940x10a8Device independent bitmap graphic, 32 x 64 x 32, image size 00.49530956848030017
                                                                                                                                                                                                                RT_ICON0x55a3c0x468Device independent bitmap graphic, 16 x 32 x 32, image size 00.7207446808510638
                                                                                                                                                                                                                RT_GROUP_ICON0x55ea40x68data0.7019230769230769
                                                                                                                                                                                                                RT_MANIFEST0x55f0c0x50dXML 1.0 document, ASCII text0.4694508894044857

                                                                                                                                                                                                                Imports

                                                                                                                                                                                                                DLLImport
                                                                                                                                                                                                                USER32.dllCreateWindowExW, ShutdownBlockReasonCreate, MsgWaitForMultipleObjects, ShowWindow, DestroyWindow, RegisterClassW, DefWindowProcW, PeekMessageW, DispatchMessageW, TranslateMessage, PostMessageW, GetMessageW, MessageBoxW, MessageBoxA, SystemParametersInfoW, DestroyIcon, SetWindowLongPtrW, GetWindowLongPtrW, GetClientRect, InvalidateRect, ReleaseDC, GetDC, DrawTextW, GetDialogBaseUnits, EndDialog, DialogBoxIndirectParamW, MoveWindow, SendMessageW
                                                                                                                                                                                                                COMCTL32.dll
                                                                                                                                                                                                                KERNEL32.dllGetACP, IsValidCodePage, GetStringTypeW, GetFileAttributesExW, SetEnvironmentVariableW, FlushFileBuffers, GetCurrentDirectoryW, LCMapStringW, CompareStringW, FlsFree, GetOEMCP, GetCPInfo, GetModuleHandleW, MulDiv, FormatMessageW, GetLastError, GetModuleFileNameW, LoadLibraryExW, SetDllDirectoryW, CreateSymbolicLinkW, GetProcAddress, GetEnvironmentStringsW, GetCommandLineW, GetEnvironmentVariableW, ExpandEnvironmentStringsW, DeleteFileW, FindClose, FindFirstFileW, FindNextFileW, GetDriveTypeW, RemoveDirectoryW, GetTempPathW, CloseHandle, QueryPerformanceCounter, QueryPerformanceFrequency, WaitForSingleObject, Sleep, GetCurrentProcess, TerminateProcess, GetExitCodeProcess, CreateProcessW, GetStartupInfoW, FreeLibrary, LocalFree, SetConsoleCtrlHandler, K32EnumProcessModules, K32GetModuleFileNameExW, CreateFileW, FindFirstFileExW, GetFinalPathNameByHandleW, MultiByteToWideChar, WideCharToMultiByte, FlsSetValue, FreeEnvironmentStringsW, GetProcessHeap, GetTimeZoneInformation, HeapSize, HeapReAlloc, WriteConsoleW, SetEndOfFile, CreateDirectoryW, RtlCaptureContext, RtlLookupFunctionEntry, RtlVirtualUnwind, UnhandledExceptionFilter, SetUnhandledExceptionFilter, IsProcessorFeaturePresent, GetCurrentProcessId, GetCurrentThreadId, GetSystemTimeAsFileTime, InitializeSListHead, IsDebuggerPresent, RtlUnwindEx, SetLastError, EnterCriticalSection, LeaveCriticalSection, DeleteCriticalSection, InitializeCriticalSectionAndSpinCount, TlsAlloc, TlsGetValue, TlsSetValue, TlsFree, EncodePointer, RaiseException, RtlPcToFileHeader, GetCommandLineA, GetFileInformationByHandle, GetFileType, PeekNamedPipe, SystemTimeToTzSpecificLocalTime, FileTimeToSystemTime, ReadFile, GetFullPathNameW, SetStdHandle, GetStdHandle, WriteFile, ExitProcess, GetModuleHandleExW, HeapFree, GetConsoleMode, ReadConsoleW, SetFilePointerEx, GetConsoleOutputCP, GetFileSizeEx, HeapAlloc, FlsAlloc, FlsGetValue
                                                                                                                                                                                                                ADVAPI32.dllOpenProcessToken, GetTokenInformation, ConvertStringSecurityDescriptorToSecurityDescriptorW, ConvertSidToStringSidW
                                                                                                                                                                                                                GDI32.dllSelectObject, DeleteObject, CreateFontIndirectW

                                                                                                                                                                                                                Network Behavior

                                                                                                                                                                                                                Network Port Distribution

                                                                                                                                                                                                                TCP Packets

                                                                                                                                                                                                                TimestampSource PortDest PortSource IPDest IP
                                                                                                                                                                                                                Dec 6, 2024 17:45:00.377068043 CET4973180192.168.2.4163.5.242.208
                                                                                                                                                                                                                Dec 6, 2024 17:45:00.496881008 CET8049731163.5.242.208192.168.2.4
                                                                                                                                                                                                                Dec 6, 2024 17:45:00.496962070 CET4973180192.168.2.4163.5.242.208
                                                                                                                                                                                                                Dec 6, 2024 17:45:00.497308016 CET4973180192.168.2.4163.5.242.208
                                                                                                                                                                                                                Dec 6, 2024 17:45:00.618367910 CET8049731163.5.242.208192.168.2.4
                                                                                                                                                                                                                Dec 6, 2024 17:45:01.855582952 CET8049731163.5.242.208192.168.2.4
                                                                                                                                                                                                                Dec 6, 2024 17:45:01.856669903 CET4973180192.168.2.4163.5.242.208
                                                                                                                                                                                                                Dec 6, 2024 17:45:01.858158112 CET4973280192.168.2.4163.5.242.208
                                                                                                                                                                                                                Dec 6, 2024 17:45:01.976953983 CET8049731163.5.242.208192.168.2.4
                                                                                                                                                                                                                Dec 6, 2024 17:45:01.977034092 CET4973180192.168.2.4163.5.242.208
                                                                                                                                                                                                                Dec 6, 2024 17:45:01.977849007 CET8049732163.5.242.208192.168.2.4
                                                                                                                                                                                                                Dec 6, 2024 17:45:01.977921009 CET4973280192.168.2.4163.5.242.208
                                                                                                                                                                                                                Dec 6, 2024 17:45:01.978065014 CET4973280192.168.2.4163.5.242.208
                                                                                                                                                                                                                Dec 6, 2024 17:45:02.098659039 CET8049732163.5.242.208192.168.2.4
                                                                                                                                                                                                                Dec 6, 2024 17:45:03.312829018 CET8049732163.5.242.208192.168.2.4
                                                                                                                                                                                                                Dec 6, 2024 17:45:03.313620090 CET4973280192.168.2.4163.5.242.208
                                                                                                                                                                                                                Dec 6, 2024 17:45:03.435368061 CET8049732163.5.242.208192.168.2.4
                                                                                                                                                                                                                Dec 6, 2024 17:45:03.435441017 CET4973280192.168.2.4163.5.242.208

                                                                                                                                                                                                                HTTP Request Dependency Graph

                                                                                                                                                                                                                • 163.5.242.208

                                                                                                                                                                                                                HTTP Packets

                                                                                                                                                                                                                Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                                                                0192.168.2.449731163.5.242.20880792C:\Users\user\Desktop\dipwo1iToJ.exe
                                                                                                                                                                                                                TimestampBytes transferredDirectionData
                                                                                                                                                                                                                Dec 6, 2024 17:45:00.497308016 CET165OUTGET /bababa31692_token.txt HTTP/1.1
                                                                                                                                                                                                                Host: 163.5.242.208
                                                                                                                                                                                                                User-Agent: python-requests/2.32.3
                                                                                                                                                                                                                Accept-Encoding: gzip, deflate
                                                                                                                                                                                                                Accept: */*
                                                                                                                                                                                                                Connection: keep-alive
                                                                                                                                                                                                                Dec 6, 2024 17:45:01.855582952 CET354INHTTP/1.1 200 OK
                                                                                                                                                                                                                Date: Fri, 06 Dec 2024 16:45:01 GMT
                                                                                                                                                                                                                Server: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.2.12
                                                                                                                                                                                                                Last-Modified: Mon, 25 Nov 2024 18:05:43 GMT
                                                                                                                                                                                                                ETag: "2e-627c094cae5b4"
                                                                                                                                                                                                                Accept-Ranges: bytes
                                                                                                                                                                                                                Content-Length: 46
                                                                                                                                                                                                                Keep-Alive: timeout=5, max=100
                                                                                                                                                                                                                Connection: Keep-Alive
                                                                                                                                                                                                                Content-Type: text/plain
                                                                                                                                                                                                                Data Raw: 38 31 32 34 33 38 33 35 39 31 3a 41 41 45 66 46 72 68 37 4f 37 78 6a 77 61 72 79 47 31 41 43 63 44 4a 79 52 61 48 50 59 4b 48 6b 6a 4c 55
                                                                                                                                                                                                                Data Ascii: 8124383591:AAEfFrh7O7xjwaryG1ACcDJyRaHPYKHkjLU


                                                                                                                                                                                                                Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                                                                1192.168.2.449732163.5.242.20880792C:\Users\user\Desktop\dipwo1iToJ.exe
                                                                                                                                                                                                                TimestampBytes transferredDirectionData
                                                                                                                                                                                                                Dec 6, 2024 17:45:01.978065014 CET163OUTGET /7236785358_chat.txt HTTP/1.1
                                                                                                                                                                                                                Host: 163.5.242.208
                                                                                                                                                                                                                User-Agent: python-requests/2.32.3
                                                                                                                                                                                                                Accept-Encoding: gzip, deflate
                                                                                                                                                                                                                Accept: */*
                                                                                                                                                                                                                Connection: keep-alive
                                                                                                                                                                                                                Dec 6, 2024 17:45:03.312829018 CET318INHTTP/1.1 200 OK
                                                                                                                                                                                                                Date: Fri, 06 Dec 2024 16:45:03 GMT
                                                                                                                                                                                                                Server: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.2.12
                                                                                                                                                                                                                Last-Modified: Wed, 27 Nov 2024 07:02:56 GMT
                                                                                                                                                                                                                ETag: "b-627df8e248257"
                                                                                                                                                                                                                Accept-Ranges: bytes
                                                                                                                                                                                                                Content-Length: 11
                                                                                                                                                                                                                Keep-Alive: timeout=5, max=100
                                                                                                                                                                                                                Connection: Keep-Alive
                                                                                                                                                                                                                Content-Type: text/plain
                                                                                                                                                                                                                Data Raw: 2d 34 35 31 34 34 39 34 35 38 35
                                                                                                                                                                                                                Data Ascii: -4514494585


                                                                                                                                                                                                                Statistics

                                                                                                                                                                                                                CPU Usage

                                                                                                                                                                                                                Click to jump to process

                                                                                                                                                                                                                Memory Usage

                                                                                                                                                                                                                Click to jump to process

                                                                                                                                                                                                                High Level Behavior Distribution

                                                                                                                                                                                                                Click to dive into process behavior distribution

                                                                                                                                                                                                                Behavior

                                                                                                                                                                                                                Click to jump to process

                                                                                                                                                                                                                System Behavior

                                                                                                                                                                                                                General

                                                                                                                                                                                                                Target ID:0
                                                                                                                                                                                                                Start time:11:44:52
                                                                                                                                                                                                                Start date:06/12/2024
                                                                                                                                                                                                                Path:C:\Users\user\Desktop\dipwo1iToJ.exe
                                                                                                                                                                                                                Wow64 process (32bit):false
                                                                                                                                                                                                                Commandline:"C:\Users\user\Desktop\dipwo1iToJ.exe"
                                                                                                                                                                                                                Imagebase:0x7ff6f8fc0000
                                                                                                                                                                                                                File size:18'082'384 bytes
                                                                                                                                                                                                                MD5 hash:F40D72B602D086C3724048C5DF9CC6F0
                                                                                                                                                                                                                Has elevated privileges:true
                                                                                                                                                                                                                Has administrator privileges:true
                                                                                                                                                                                                                Programmed in:C, C++ or other language
                                                                                                                                                                                                                Reputation:low
                                                                                                                                                                                                                Has exited:true

                                                                                                                                                                                                                General

                                                                                                                                                                                                                Target ID:1
                                                                                                                                                                                                                Start time:11:44:55
                                                                                                                                                                                                                Start date:06/12/2024
                                                                                                                                                                                                                Path:C:\Users\user\Desktop\dipwo1iToJ.exe
                                                                                                                                                                                                                Wow64 process (32bit):false
                                                                                                                                                                                                                Commandline:"C:\Users\user\Desktop\dipwo1iToJ.exe"
                                                                                                                                                                                                                Imagebase:0x7ff6f8fc0000
                                                                                                                                                                                                                File size:18'082'384 bytes
                                                                                                                                                                                                                MD5 hash:F40D72B602D086C3724048C5DF9CC6F0
                                                                                                                                                                                                                Has elevated privileges:true
                                                                                                                                                                                                                Has administrator privileges:true
                                                                                                                                                                                                                Programmed in:C, C++ or other language
                                                                                                                                                                                                                Reputation:low
                                                                                                                                                                                                                Has exited:true

                                                                                                                                                                                                                Disassembly

                                                                                                                                                                                                                Reset < >

                                                                                                                                                                                                                  Execution Graph

                                                                                                                                                                                                                  Execution Coverage:10.2%
                                                                                                                                                                                                                  Dynamic/Decrypted Code Coverage:0%
                                                                                                                                                                                                                  Signature Coverage:19.8%
                                                                                                                                                                                                                  Total number of Nodes:2000
                                                                                                                                                                                                                  Total number of Limit Nodes:36
                                                                                                                                                                                                                  execution_graph 20514 7ff6f8fccbc0 20515 7ff6f8fccbd0 20514->20515 20531 7ff6f8fd9c18 20515->20531 20517 7ff6f8fccbdc 20537 7ff6f8fcceb8 20517->20537 20519 7ff6f8fcd19c 7 API calls 20521 7ff6f8fccc75 20519->20521 20520 7ff6f8fccbf4 _RTC_Initialize 20529 7ff6f8fccc49 20520->20529 20542 7ff6f8fcd068 20520->20542 20523 7ff6f8fccc09 20545 7ff6f8fd9084 20523->20545 20529->20519 20530 7ff6f8fccc65 20529->20530 20532 7ff6f8fd9c29 20531->20532 20533 7ff6f8fd9c31 20532->20533 20534 7ff6f8fd4f78 _set_fmode 11 API calls 20532->20534 20533->20517 20535 7ff6f8fd9c40 20534->20535 20536 7ff6f8fda950 _invalid_parameter_noinfo 37 API calls 20535->20536 20536->20533 20538 7ff6f8fccec9 20537->20538 20541 7ff6f8fccece __scrt_acquire_startup_lock 20537->20541 20539 7ff6f8fcd19c 7 API calls 20538->20539 20538->20541 20540 7ff6f8fccf42 20539->20540 20541->20520 20570 7ff6f8fcd02c 20542->20570 20544 7ff6f8fcd071 20544->20523 20546 7ff6f8fccc15 20545->20546 20547 7ff6f8fd90a4 20545->20547 20546->20529 20569 7ff6f8fcd13c InitializeSListHead 20546->20569 20548 7ff6f8fd90c2 GetModuleFileNameW 20547->20548 20549 7ff6f8fd90ac 20547->20549 20553 7ff6f8fd90ed 20548->20553 20550 7ff6f8fd4f78 _set_fmode 11 API calls 20549->20550 20551 7ff6f8fd90b1 20550->20551 20552 7ff6f8fda950 _invalid_parameter_noinfo 37 API calls 20551->20552 20552->20546 20554 7ff6f8fd9024 11 API calls 20553->20554 20555 7ff6f8fd912d 20554->20555 20556 7ff6f8fd9135 20555->20556 20559 7ff6f8fd914d 20555->20559 20557 7ff6f8fd4f78 _set_fmode 11 API calls 20556->20557 20558 7ff6f8fd913a 20557->20558 20561 7ff6f8fda9b8 __free_lconv_num 11 API calls 20558->20561 20560 7ff6f8fd916f 20559->20560 20563 7ff6f8fd91b4 20559->20563 20564 7ff6f8fd919b 20559->20564 20562 7ff6f8fda9b8 __free_lconv_num 11 API calls 20560->20562 20561->20546 20562->20546 20567 7ff6f8fda9b8 __free_lconv_num 11 API calls 20563->20567 20565 7ff6f8fda9b8 __free_lconv_num 11 API calls 20564->20565 20566 7ff6f8fd91a4 20565->20566 20568 7ff6f8fda9b8 __free_lconv_num 11 API calls 20566->20568 20567->20560 20568->20546 20571 7ff6f8fcd046 20570->20571 20573 7ff6f8fcd03f 20570->20573 20574 7ff6f8fda25c 20571->20574 20573->20544 20577 7ff6f8fd9e98 20574->20577 20584 7ff6f8fe0348 EnterCriticalSection 20577->20584 19675 7ff6f8fdb040 19676 7ff6f8fdb045 19675->19676 19680 7ff6f8fdb05a 19675->19680 19681 7ff6f8fdb060 19676->19681 19682 7ff6f8fdb0a2 19681->19682 19683 7ff6f8fdb0aa 19681->19683 19684 7ff6f8fda9b8 __free_lconv_num 11 API calls 19682->19684 19685 7ff6f8fda9b8 __free_lconv_num 11 API calls 19683->19685 19684->19683 19686 7ff6f8fdb0b7 19685->19686 19687 7ff6f8fda9b8 __free_lconv_num 11 API calls 19686->19687 19688 7ff6f8fdb0c4 19687->19688 19689 7ff6f8fda9b8 __free_lconv_num 11 API calls 19688->19689 19690 7ff6f8fdb0d1 19689->19690 19691 7ff6f8fda9b8 __free_lconv_num 11 API calls 19690->19691 19692 7ff6f8fdb0de 19691->19692 19693 7ff6f8fda9b8 __free_lconv_num 11 API calls 19692->19693 19694 7ff6f8fdb0eb 19693->19694 19695 7ff6f8fda9b8 __free_lconv_num 11 API calls 19694->19695 19696 7ff6f8fdb0f8 19695->19696 19697 7ff6f8fda9b8 __free_lconv_num 11 API calls 19696->19697 19698 7ff6f8fdb105 19697->19698 19699 7ff6f8fda9b8 __free_lconv_num 11 API calls 19698->19699 19700 7ff6f8fdb115 19699->19700 19701 7ff6f8fda9b8 __free_lconv_num 11 API calls 19700->19701 19702 7ff6f8fdb125 19701->19702 19707 7ff6f8fdaf04 19702->19707 19721 7ff6f8fe0348 EnterCriticalSection 19707->19721 20585 7ff6f8fd9dc0 20588 7ff6f8fd9d3c 20585->20588 20595 7ff6f8fe0348 EnterCriticalSection 20588->20595 19037 7ff6f8fe0938 19038 7ff6f8fe095c 19037->19038 19040 7ff6f8fe096c 19037->19040 19039 7ff6f8fd4f78 _set_fmode 11 API calls 19038->19039 19061 7ff6f8fe0961 19039->19061 19041 7ff6f8fe0c4c 19040->19041 19042 7ff6f8fe098e 19040->19042 19043 7ff6f8fd4f78 _set_fmode 11 API calls 19041->19043 19044 7ff6f8fe09af 19042->19044 19168 7ff6f8fe0ff4 19042->19168 19045 7ff6f8fe0c51 19043->19045 19048 7ff6f8fe0a21 19044->19048 19050 7ff6f8fe09d5 19044->19050 19055 7ff6f8fe0a15 19044->19055 19047 7ff6f8fda9b8 __free_lconv_num 11 API calls 19045->19047 19047->19061 19052 7ff6f8fdec08 _set_fmode 11 API calls 19048->19052 19066 7ff6f8fe09e4 19048->19066 19049 7ff6f8fe0ace 19060 7ff6f8fe0aeb 19049->19060 19067 7ff6f8fe0b3d 19049->19067 19183 7ff6f8fd9730 19050->19183 19056 7ff6f8fe0a37 19052->19056 19054 7ff6f8fda9b8 __free_lconv_num 11 API calls 19054->19061 19055->19049 19055->19066 19189 7ff6f8fe719c 19055->19189 19062 7ff6f8fda9b8 __free_lconv_num 11 API calls 19056->19062 19058 7ff6f8fe09df 19064 7ff6f8fd4f78 _set_fmode 11 API calls 19058->19064 19059 7ff6f8fe09fd 19059->19055 19069 7ff6f8fe0ff4 45 API calls 19059->19069 19065 7ff6f8fda9b8 __free_lconv_num 11 API calls 19060->19065 19063 7ff6f8fe0a45 19062->19063 19063->19055 19063->19066 19071 7ff6f8fdec08 _set_fmode 11 API calls 19063->19071 19064->19066 19068 7ff6f8fe0af4 19065->19068 19066->19054 19067->19066 19070 7ff6f8fe344c 40 API calls 19067->19070 19079 7ff6f8fe0af9 19068->19079 19225 7ff6f8fe344c 19068->19225 19069->19055 19072 7ff6f8fe0b7a 19070->19072 19073 7ff6f8fe0a67 19071->19073 19074 7ff6f8fda9b8 __free_lconv_num 11 API calls 19072->19074 19076 7ff6f8fda9b8 __free_lconv_num 11 API calls 19073->19076 19077 7ff6f8fe0b84 19074->19077 19076->19055 19077->19066 19077->19079 19078 7ff6f8fe0c40 19081 7ff6f8fda9b8 __free_lconv_num 11 API calls 19078->19081 19079->19078 19083 7ff6f8fdec08 _set_fmode 11 API calls 19079->19083 19080 7ff6f8fe0b25 19082 7ff6f8fda9b8 __free_lconv_num 11 API calls 19080->19082 19081->19061 19082->19079 19084 7ff6f8fe0bc8 19083->19084 19085 7ff6f8fe0bd0 19084->19085 19086 7ff6f8fe0bd9 19084->19086 19087 7ff6f8fda9b8 __free_lconv_num 11 API calls 19085->19087 19088 7ff6f8fda514 __std_exception_copy 37 API calls 19086->19088 19089 7ff6f8fe0bd7 19087->19089 19090 7ff6f8fe0be8 19088->19090 19093 7ff6f8fda9b8 __free_lconv_num 11 API calls 19089->19093 19091 7ff6f8fe0bf0 19090->19091 19092 7ff6f8fe0c7b 19090->19092 19234 7ff6f8fe72b4 19091->19234 19095 7ff6f8fda970 _isindst 17 API calls 19092->19095 19093->19061 19096 7ff6f8fe0c8f 19095->19096 19098 7ff6f8fe0cb8 19096->19098 19105 7ff6f8fe0cc8 19096->19105 19101 7ff6f8fd4f78 _set_fmode 11 API calls 19098->19101 19099 7ff6f8fe0c17 19103 7ff6f8fd4f78 _set_fmode 11 API calls 19099->19103 19100 7ff6f8fe0c38 19102 7ff6f8fda9b8 __free_lconv_num 11 API calls 19100->19102 19130 7ff6f8fe0cbd 19101->19130 19102->19078 19104 7ff6f8fe0c1c 19103->19104 19107 7ff6f8fda9b8 __free_lconv_num 11 API calls 19104->19107 19106 7ff6f8fe0fab 19105->19106 19108 7ff6f8fe0cea 19105->19108 19109 7ff6f8fd4f78 _set_fmode 11 API calls 19106->19109 19107->19089 19110 7ff6f8fe0d07 19108->19110 19253 7ff6f8fe10dc 19108->19253 19111 7ff6f8fe0fb0 19109->19111 19114 7ff6f8fe0d7b 19110->19114 19116 7ff6f8fe0d2f 19110->19116 19124 7ff6f8fe0d6f 19110->19124 19113 7ff6f8fda9b8 __free_lconv_num 11 API calls 19111->19113 19113->19130 19119 7ff6f8fe0da3 19114->19119 19120 7ff6f8fdec08 _set_fmode 11 API calls 19114->19120 19135 7ff6f8fe0d3e 19114->19135 19115 7ff6f8fe0e2e 19128 7ff6f8fe0e4b 19115->19128 19136 7ff6f8fe0e9e 19115->19136 19268 7ff6f8fd976c 19116->19268 19122 7ff6f8fdec08 _set_fmode 11 API calls 19119->19122 19119->19124 19119->19135 19125 7ff6f8fe0d95 19120->19125 19129 7ff6f8fe0dc5 19122->19129 19123 7ff6f8fda9b8 __free_lconv_num 11 API calls 19123->19130 19124->19115 19124->19135 19274 7ff6f8fe705c 19124->19274 19131 7ff6f8fda9b8 __free_lconv_num 11 API calls 19125->19131 19126 7ff6f8fe0d57 19126->19124 19138 7ff6f8fe10dc 45 API calls 19126->19138 19127 7ff6f8fe0d39 19132 7ff6f8fd4f78 _set_fmode 11 API calls 19127->19132 19133 7ff6f8fda9b8 __free_lconv_num 11 API calls 19128->19133 19134 7ff6f8fda9b8 __free_lconv_num 11 API calls 19129->19134 19131->19119 19132->19135 19137 7ff6f8fe0e54 19133->19137 19134->19124 19135->19123 19136->19135 19139 7ff6f8fe344c 40 API calls 19136->19139 19142 7ff6f8fe344c 40 API calls 19137->19142 19145 7ff6f8fe0e5a 19137->19145 19138->19124 19140 7ff6f8fe0edc 19139->19140 19141 7ff6f8fda9b8 __free_lconv_num 11 API calls 19140->19141 19143 7ff6f8fe0ee6 19141->19143 19146 7ff6f8fe0e86 19142->19146 19143->19135 19143->19145 19144 7ff6f8fe0f9f 19148 7ff6f8fda9b8 __free_lconv_num 11 API calls 19144->19148 19145->19144 19149 7ff6f8fdec08 _set_fmode 11 API calls 19145->19149 19147 7ff6f8fda9b8 __free_lconv_num 11 API calls 19146->19147 19147->19145 19148->19130 19150 7ff6f8fe0f2b 19149->19150 19151 7ff6f8fe0f33 19150->19151 19152 7ff6f8fe0f3c 19150->19152 19153 7ff6f8fda9b8 __free_lconv_num 11 API calls 19151->19153 19154 7ff6f8fe04e4 37 API calls 19152->19154 19155 7ff6f8fe0f3a 19153->19155 19156 7ff6f8fe0f4a 19154->19156 19159 7ff6f8fda9b8 __free_lconv_num 11 API calls 19155->19159 19157 7ff6f8fe0f52 SetEnvironmentVariableW 19156->19157 19158 7ff6f8fe0fdf 19156->19158 19160 7ff6f8fe0f97 19157->19160 19161 7ff6f8fe0f76 19157->19161 19162 7ff6f8fda970 _isindst 17 API calls 19158->19162 19159->19130 19164 7ff6f8fda9b8 __free_lconv_num 11 API calls 19160->19164 19165 7ff6f8fd4f78 _set_fmode 11 API calls 19161->19165 19163 7ff6f8fe0ff3 19162->19163 19164->19144 19166 7ff6f8fe0f7b 19165->19166 19167 7ff6f8fda9b8 __free_lconv_num 11 API calls 19166->19167 19167->19155 19169 7ff6f8fe1011 19168->19169 19170 7ff6f8fe1029 19168->19170 19169->19044 19171 7ff6f8fdec08 _set_fmode 11 API calls 19170->19171 19178 7ff6f8fe104d 19171->19178 19172 7ff6f8fe10d2 19174 7ff6f8fda574 __CxxCallCatchBlock 45 API calls 19172->19174 19173 7ff6f8fe10ae 19175 7ff6f8fda9b8 __free_lconv_num 11 API calls 19173->19175 19176 7ff6f8fe10d8 19174->19176 19175->19169 19177 7ff6f8fdec08 _set_fmode 11 API calls 19177->19178 19178->19172 19178->19173 19178->19177 19179 7ff6f8fda9b8 __free_lconv_num 11 API calls 19178->19179 19180 7ff6f8fda514 __std_exception_copy 37 API calls 19178->19180 19181 7ff6f8fe10bd 19178->19181 19179->19178 19180->19178 19182 7ff6f8fda970 _isindst 17 API calls 19181->19182 19182->19172 19184 7ff6f8fd9740 19183->19184 19185 7ff6f8fd9749 19183->19185 19184->19185 19298 7ff6f8fd9208 19184->19298 19185->19058 19185->19059 19190 7ff6f8fe62c4 19189->19190 19191 7ff6f8fe71a9 19189->19191 19192 7ff6f8fe62d1 19190->19192 19198 7ff6f8fe6307 19190->19198 19193 7ff6f8fd4fbc 45 API calls 19191->19193 19196 7ff6f8fd4f78 _set_fmode 11 API calls 19192->19196 19213 7ff6f8fe6278 19192->19213 19194 7ff6f8fe71dd 19193->19194 19199 7ff6f8fe71e2 19194->19199 19203 7ff6f8fe71f3 19194->19203 19207 7ff6f8fe720a 19194->19207 19195 7ff6f8fe6331 19200 7ff6f8fd4f78 _set_fmode 11 API calls 19195->19200 19197 7ff6f8fe62db 19196->19197 19201 7ff6f8fda950 _invalid_parameter_noinfo 37 API calls 19197->19201 19198->19195 19202 7ff6f8fe6356 19198->19202 19199->19055 19204 7ff6f8fe6336 19200->19204 19206 7ff6f8fe62e6 19201->19206 19212 7ff6f8fd4fbc 45 API calls 19202->19212 19216 7ff6f8fe6341 19202->19216 19205 7ff6f8fd4f78 _set_fmode 11 API calls 19203->19205 19208 7ff6f8fda950 _invalid_parameter_noinfo 37 API calls 19204->19208 19209 7ff6f8fe71f8 19205->19209 19206->19055 19210 7ff6f8fe7214 19207->19210 19211 7ff6f8fe7226 19207->19211 19208->19216 19214 7ff6f8fda950 _invalid_parameter_noinfo 37 API calls 19209->19214 19215 7ff6f8fd4f78 _set_fmode 11 API calls 19210->19215 19217 7ff6f8fe724e 19211->19217 19218 7ff6f8fe7237 19211->19218 19212->19216 19213->19055 19214->19199 19219 7ff6f8fe7219 19215->19219 19216->19055 19540 7ff6f8fe8fbc 19217->19540 19531 7ff6f8fe6314 19218->19531 19223 7ff6f8fda950 _invalid_parameter_noinfo 37 API calls 19219->19223 19223->19199 19224 7ff6f8fd4f78 _set_fmode 11 API calls 19224->19199 19226 7ff6f8fe346e 19225->19226 19227 7ff6f8fe348b 19225->19227 19226->19227 19229 7ff6f8fe347c 19226->19229 19228 7ff6f8fe3495 19227->19228 19580 7ff6f8fe7ca8 19227->19580 19587 7ff6f8fe7ce4 19228->19587 19231 7ff6f8fd4f78 _set_fmode 11 API calls 19229->19231 19233 7ff6f8fe3481 __scrt_get_show_window_mode 19231->19233 19233->19080 19235 7ff6f8fd4fbc 45 API calls 19234->19235 19236 7ff6f8fe731a 19235->19236 19238 7ff6f8fe7328 19236->19238 19599 7ff6f8fdef94 19236->19599 19602 7ff6f8fd551c 19238->19602 19241 7ff6f8fe7414 19244 7ff6f8fe7425 19241->19244 19245 7ff6f8fda9b8 __free_lconv_num 11 API calls 19241->19245 19242 7ff6f8fd4fbc 45 API calls 19243 7ff6f8fe7397 19242->19243 19247 7ff6f8fdef94 5 API calls 19243->19247 19249 7ff6f8fe73a0 19243->19249 19246 7ff6f8fe0c13 19244->19246 19248 7ff6f8fda9b8 __free_lconv_num 11 API calls 19244->19248 19245->19244 19246->19099 19246->19100 19247->19249 19248->19246 19250 7ff6f8fd551c 14 API calls 19249->19250 19251 7ff6f8fe73fb 19250->19251 19251->19241 19252 7ff6f8fe7403 SetEnvironmentVariableW 19251->19252 19252->19241 19254 7ff6f8fe10ff 19253->19254 19255 7ff6f8fe111c 19253->19255 19254->19110 19256 7ff6f8fdec08 _set_fmode 11 API calls 19255->19256 19262 7ff6f8fe1140 19256->19262 19257 7ff6f8fe11a1 19259 7ff6f8fda9b8 __free_lconv_num 11 API calls 19257->19259 19258 7ff6f8fda574 __CxxCallCatchBlock 45 API calls 19260 7ff6f8fe11ca 19258->19260 19259->19254 19261 7ff6f8fdec08 _set_fmode 11 API calls 19261->19262 19262->19257 19262->19261 19263 7ff6f8fda9b8 __free_lconv_num 11 API calls 19262->19263 19264 7ff6f8fe04e4 37 API calls 19262->19264 19265 7ff6f8fe11b0 19262->19265 19267 7ff6f8fe11c4 19262->19267 19263->19262 19264->19262 19266 7ff6f8fda970 _isindst 17 API calls 19265->19266 19266->19267 19267->19258 19269 7ff6f8fd9785 19268->19269 19270 7ff6f8fd977c 19268->19270 19269->19126 19269->19127 19270->19269 19624 7ff6f8fd927c 19270->19624 19277 7ff6f8fe7069 19274->19277 19280 7ff6f8fe7096 19274->19280 19275 7ff6f8fe706e 19276 7ff6f8fd4f78 _set_fmode 11 API calls 19275->19276 19279 7ff6f8fe7073 19276->19279 19277->19275 19277->19280 19278 7ff6f8fe70da 19281 7ff6f8fd4f78 _set_fmode 11 API calls 19278->19281 19283 7ff6f8fda950 _invalid_parameter_noinfo 37 API calls 19279->19283 19280->19278 19282 7ff6f8fe70f9 19280->19282 19296 7ff6f8fe70ce __crtLCMapStringW 19280->19296 19284 7ff6f8fe70df 19281->19284 19285 7ff6f8fe7103 19282->19285 19286 7ff6f8fe7115 19282->19286 19287 7ff6f8fe707e 19283->19287 19289 7ff6f8fda950 _invalid_parameter_noinfo 37 API calls 19284->19289 19290 7ff6f8fd4f78 _set_fmode 11 API calls 19285->19290 19288 7ff6f8fd4fbc 45 API calls 19286->19288 19287->19124 19291 7ff6f8fe7122 19288->19291 19289->19296 19292 7ff6f8fe7108 19290->19292 19291->19296 19671 7ff6f8fe8b78 19291->19671 19293 7ff6f8fda950 _invalid_parameter_noinfo 37 API calls 19292->19293 19293->19296 19296->19124 19297 7ff6f8fd4f78 _set_fmode 11 API calls 19297->19296 19299 7ff6f8fd9221 19298->19299 19312 7ff6f8fd921d 19298->19312 19321 7ff6f8fe2660 19299->19321 19304 7ff6f8fd9233 19306 7ff6f8fda9b8 __free_lconv_num 11 API calls 19304->19306 19305 7ff6f8fd923f 19347 7ff6f8fd92ec 19305->19347 19306->19312 19309 7ff6f8fda9b8 __free_lconv_num 11 API calls 19310 7ff6f8fd9266 19309->19310 19311 7ff6f8fda9b8 __free_lconv_num 11 API calls 19310->19311 19311->19312 19312->19185 19313 7ff6f8fd955c 19312->19313 19314 7ff6f8fd9585 19313->19314 19315 7ff6f8fd959e 19313->19315 19314->19185 19315->19314 19316 7ff6f8fdec08 _set_fmode 11 API calls 19315->19316 19317 7ff6f8fd962e 19315->19317 19318 7ff6f8fe0858 WideCharToMultiByte 19315->19318 19320 7ff6f8fda9b8 __free_lconv_num 11 API calls 19315->19320 19316->19315 19319 7ff6f8fda9b8 __free_lconv_num 11 API calls 19317->19319 19318->19315 19319->19314 19320->19315 19322 7ff6f8fe266d 19321->19322 19323 7ff6f8fd9226 19321->19323 19366 7ff6f8fdb294 19322->19366 19327 7ff6f8fe299c GetEnvironmentStringsW 19323->19327 19328 7ff6f8fd922b 19327->19328 19329 7ff6f8fe29cc 19327->19329 19328->19304 19328->19305 19330 7ff6f8fe0858 WideCharToMultiByte 19329->19330 19331 7ff6f8fe2a1d 19330->19331 19332 7ff6f8fe2a24 FreeEnvironmentStringsW 19331->19332 19333 7ff6f8fdd66c _fread_nolock 12 API calls 19331->19333 19332->19328 19334 7ff6f8fe2a37 19333->19334 19335 7ff6f8fe2a3f 19334->19335 19336 7ff6f8fe2a48 19334->19336 19337 7ff6f8fda9b8 __free_lconv_num 11 API calls 19335->19337 19338 7ff6f8fe0858 WideCharToMultiByte 19336->19338 19339 7ff6f8fe2a46 19337->19339 19340 7ff6f8fe2a6b 19338->19340 19339->19332 19341 7ff6f8fe2a6f 19340->19341 19342 7ff6f8fe2a79 19340->19342 19344 7ff6f8fda9b8 __free_lconv_num 11 API calls 19341->19344 19343 7ff6f8fda9b8 __free_lconv_num 11 API calls 19342->19343 19345 7ff6f8fe2a77 FreeEnvironmentStringsW 19343->19345 19344->19345 19345->19328 19348 7ff6f8fd9311 19347->19348 19349 7ff6f8fdec08 _set_fmode 11 API calls 19348->19349 19359 7ff6f8fd9347 19349->19359 19350 7ff6f8fda9b8 __free_lconv_num 11 API calls 19351 7ff6f8fd9247 19350->19351 19351->19309 19352 7ff6f8fd93c2 19353 7ff6f8fda9b8 __free_lconv_num 11 API calls 19352->19353 19353->19351 19354 7ff6f8fdec08 _set_fmode 11 API calls 19354->19359 19355 7ff6f8fd93b1 19525 7ff6f8fd9518 19355->19525 19357 7ff6f8fda514 __std_exception_copy 37 API calls 19357->19359 19359->19352 19359->19354 19359->19355 19359->19357 19361 7ff6f8fd93e7 19359->19361 19362 7ff6f8fd934f 19359->19362 19364 7ff6f8fda9b8 __free_lconv_num 11 API calls 19359->19364 19360 7ff6f8fda9b8 __free_lconv_num 11 API calls 19360->19362 19363 7ff6f8fda970 _isindst 17 API calls 19361->19363 19362->19350 19365 7ff6f8fd93fa 19363->19365 19364->19359 19367 7ff6f8fdb2a5 FlsGetValue 19366->19367 19368 7ff6f8fdb2c0 FlsSetValue 19366->19368 19369 7ff6f8fdb2b2 19367->19369 19370 7ff6f8fdb2ba 19367->19370 19368->19369 19371 7ff6f8fdb2cd 19368->19371 19372 7ff6f8fda574 __CxxCallCatchBlock 45 API calls 19369->19372 19375 7ff6f8fdb2b8 19369->19375 19370->19368 19373 7ff6f8fdec08 _set_fmode 11 API calls 19371->19373 19376 7ff6f8fdb335 19372->19376 19374 7ff6f8fdb2dc 19373->19374 19377 7ff6f8fdb2fa FlsSetValue 19374->19377 19378 7ff6f8fdb2ea FlsSetValue 19374->19378 19386 7ff6f8fe2334 19375->19386 19380 7ff6f8fdb306 FlsSetValue 19377->19380 19381 7ff6f8fdb318 19377->19381 19379 7ff6f8fdb2f3 19378->19379 19382 7ff6f8fda9b8 __free_lconv_num 11 API calls 19379->19382 19380->19379 19383 7ff6f8fdaf64 _set_fmode 11 API calls 19381->19383 19382->19369 19384 7ff6f8fdb320 19383->19384 19385 7ff6f8fda9b8 __free_lconv_num 11 API calls 19384->19385 19385->19375 19409 7ff6f8fe25a4 19386->19409 19388 7ff6f8fe2369 19424 7ff6f8fe2034 19388->19424 19391 7ff6f8fe2386 19391->19323 19392 7ff6f8fdd66c _fread_nolock 12 API calls 19393 7ff6f8fe2397 19392->19393 19394 7ff6f8fe239f 19393->19394 19396 7ff6f8fe23ae 19393->19396 19395 7ff6f8fda9b8 __free_lconv_num 11 API calls 19394->19395 19395->19391 19396->19396 19431 7ff6f8fe26dc 19396->19431 19399 7ff6f8fe24aa 19400 7ff6f8fd4f78 _set_fmode 11 API calls 19399->19400 19401 7ff6f8fe24af 19400->19401 19403 7ff6f8fda9b8 __free_lconv_num 11 API calls 19401->19403 19402 7ff6f8fe2505 19405 7ff6f8fe256c 19402->19405 19442 7ff6f8fe1e64 19402->19442 19403->19391 19404 7ff6f8fe24c4 19404->19402 19407 7ff6f8fda9b8 __free_lconv_num 11 API calls 19404->19407 19406 7ff6f8fda9b8 __free_lconv_num 11 API calls 19405->19406 19406->19391 19407->19402 19410 7ff6f8fe25c7 19409->19410 19412 7ff6f8fe25d1 19410->19412 19457 7ff6f8fe0348 EnterCriticalSection 19410->19457 19414 7ff6f8fe2643 19412->19414 19416 7ff6f8fda574 __CxxCallCatchBlock 45 API calls 19412->19416 19414->19388 19418 7ff6f8fe265b 19416->19418 19420 7ff6f8fe26b2 19418->19420 19421 7ff6f8fdb294 50 API calls 19418->19421 19420->19388 19422 7ff6f8fe269c 19421->19422 19423 7ff6f8fe2334 65 API calls 19422->19423 19423->19420 19425 7ff6f8fd4fbc 45 API calls 19424->19425 19426 7ff6f8fe2048 19425->19426 19427 7ff6f8fe2054 GetOEMCP 19426->19427 19428 7ff6f8fe2066 19426->19428 19430 7ff6f8fe207b 19427->19430 19429 7ff6f8fe206b GetACP 19428->19429 19428->19430 19429->19430 19430->19391 19430->19392 19432 7ff6f8fe2034 47 API calls 19431->19432 19433 7ff6f8fe2709 19432->19433 19434 7ff6f8fe2746 IsValidCodePage 19433->19434 19440 7ff6f8fe285f 19433->19440 19441 7ff6f8fe2760 __scrt_get_show_window_mode 19433->19441 19436 7ff6f8fe2757 19434->19436 19434->19440 19435 7ff6f8fcc5c0 _log10_special 8 API calls 19437 7ff6f8fe24a1 19435->19437 19438 7ff6f8fe2786 GetCPInfo 19436->19438 19436->19441 19437->19399 19437->19404 19438->19440 19438->19441 19440->19435 19458 7ff6f8fe214c 19441->19458 19524 7ff6f8fe0348 EnterCriticalSection 19442->19524 19459 7ff6f8fe2189 GetCPInfo 19458->19459 19468 7ff6f8fe227f 19458->19468 19464 7ff6f8fe219c 19459->19464 19459->19468 19460 7ff6f8fcc5c0 _log10_special 8 API calls 19462 7ff6f8fe231e 19460->19462 19461 7ff6f8fe2eb0 48 API calls 19463 7ff6f8fe2213 19461->19463 19462->19440 19469 7ff6f8fe7bf4 19463->19469 19464->19461 19467 7ff6f8fe7bf4 54 API calls 19467->19468 19468->19460 19470 7ff6f8fd4fbc 45 API calls 19469->19470 19471 7ff6f8fe7c19 19470->19471 19474 7ff6f8fe78c0 19471->19474 19475 7ff6f8fe7901 19474->19475 19476 7ff6f8fdf910 _fread_nolock MultiByteToWideChar 19475->19476 19479 7ff6f8fe794b 19476->19479 19477 7ff6f8fe7bc9 19478 7ff6f8fcc5c0 _log10_special 8 API calls 19477->19478 19480 7ff6f8fe2246 19478->19480 19479->19477 19481 7ff6f8fdd66c _fread_nolock 12 API calls 19479->19481 19482 7ff6f8fe7a81 19479->19482 19484 7ff6f8fe7983 19479->19484 19480->19467 19481->19484 19482->19477 19483 7ff6f8fda9b8 __free_lconv_num 11 API calls 19482->19483 19483->19477 19484->19482 19485 7ff6f8fdf910 _fread_nolock MultiByteToWideChar 19484->19485 19486 7ff6f8fe79f6 19485->19486 19486->19482 19505 7ff6f8fdf154 19486->19505 19489 7ff6f8fe7a92 19491 7ff6f8fdd66c _fread_nolock 12 API calls 19489->19491 19493 7ff6f8fe7b64 19489->19493 19495 7ff6f8fe7ab0 19489->19495 19490 7ff6f8fe7a41 19490->19482 19492 7ff6f8fdf154 __crtLCMapStringW 6 API calls 19490->19492 19491->19495 19492->19482 19493->19482 19494 7ff6f8fda9b8 __free_lconv_num 11 API calls 19493->19494 19494->19482 19495->19482 19496 7ff6f8fdf154 __crtLCMapStringW 6 API calls 19495->19496 19497 7ff6f8fe7b30 19496->19497 19497->19493 19498 7ff6f8fe7b50 19497->19498 19499 7ff6f8fe7b66 19497->19499 19501 7ff6f8fe0858 WideCharToMultiByte 19498->19501 19500 7ff6f8fe0858 WideCharToMultiByte 19499->19500 19502 7ff6f8fe7b5e 19500->19502 19501->19502 19502->19493 19503 7ff6f8fe7b7e 19502->19503 19503->19482 19504 7ff6f8fda9b8 __free_lconv_num 11 API calls 19503->19504 19504->19482 19511 7ff6f8fded80 19505->19511 19509 7ff6f8fdf203 LCMapStringW 19510 7ff6f8fdf19a 19509->19510 19510->19482 19510->19489 19510->19490 19512 7ff6f8fdeddd 19511->19512 19519 7ff6f8fdedd8 __vcrt_InitializeCriticalSectionEx 19511->19519 19512->19510 19521 7ff6f8fdf240 19512->19521 19513 7ff6f8fdee0d LoadLibraryExW 19515 7ff6f8fdeee2 19513->19515 19516 7ff6f8fdee32 GetLastError 19513->19516 19514 7ff6f8fdef02 GetProcAddress 19514->19512 19518 7ff6f8fdef13 19514->19518 19515->19514 19517 7ff6f8fdeef9 FreeLibrary 19515->19517 19516->19519 19517->19514 19518->19512 19519->19512 19519->19513 19519->19514 19520 7ff6f8fdee6c LoadLibraryExW 19519->19520 19520->19515 19520->19519 19522 7ff6f8fded80 __crtLCMapStringW 5 API calls 19521->19522 19523 7ff6f8fdf26e __crtLCMapStringW 19522->19523 19523->19509 19526 7ff6f8fd951d 19525->19526 19527 7ff6f8fd93b9 19525->19527 19528 7ff6f8fd9546 19526->19528 19530 7ff6f8fda9b8 __free_lconv_num 11 API calls 19526->19530 19527->19360 19529 7ff6f8fda9b8 __free_lconv_num 11 API calls 19528->19529 19529->19527 19530->19526 19532 7ff6f8fe6331 19531->19532 19533 7ff6f8fe6348 19531->19533 19534 7ff6f8fd4f78 _set_fmode 11 API calls 19532->19534 19533->19532 19535 7ff6f8fe6356 19533->19535 19536 7ff6f8fe6336 19534->19536 19538 7ff6f8fd4fbc 45 API calls 19535->19538 19539 7ff6f8fe6341 19535->19539 19537 7ff6f8fda950 _invalid_parameter_noinfo 37 API calls 19536->19537 19537->19539 19538->19539 19539->19199 19541 7ff6f8fd4fbc 45 API calls 19540->19541 19542 7ff6f8fe8fe1 19541->19542 19545 7ff6f8fe8c38 19542->19545 19548 7ff6f8fe8c86 19545->19548 19546 7ff6f8fcc5c0 _log10_special 8 API calls 19547 7ff6f8fe7275 19546->19547 19547->19199 19547->19224 19549 7ff6f8fe8d0d 19548->19549 19551 7ff6f8fe8cf8 GetCPInfo 19548->19551 19554 7ff6f8fe8d11 19548->19554 19550 7ff6f8fdf910 _fread_nolock MultiByteToWideChar 19549->19550 19549->19554 19552 7ff6f8fe8da5 19550->19552 19551->19549 19551->19554 19553 7ff6f8fdd66c _fread_nolock 12 API calls 19552->19553 19552->19554 19555 7ff6f8fe8ddc 19552->19555 19553->19555 19554->19546 19555->19554 19556 7ff6f8fdf910 _fread_nolock MultiByteToWideChar 19555->19556 19557 7ff6f8fe8e4a 19556->19557 19558 7ff6f8fe8f2c 19557->19558 19559 7ff6f8fdf910 _fread_nolock MultiByteToWideChar 19557->19559 19558->19554 19560 7ff6f8fda9b8 __free_lconv_num 11 API calls 19558->19560 19561 7ff6f8fe8e70 19559->19561 19560->19554 19561->19558 19562 7ff6f8fdd66c _fread_nolock 12 API calls 19561->19562 19563 7ff6f8fe8e9d 19561->19563 19562->19563 19563->19558 19564 7ff6f8fdf910 _fread_nolock MultiByteToWideChar 19563->19564 19565 7ff6f8fe8f14 19564->19565 19566 7ff6f8fe8f34 19565->19566 19567 7ff6f8fe8f1a 19565->19567 19574 7ff6f8fdefd8 19566->19574 19567->19558 19570 7ff6f8fda9b8 __free_lconv_num 11 API calls 19567->19570 19570->19558 19571 7ff6f8fe8f73 19571->19554 19573 7ff6f8fda9b8 __free_lconv_num 11 API calls 19571->19573 19572 7ff6f8fda9b8 __free_lconv_num 11 API calls 19572->19571 19573->19554 19575 7ff6f8fded80 __crtLCMapStringW 5 API calls 19574->19575 19576 7ff6f8fdf016 19575->19576 19577 7ff6f8fdf240 __crtLCMapStringW 5 API calls 19576->19577 19578 7ff6f8fdf01e 19576->19578 19579 7ff6f8fdf087 CompareStringW 19577->19579 19578->19571 19578->19572 19579->19578 19581 7ff6f8fe7cb1 19580->19581 19582 7ff6f8fe7cca HeapSize 19580->19582 19583 7ff6f8fd4f78 _set_fmode 11 API calls 19581->19583 19584 7ff6f8fe7cb6 19583->19584 19585 7ff6f8fda950 _invalid_parameter_noinfo 37 API calls 19584->19585 19586 7ff6f8fe7cc1 19585->19586 19586->19228 19588 7ff6f8fe7d03 19587->19588 19589 7ff6f8fe7cf9 19587->19589 19590 7ff6f8fe7d08 19588->19590 19597 7ff6f8fe7d0f _set_fmode 19588->19597 19591 7ff6f8fdd66c _fread_nolock 12 API calls 19589->19591 19592 7ff6f8fda9b8 __free_lconv_num 11 API calls 19590->19592 19595 7ff6f8fe7d01 19591->19595 19592->19595 19593 7ff6f8fe7d42 HeapReAlloc 19593->19595 19593->19597 19594 7ff6f8fe7d15 19596 7ff6f8fd4f78 _set_fmode 11 API calls 19594->19596 19595->19233 19596->19595 19597->19593 19597->19594 19598 7ff6f8fe3600 _set_fmode 2 API calls 19597->19598 19598->19597 19600 7ff6f8fded80 __crtLCMapStringW 5 API calls 19599->19600 19601 7ff6f8fdefb4 19600->19601 19601->19238 19603 7ff6f8fd556a 19602->19603 19604 7ff6f8fd5546 19602->19604 19605 7ff6f8fd55c4 19603->19605 19606 7ff6f8fd556f 19603->19606 19608 7ff6f8fda9b8 __free_lconv_num 11 API calls 19604->19608 19609 7ff6f8fd5555 19604->19609 19607 7ff6f8fdf910 _fread_nolock MultiByteToWideChar 19605->19607 19606->19609 19611 7ff6f8fda9b8 __free_lconv_num 11 API calls 19606->19611 19616 7ff6f8fd5584 19606->19616 19614 7ff6f8fd55e0 19607->19614 19608->19609 19609->19241 19609->19242 19610 7ff6f8fd55e7 GetLastError 19613 7ff6f8fd4eec _fread_nolock 11 API calls 19610->19613 19611->19616 19612 7ff6f8fdd66c _fread_nolock 12 API calls 19612->19609 19618 7ff6f8fd55f4 19613->19618 19614->19610 19615 7ff6f8fd5622 19614->19615 19619 7ff6f8fd5615 19614->19619 19622 7ff6f8fda9b8 __free_lconv_num 11 API calls 19614->19622 19615->19609 19617 7ff6f8fdf910 _fread_nolock MultiByteToWideChar 19615->19617 19616->19612 19620 7ff6f8fd5666 19617->19620 19621 7ff6f8fd4f78 _set_fmode 11 API calls 19618->19621 19623 7ff6f8fdd66c _fread_nolock 12 API calls 19619->19623 19620->19609 19620->19610 19621->19609 19622->19619 19623->19615 19625 7ff6f8fd9295 19624->19625 19626 7ff6f8fd9291 19624->19626 19645 7ff6f8fe2aac GetEnvironmentStringsW 19625->19645 19626->19269 19637 7ff6f8fd963c 19626->19637 19629 7ff6f8fd92a2 19631 7ff6f8fda9b8 __free_lconv_num 11 API calls 19629->19631 19630 7ff6f8fd92ae 19652 7ff6f8fd93fc 19630->19652 19631->19626 19634 7ff6f8fda9b8 __free_lconv_num 11 API calls 19635 7ff6f8fd92d5 19634->19635 19636 7ff6f8fda9b8 __free_lconv_num 11 API calls 19635->19636 19636->19626 19638 7ff6f8fd965f 19637->19638 19641 7ff6f8fd9676 19637->19641 19638->19269 19639 7ff6f8fdf910 MultiByteToWideChar _fread_nolock 19639->19641 19640 7ff6f8fdec08 _set_fmode 11 API calls 19640->19641 19641->19638 19641->19639 19641->19640 19642 7ff6f8fd96ea 19641->19642 19644 7ff6f8fda9b8 __free_lconv_num 11 API calls 19641->19644 19643 7ff6f8fda9b8 __free_lconv_num 11 API calls 19642->19643 19643->19638 19644->19641 19646 7ff6f8fd929a 19645->19646 19647 7ff6f8fe2ad0 19645->19647 19646->19629 19646->19630 19648 7ff6f8fdd66c _fread_nolock 12 API calls 19647->19648 19649 7ff6f8fe2b07 memcpy_s 19648->19649 19650 7ff6f8fda9b8 __free_lconv_num 11 API calls 19649->19650 19651 7ff6f8fe2b27 FreeEnvironmentStringsW 19650->19651 19651->19646 19653 7ff6f8fd9424 19652->19653 19654 7ff6f8fdec08 _set_fmode 11 API calls 19653->19654 19667 7ff6f8fd945f 19654->19667 19655 7ff6f8fd9467 19656 7ff6f8fda9b8 __free_lconv_num 11 API calls 19655->19656 19657 7ff6f8fd92b6 19656->19657 19657->19634 19658 7ff6f8fd94e1 19659 7ff6f8fda9b8 __free_lconv_num 11 API calls 19658->19659 19659->19657 19660 7ff6f8fdec08 _set_fmode 11 API calls 19660->19667 19661 7ff6f8fd94d0 19662 7ff6f8fd9518 11 API calls 19661->19662 19664 7ff6f8fd94d8 19662->19664 19663 7ff6f8fe04e4 37 API calls 19663->19667 19665 7ff6f8fda9b8 __free_lconv_num 11 API calls 19664->19665 19665->19655 19666 7ff6f8fd9504 19668 7ff6f8fda970 _isindst 17 API calls 19666->19668 19667->19655 19667->19658 19667->19660 19667->19661 19667->19663 19667->19666 19669 7ff6f8fda9b8 __free_lconv_num 11 API calls 19667->19669 19670 7ff6f8fd9516 19668->19670 19669->19667 19672 7ff6f8fe8ba1 __crtLCMapStringW 19671->19672 19673 7ff6f8fdefd8 6 API calls 19672->19673 19674 7ff6f8fe715e 19672->19674 19673->19674 19674->19296 19674->19297 19723 7ff6f8feac53 19724 7ff6f8feac63 19723->19724 19727 7ff6f8fd54e8 LeaveCriticalSection 19724->19727 16038 7ff6f8fcbb50 16039 7ff6f8fcbb7e 16038->16039 16040 7ff6f8fcbb65 16038->16040 16040->16039 16043 7ff6f8fdd66c 16040->16043 16044 7ff6f8fdd6b7 16043->16044 16048 7ff6f8fdd67b _set_fmode 16043->16048 16053 7ff6f8fd4f78 16044->16053 16045 7ff6f8fdd69e HeapAlloc 16047 7ff6f8fcbbde 16045->16047 16045->16048 16048->16044 16048->16045 16050 7ff6f8fe3600 16048->16050 16056 7ff6f8fe3640 16050->16056 16062 7ff6f8fdb338 GetLastError 16053->16062 16055 7ff6f8fd4f81 16055->16047 16061 7ff6f8fe0348 EnterCriticalSection 16056->16061 16063 7ff6f8fdb379 FlsSetValue 16062->16063 16064 7ff6f8fdb35c 16062->16064 16065 7ff6f8fdb38b 16063->16065 16068 7ff6f8fdb369 SetLastError 16063->16068 16064->16063 16064->16068 16079 7ff6f8fdec08 16065->16079 16068->16055 16070 7ff6f8fdb3b8 FlsSetValue 16073 7ff6f8fdb3c4 FlsSetValue 16070->16073 16074 7ff6f8fdb3d6 16070->16074 16071 7ff6f8fdb3a8 FlsSetValue 16072 7ff6f8fdb3b1 16071->16072 16088 7ff6f8fda9b8 16072->16088 16073->16072 16094 7ff6f8fdaf64 16074->16094 16080 7ff6f8fdec19 16079->16080 16086 7ff6f8fdec27 _set_fmode 16079->16086 16081 7ff6f8fdec6a 16080->16081 16080->16086 16084 7ff6f8fd4f78 _set_fmode 10 API calls 16081->16084 16082 7ff6f8fdec4e HeapAlloc 16083 7ff6f8fdec68 16082->16083 16082->16086 16085 7ff6f8fdb39a 16083->16085 16084->16085 16085->16070 16085->16071 16086->16081 16086->16082 16087 7ff6f8fe3600 _set_fmode 2 API calls 16086->16087 16087->16086 16089 7ff6f8fda9bd RtlFreeHeap 16088->16089 16093 7ff6f8fda9ec 16088->16093 16090 7ff6f8fda9d8 GetLastError 16089->16090 16089->16093 16091 7ff6f8fda9e5 __free_lconv_num 16090->16091 16092 7ff6f8fd4f78 _set_fmode 9 API calls 16091->16092 16092->16093 16093->16068 16099 7ff6f8fdae3c 16094->16099 16111 7ff6f8fe0348 EnterCriticalSection 16099->16111 16113 7ff6f8fd99d1 16125 7ff6f8fda448 16113->16125 16130 7ff6f8fdb1c0 GetLastError 16125->16130 16131 7ff6f8fdb1e4 FlsGetValue 16130->16131 16132 7ff6f8fdb201 FlsSetValue 16130->16132 16133 7ff6f8fdb1fb 16131->16133 16149 7ff6f8fdb1f1 16131->16149 16134 7ff6f8fdb213 16132->16134 16132->16149 16133->16132 16136 7ff6f8fdec08 _set_fmode 11 API calls 16134->16136 16135 7ff6f8fdb26d SetLastError 16137 7ff6f8fda451 16135->16137 16138 7ff6f8fdb28d 16135->16138 16139 7ff6f8fdb222 16136->16139 16152 7ff6f8fda574 16137->16152 16140 7ff6f8fda574 __CxxCallCatchBlock 38 API calls 16138->16140 16141 7ff6f8fdb240 FlsSetValue 16139->16141 16142 7ff6f8fdb230 FlsSetValue 16139->16142 16145 7ff6f8fdb292 16140->16145 16143 7ff6f8fdb25e 16141->16143 16144 7ff6f8fdb24c FlsSetValue 16141->16144 16146 7ff6f8fdb239 16142->16146 16148 7ff6f8fdaf64 _set_fmode 11 API calls 16143->16148 16144->16146 16147 7ff6f8fda9b8 __free_lconv_num 11 API calls 16146->16147 16147->16149 16150 7ff6f8fdb266 16148->16150 16149->16135 16151 7ff6f8fda9b8 __free_lconv_num 11 API calls 16150->16151 16151->16135 16161 7ff6f8fe36c0 16152->16161 16195 7ff6f8fe3678 16161->16195 16200 7ff6f8fe0348 EnterCriticalSection 16195->16200 20722 7ff6f8feadd9 20725 7ff6f8fd54e8 LeaveCriticalSection 20722->20725 19733 7ff6f8feae6e 19734 7ff6f8feae7d 19733->19734 19735 7ff6f8feae87 19733->19735 19737 7ff6f8fe03a8 LeaveCriticalSection 19734->19737 19738 7ff6f8fd5480 19739 7ff6f8fd548b 19738->19739 19747 7ff6f8fdf314 19739->19747 19760 7ff6f8fe0348 EnterCriticalSection 19747->19760 18869 7ff6f8fdf9fc 18870 7ff6f8fdfbee 18869->18870 18872 7ff6f8fdfa3e _isindst 18869->18872 18871 7ff6f8fd4f78 _set_fmode 11 API calls 18870->18871 18889 7ff6f8fdfbde 18871->18889 18872->18870 18875 7ff6f8fdfabe _isindst 18872->18875 18873 7ff6f8fcc5c0 _log10_special 8 API calls 18874 7ff6f8fdfc09 18873->18874 18890 7ff6f8fe6204 18875->18890 18880 7ff6f8fdfc1a 18881 7ff6f8fda970 _isindst 17 API calls 18880->18881 18883 7ff6f8fdfc2e 18881->18883 18887 7ff6f8fdfb1b 18887->18889 18915 7ff6f8fe6248 18887->18915 18889->18873 18891 7ff6f8fe6213 18890->18891 18892 7ff6f8fdfadc 18890->18892 18922 7ff6f8fe0348 EnterCriticalSection 18891->18922 18897 7ff6f8fe5608 18892->18897 18898 7ff6f8fe5611 18897->18898 18899 7ff6f8fdfaf1 18897->18899 18900 7ff6f8fd4f78 _set_fmode 11 API calls 18898->18900 18899->18880 18903 7ff6f8fe5638 18899->18903 18901 7ff6f8fe5616 18900->18901 18902 7ff6f8fda950 _invalid_parameter_noinfo 37 API calls 18901->18902 18902->18899 18904 7ff6f8fe5641 18903->18904 18905 7ff6f8fdfb02 18903->18905 18906 7ff6f8fd4f78 _set_fmode 11 API calls 18904->18906 18905->18880 18909 7ff6f8fe5668 18905->18909 18907 7ff6f8fe5646 18906->18907 18908 7ff6f8fda950 _invalid_parameter_noinfo 37 API calls 18907->18908 18908->18905 18910 7ff6f8fe5671 18909->18910 18914 7ff6f8fdfb13 18909->18914 18911 7ff6f8fd4f78 _set_fmode 11 API calls 18910->18911 18912 7ff6f8fe5676 18911->18912 18913 7ff6f8fda950 _invalid_parameter_noinfo 37 API calls 18912->18913 18913->18914 18914->18880 18914->18887 18923 7ff6f8fe0348 EnterCriticalSection 18915->18923 20484 7ff6f8fdc590 20495 7ff6f8fe0348 EnterCriticalSection 20484->20495 20337 7ff6f8fe1720 20348 7ff6f8fe7454 20337->20348 20349 7ff6f8fe7461 20348->20349 20350 7ff6f8fda9b8 __free_lconv_num 11 API calls 20349->20350 20351 7ff6f8fe747d 20349->20351 20350->20349 20352 7ff6f8fda9b8 __free_lconv_num 11 API calls 20351->20352 20353 7ff6f8fe1729 20351->20353 20352->20351 20354 7ff6f8fe0348 EnterCriticalSection 20353->20354 18924 7ff6f8fd5698 18925 7ff6f8fd56b2 18924->18925 18926 7ff6f8fd56cf 18924->18926 18927 7ff6f8fd4f58 _fread_nolock 11 API calls 18925->18927 18926->18925 18928 7ff6f8fd56e2 CreateFileW 18926->18928 18929 7ff6f8fd56b7 18927->18929 18930 7ff6f8fd574c 18928->18930 18931 7ff6f8fd5716 18928->18931 18933 7ff6f8fd4f78 _set_fmode 11 API calls 18929->18933 18975 7ff6f8fd5c74 18930->18975 18949 7ff6f8fd57ec GetFileType 18931->18949 18936 7ff6f8fd56bf 18933->18936 18940 7ff6f8fda950 _invalid_parameter_noinfo 37 API calls 18936->18940 18938 7ff6f8fd5755 18943 7ff6f8fd4eec _fread_nolock 11 API calls 18938->18943 18939 7ff6f8fd5780 18996 7ff6f8fd5a34 18939->18996 18944 7ff6f8fd56ca 18940->18944 18941 7ff6f8fd5741 CloseHandle 18941->18944 18942 7ff6f8fd572b CloseHandle 18942->18944 18948 7ff6f8fd575f 18943->18948 18948->18944 18950 7ff6f8fd583a 18949->18950 18951 7ff6f8fd58f7 18949->18951 18952 7ff6f8fd5866 GetFileInformationByHandle 18950->18952 18955 7ff6f8fd5b70 21 API calls 18950->18955 18953 7ff6f8fd58ff 18951->18953 18954 7ff6f8fd5921 18951->18954 18956 7ff6f8fd5912 GetLastError 18952->18956 18957 7ff6f8fd588f 18952->18957 18953->18956 18958 7ff6f8fd5903 18953->18958 18959 7ff6f8fd5944 PeekNamedPipe 18954->18959 18974 7ff6f8fd58e2 18954->18974 18960 7ff6f8fd5854 18955->18960 18963 7ff6f8fd4eec _fread_nolock 11 API calls 18956->18963 18961 7ff6f8fd5a34 51 API calls 18957->18961 18962 7ff6f8fd4f78 _set_fmode 11 API calls 18958->18962 18959->18974 18960->18952 18960->18974 18965 7ff6f8fd589a 18961->18965 18962->18974 18963->18974 18964 7ff6f8fcc5c0 _log10_special 8 API calls 18966 7ff6f8fd5724 18964->18966 19013 7ff6f8fd5994 18965->19013 18966->18941 18966->18942 18969 7ff6f8fd5994 10 API calls 18970 7ff6f8fd58b9 18969->18970 18971 7ff6f8fd5994 10 API calls 18970->18971 18972 7ff6f8fd58ca 18971->18972 18973 7ff6f8fd4f78 _set_fmode 11 API calls 18972->18973 18972->18974 18973->18974 18974->18964 18976 7ff6f8fd5caa 18975->18976 18977 7ff6f8fd4f78 _set_fmode 11 API calls 18976->18977 18995 7ff6f8fd5d42 __std_exception_destroy 18976->18995 18979 7ff6f8fd5cbc 18977->18979 18978 7ff6f8fcc5c0 _log10_special 8 API calls 18980 7ff6f8fd5751 18978->18980 18981 7ff6f8fd4f78 _set_fmode 11 API calls 18979->18981 18980->18938 18980->18939 18982 7ff6f8fd5cc4 18981->18982 18983 7ff6f8fd7e78 45 API calls 18982->18983 18984 7ff6f8fd5cd9 18983->18984 18985 7ff6f8fd5ce1 18984->18985 18986 7ff6f8fd5ceb 18984->18986 18987 7ff6f8fd4f78 _set_fmode 11 API calls 18985->18987 18988 7ff6f8fd4f78 _set_fmode 11 API calls 18986->18988 18992 7ff6f8fd5ce6 18987->18992 18989 7ff6f8fd5cf0 18988->18989 18990 7ff6f8fd4f78 _set_fmode 11 API calls 18989->18990 18989->18995 18991 7ff6f8fd5cfa 18990->18991 18993 7ff6f8fd7e78 45 API calls 18991->18993 18994 7ff6f8fd5d34 GetDriveTypeW 18992->18994 18992->18995 18993->18992 18994->18995 18995->18978 18997 7ff6f8fd5a5c 18996->18997 19005 7ff6f8fd578d 18997->19005 19020 7ff6f8fdf794 18997->19020 18999 7ff6f8fd5af0 19000 7ff6f8fdf794 51 API calls 18999->19000 18999->19005 19001 7ff6f8fd5b03 19000->19001 19002 7ff6f8fdf794 51 API calls 19001->19002 19001->19005 19003 7ff6f8fd5b16 19002->19003 19004 7ff6f8fdf794 51 API calls 19003->19004 19003->19005 19004->19005 19006 7ff6f8fd5b70 19005->19006 19007 7ff6f8fd5b8a 19006->19007 19008 7ff6f8fd5bc1 19007->19008 19009 7ff6f8fd5b9a 19007->19009 19011 7ff6f8fdf628 21 API calls 19008->19011 19010 7ff6f8fd5baa 19009->19010 19012 7ff6f8fd4eec _fread_nolock 11 API calls 19009->19012 19010->18948 19011->19010 19012->19010 19014 7ff6f8fd59b0 19013->19014 19015 7ff6f8fd59bd FileTimeToSystemTime 19013->19015 19014->19015 19017 7ff6f8fd59b8 19014->19017 19016 7ff6f8fd59d1 SystemTimeToTzSpecificLocalTime 19015->19016 19015->19017 19016->19017 19018 7ff6f8fcc5c0 _log10_special 8 API calls 19017->19018 19019 7ff6f8fd58a9 19018->19019 19019->18969 19021 7ff6f8fdf7c5 19020->19021 19022 7ff6f8fdf7a1 19020->19022 19024 7ff6f8fdf7ff 19021->19024 19027 7ff6f8fdf81e 19021->19027 19022->19021 19023 7ff6f8fdf7a6 19022->19023 19025 7ff6f8fd4f78 _set_fmode 11 API calls 19023->19025 19026 7ff6f8fd4f78 _set_fmode 11 API calls 19024->19026 19028 7ff6f8fdf7ab 19025->19028 19029 7ff6f8fdf804 19026->19029 19030 7ff6f8fd4fbc 45 API calls 19027->19030 19031 7ff6f8fda950 _invalid_parameter_noinfo 37 API calls 19028->19031 19032 7ff6f8fda950 _invalid_parameter_noinfo 37 API calls 19029->19032 19035 7ff6f8fdf82b 19030->19035 19033 7ff6f8fdf7b6 19031->19033 19034 7ff6f8fdf80f 19032->19034 19033->18999 19034->18999 19035->19034 19036 7ff6f8fe054c 51 API calls 19035->19036 19036->19035 16265 7ff6f8fcccac 16286 7ff6f8fcce7c 16265->16286 16268 7ff6f8fccdf8 16440 7ff6f8fcd19c IsProcessorFeaturePresent 16268->16440 16269 7ff6f8fcccc8 __scrt_acquire_startup_lock 16271 7ff6f8fcce02 16269->16271 16278 7ff6f8fccce6 __scrt_release_startup_lock 16269->16278 16272 7ff6f8fcd19c 7 API calls 16271->16272 16274 7ff6f8fcce0d __CxxCallCatchBlock 16272->16274 16273 7ff6f8fccd0b 16275 7ff6f8fccd91 16292 7ff6f8fcd2e4 16275->16292 16277 7ff6f8fccd96 16295 7ff6f8fc1000 16277->16295 16278->16273 16278->16275 16429 7ff6f8fd9b9c 16278->16429 16283 7ff6f8fccdb9 16283->16274 16436 7ff6f8fcd000 16283->16436 16287 7ff6f8fcce84 16286->16287 16288 7ff6f8fcce90 __scrt_dllmain_crt_thread_attach 16287->16288 16289 7ff6f8fcce9d 16288->16289 16290 7ff6f8fcccc0 16288->16290 16289->16290 16447 7ff6f8fcd8f8 16289->16447 16290->16268 16290->16269 16474 7ff6f8fea540 16292->16474 16296 7ff6f8fc1009 16295->16296 16476 7ff6f8fd54f4 16296->16476 16298 7ff6f8fc37fb 16483 7ff6f8fc36b0 16298->16483 16303 7ff6f8fcc5c0 _log10_special 8 API calls 16306 7ff6f8fc3ca7 16303->16306 16304 7ff6f8fc383c 16650 7ff6f8fc1c80 16304->16650 16305 7ff6f8fc391b 16659 7ff6f8fc45b0 16305->16659 16434 7ff6f8fcd328 GetModuleHandleW 16306->16434 16309 7ff6f8fc385b 16555 7ff6f8fc8a20 16309->16555 16312 7ff6f8fc396a 16682 7ff6f8fc2710 16312->16682 16314 7ff6f8fc388e 16322 7ff6f8fc38bb __std_exception_destroy 16314->16322 16654 7ff6f8fc8b90 16314->16654 16316 7ff6f8fc395d 16317 7ff6f8fc3984 16316->16317 16318 7ff6f8fc3962 16316->16318 16320 7ff6f8fc1c80 49 API calls 16317->16320 16678 7ff6f8fd00bc 16318->16678 16323 7ff6f8fc39a3 16320->16323 16324 7ff6f8fc8a20 14 API calls 16322->16324 16331 7ff6f8fc38de __std_exception_destroy 16322->16331 16328 7ff6f8fc1950 115 API calls 16323->16328 16324->16331 16325 7ff6f8fc8b30 40 API calls 16326 7ff6f8fc3a0b 16325->16326 16327 7ff6f8fc8b90 40 API calls 16326->16327 16329 7ff6f8fc3a17 16327->16329 16330 7ff6f8fc39ce 16328->16330 16332 7ff6f8fc8b90 40 API calls 16329->16332 16330->16309 16333 7ff6f8fc39de 16330->16333 16331->16325 16337 7ff6f8fc390e __std_exception_destroy 16331->16337 16334 7ff6f8fc3a23 16332->16334 16335 7ff6f8fc2710 54 API calls 16333->16335 16336 7ff6f8fc8b90 40 API calls 16334->16336 16377 7ff6f8fc3808 __std_exception_destroy 16335->16377 16336->16337 16338 7ff6f8fc8a20 14 API calls 16337->16338 16339 7ff6f8fc3a3b 16338->16339 16340 7ff6f8fc3b2f 16339->16340 16341 7ff6f8fc3a60 __std_exception_destroy 16339->16341 16342 7ff6f8fc2710 54 API calls 16340->16342 16354 7ff6f8fc3aab 16341->16354 16568 7ff6f8fc8b30 16341->16568 16342->16377 16344 7ff6f8fc8a20 14 API calls 16345 7ff6f8fc3bf4 __std_exception_destroy 16344->16345 16346 7ff6f8fc3d41 16345->16346 16347 7ff6f8fc3c46 16345->16347 16693 7ff6f8fc44d0 16346->16693 16348 7ff6f8fc3c50 16347->16348 16349 7ff6f8fc3cd4 16347->16349 16575 7ff6f8fc90e0 16348->16575 16352 7ff6f8fc8a20 14 API calls 16349->16352 16356 7ff6f8fc3ce0 16352->16356 16353 7ff6f8fc3d4f 16357 7ff6f8fc3d71 16353->16357 16358 7ff6f8fc3d65 16353->16358 16354->16344 16359 7ff6f8fc3c61 16356->16359 16362 7ff6f8fc3ced 16356->16362 16361 7ff6f8fc1c80 49 API calls 16357->16361 16696 7ff6f8fc4620 16358->16696 16365 7ff6f8fc2710 54 API calls 16359->16365 16370 7ff6f8fc3cc8 __std_exception_destroy 16361->16370 16366 7ff6f8fc1c80 49 API calls 16362->16366 16365->16377 16369 7ff6f8fc3d0b 16366->16369 16367 7ff6f8fc3dc4 16625 7ff6f8fc9400 16367->16625 16369->16370 16371 7ff6f8fc3d12 16369->16371 16370->16367 16372 7ff6f8fc3da7 SetDllDirectoryW LoadLibraryExW 16370->16372 16375 7ff6f8fc2710 54 API calls 16371->16375 16372->16367 16374 7ff6f8fc3dd7 SetDllDirectoryW 16376 7ff6f8fc3e0a 16374->16376 16420 7ff6f8fc3e5a 16374->16420 16375->16377 16379 7ff6f8fc8a20 14 API calls 16376->16379 16377->16303 16378 7ff6f8fc3ffc 16381 7ff6f8fc4029 16378->16381 16382 7ff6f8fc4006 PostMessageW GetMessageW 16378->16382 16386 7ff6f8fc3e16 __std_exception_destroy 16379->16386 16380 7ff6f8fc3f1b 16630 7ff6f8fc33c0 16380->16630 16773 7ff6f8fc3360 16381->16773 16382->16381 16389 7ff6f8fc3ef2 16386->16389 16393 7ff6f8fc3e4e 16386->16393 16392 7ff6f8fc8b30 40 API calls 16389->16392 16392->16420 16393->16420 16699 7ff6f8fc6db0 16393->16699 16406 7ff6f8fc3e81 16420->16378 16420->16380 16430 7ff6f8fd9bb3 16429->16430 16431 7ff6f8fd9bd4 16429->16431 16430->16275 16432 7ff6f8fda448 45 API calls 16431->16432 16433 7ff6f8fd9bd9 16432->16433 16435 7ff6f8fcd339 16434->16435 16435->16283 16437 7ff6f8fcd011 16436->16437 16438 7ff6f8fccdd0 16437->16438 16439 7ff6f8fcd8f8 7 API calls 16437->16439 16438->16273 16439->16438 16441 7ff6f8fcd1c2 __CxxCallCatchBlock __scrt_get_show_window_mode 16440->16441 16442 7ff6f8fcd1e1 RtlCaptureContext RtlLookupFunctionEntry 16441->16442 16443 7ff6f8fcd20a RtlVirtualUnwind 16442->16443 16444 7ff6f8fcd246 __scrt_get_show_window_mode 16442->16444 16443->16444 16445 7ff6f8fcd278 IsDebuggerPresent SetUnhandledExceptionFilter UnhandledExceptionFilter 16444->16445 16446 7ff6f8fcd2c6 __CxxCallCatchBlock 16445->16446 16446->16271 16448 7ff6f8fcd900 16447->16448 16449 7ff6f8fcd90a 16447->16449 16453 7ff6f8fcdc94 16448->16453 16449->16290 16454 7ff6f8fcdca3 16453->16454 16455 7ff6f8fcd905 16453->16455 16461 7ff6f8fcded0 16454->16461 16457 7ff6f8fcdd00 16455->16457 16458 7ff6f8fcdd2b 16457->16458 16459 7ff6f8fcdd0e DeleteCriticalSection 16458->16459 16460 7ff6f8fcdd2f 16458->16460 16459->16458 16460->16449 16465 7ff6f8fcdd38 16461->16465 16466 7ff6f8fcde22 TlsFree 16465->16466 16471 7ff6f8fcdd7c __vcrt_InitializeCriticalSectionEx 16465->16471 16467 7ff6f8fcddaa LoadLibraryExW 16468 7ff6f8fcddcb GetLastError 16467->16468 16469 7ff6f8fcde49 16467->16469 16468->16471 16470 7ff6f8fcde69 GetProcAddress 16469->16470 16472 7ff6f8fcde60 FreeLibrary 16469->16472 16470->16466 16471->16466 16471->16467 16471->16470 16473 7ff6f8fcdded LoadLibraryExW 16471->16473 16472->16470 16473->16469 16473->16471 16475 7ff6f8fcd2fb GetStartupInfoW 16474->16475 16475->16277 16479 7ff6f8fdf4f0 16476->16479 16477 7ff6f8fdf543 16478 7ff6f8fda884 _invalid_parameter_noinfo 37 API calls 16477->16478 16482 7ff6f8fdf56c 16478->16482 16479->16477 16480 7ff6f8fdf596 16479->16480 16786 7ff6f8fdf3c8 16480->16786 16482->16298 16794 7ff6f8fcc8c0 16483->16794 16486 7ff6f8fc3710 16796 7ff6f8fc92f0 FindFirstFileExW 16486->16796 16487 7ff6f8fc36eb GetLastError 16801 7ff6f8fc2c50 16487->16801 16490 7ff6f8fc3706 16495 7ff6f8fcc5c0 _log10_special 8 API calls 16490->16495 16492 7ff6f8fc3723 16816 7ff6f8fc9370 CreateFileW 16492->16816 16493 7ff6f8fc377d 16827 7ff6f8fc94b0 16493->16827 16497 7ff6f8fc37b5 16495->16497 16497->16377 16505 7ff6f8fc1950 16497->16505 16499 7ff6f8fc378b 16499->16490 16503 7ff6f8fc2810 49 API calls 16499->16503 16500 7ff6f8fc3734 16819 7ff6f8fc2810 16500->16819 16501 7ff6f8fc374c __vcrt_InitializeCriticalSectionEx 16501->16493 16503->16490 16506 7ff6f8fc45b0 108 API calls 16505->16506 16507 7ff6f8fc1985 16506->16507 16508 7ff6f8fc1c43 16507->16508 16509 7ff6f8fc7f80 83 API calls 16507->16509 16510 7ff6f8fcc5c0 _log10_special 8 API calls 16508->16510 16511 7ff6f8fc19cb 16509->16511 16512 7ff6f8fc1c5e 16510->16512 16554 7ff6f8fc1a03 16511->16554 17200 7ff6f8fd0744 16511->17200 16512->16304 16512->16305 16514 7ff6f8fd00bc 74 API calls 16514->16508 16515 7ff6f8fc19e5 16516 7ff6f8fc19e9 16515->16516 16517 7ff6f8fc1a08 16515->16517 16519 7ff6f8fd4f78 _set_fmode 11 API calls 16516->16519 17204 7ff6f8fd040c 16517->17204 16521 7ff6f8fc19ee 16519->16521 17207 7ff6f8fc2910 16521->17207 16522 7ff6f8fc1a45 16528 7ff6f8fc1a5c 16522->16528 16529 7ff6f8fc1a7b 16522->16529 16523 7ff6f8fc1a26 16525 7ff6f8fd4f78 _set_fmode 11 API calls 16523->16525 16526 7ff6f8fc1a2b 16525->16526 16527 7ff6f8fc2910 54 API calls 16526->16527 16527->16554 16531 7ff6f8fd4f78 _set_fmode 11 API calls 16528->16531 16530 7ff6f8fc1c80 49 API calls 16529->16530 16532 7ff6f8fc1a92 16530->16532 16533 7ff6f8fc1a61 16531->16533 16534 7ff6f8fc1c80 49 API calls 16532->16534 16535 7ff6f8fc2910 54 API calls 16533->16535 16536 7ff6f8fc1add 16534->16536 16535->16554 16537 7ff6f8fd0744 73 API calls 16536->16537 16538 7ff6f8fc1b01 16537->16538 16539 7ff6f8fc1b35 16538->16539 16540 7ff6f8fc1b16 16538->16540 16542 7ff6f8fd040c _fread_nolock 53 API calls 16539->16542 16541 7ff6f8fd4f78 _set_fmode 11 API calls 16540->16541 16543 7ff6f8fc1b1b 16541->16543 16544 7ff6f8fc1b4a 16542->16544 16547 7ff6f8fc2910 54 API calls 16543->16547 16545 7ff6f8fc1b50 16544->16545 16546 7ff6f8fc1b6f 16544->16546 16548 7ff6f8fd4f78 _set_fmode 11 API calls 16545->16548 17222 7ff6f8fd0180 16546->17222 16547->16554 16550 7ff6f8fc1b55 16548->16550 16552 7ff6f8fc2910 54 API calls 16550->16552 16552->16554 16553 7ff6f8fc2710 54 API calls 16553->16554 16554->16514 16556 7ff6f8fc8a2a 16555->16556 16557 7ff6f8fc9400 2 API calls 16556->16557 16558 7ff6f8fc8a49 GetEnvironmentVariableW 16557->16558 16559 7ff6f8fc8ab2 16558->16559 16560 7ff6f8fc8a66 ExpandEnvironmentStringsW 16558->16560 16562 7ff6f8fcc5c0 _log10_special 8 API calls 16559->16562 16560->16559 16561 7ff6f8fc8a88 16560->16561 16563 7ff6f8fc94b0 2 API calls 16561->16563 16564 7ff6f8fc8ac4 16562->16564 16565 7ff6f8fc8a9a 16563->16565 16564->16314 16566 7ff6f8fcc5c0 _log10_special 8 API calls 16565->16566 16567 7ff6f8fc8aaa 16566->16567 16567->16314 16569 7ff6f8fc9400 2 API calls 16568->16569 16570 7ff6f8fc8b4c 16569->16570 16571 7ff6f8fc9400 2 API calls 16570->16571 16572 7ff6f8fc8b5c 16571->16572 17440 7ff6f8fd82a8 16572->17440 16574 7ff6f8fc8b6a __std_exception_destroy 16574->16354 16576 7ff6f8fc90f5 16575->16576 17458 7ff6f8fc8760 GetCurrentProcess OpenProcessToken 16576->17458 16579 7ff6f8fc8760 7 API calls 16580 7ff6f8fc9121 16579->16580 16581 7ff6f8fc9154 16580->16581 16582 7ff6f8fc913a 16580->16582 16584 7ff6f8fc26b0 48 API calls 16581->16584 16583 7ff6f8fc26b0 48 API calls 16582->16583 16585 7ff6f8fc9152 16583->16585 16586 7ff6f8fc9167 LocalFree LocalFree 16584->16586 16585->16586 16587 7ff6f8fc9183 16586->16587 16589 7ff6f8fc918f 16586->16589 17468 7ff6f8fc2b50 16587->17468 16590 7ff6f8fcc5c0 _log10_special 8 API calls 16589->16590 16591 7ff6f8fc3c55 16590->16591 16591->16359 16592 7ff6f8fc8850 16591->16592 16593 7ff6f8fc8868 16592->16593 16594 7ff6f8fc88ea GetTempPathW GetCurrentProcessId 16593->16594 16595 7ff6f8fc888c 16593->16595 17477 7ff6f8fc25c0 16594->17477 16597 7ff6f8fc8a20 14 API calls 16595->16597 16598 7ff6f8fc8898 16597->16598 17484 7ff6f8fc81c0 16598->17484 16605 7ff6f8fc8918 __std_exception_destroy 16611 7ff6f8fc8955 __std_exception_destroy 16605->16611 17481 7ff6f8fd8bd8 16605->17481 16610 7ff6f8fcc5c0 _log10_special 8 API calls 16613 7ff6f8fc3cbb 16610->16613 16616 7ff6f8fc9400 2 API calls 16611->16616 16624 7ff6f8fc89c4 __std_exception_destroy 16611->16624 16613->16359 16613->16370 16617 7ff6f8fc89a1 16616->16617 16618 7ff6f8fc89a6 16617->16618 16619 7ff6f8fc89d9 16617->16619 16621 7ff6f8fc9400 2 API calls 16618->16621 16620 7ff6f8fd82a8 38 API calls 16619->16620 16620->16624 16622 7ff6f8fc89b6 16621->16622 16624->16610 16626 7ff6f8fc9422 MultiByteToWideChar 16625->16626 16628 7ff6f8fc9446 16625->16628 16626->16628 16629 7ff6f8fc945c __std_exception_destroy 16626->16629 16627 7ff6f8fc9463 MultiByteToWideChar 16627->16629 16628->16627 16628->16629 16629->16374 16640 7ff6f8fc33ce __scrt_get_show_window_mode 16630->16640 16631 7ff6f8fc35c7 16632 7ff6f8fcc5c0 _log10_special 8 API calls 16631->16632 16633 7ff6f8fc3664 16632->16633 16633->16377 16649 7ff6f8fc90c0 LocalFree 16633->16649 16635 7ff6f8fc1c80 49 API calls 16635->16640 16637 7ff6f8fc2710 54 API calls 16637->16631 16640->16631 16640->16635 16641 7ff6f8fc35c9 16640->16641 16642 7ff6f8fc2a50 54 API calls 16640->16642 16644 7ff6f8fc35e2 16640->16644 16647 7ff6f8fc35d0 16640->16647 17755 7ff6f8fc4550 16640->17755 17761 7ff6f8fc7e10 16640->17761 17772 7ff6f8fc1600 16640->17772 17820 7ff6f8fc7110 16640->17820 17824 7ff6f8fc4180 16640->17824 17868 7ff6f8fc4440 16640->17868 16643 7ff6f8fc2710 54 API calls 16641->16643 16642->16640 16643->16631 16644->16637 16648 7ff6f8fc2710 54 API calls 16647->16648 16648->16631 16651 7ff6f8fc1ca5 16650->16651 16652 7ff6f8fd49f4 49 API calls 16651->16652 16653 7ff6f8fc1cc8 16652->16653 16653->16309 16655 7ff6f8fc9400 2 API calls 16654->16655 16656 7ff6f8fc8ba4 16655->16656 16657 7ff6f8fd82a8 38 API calls 16656->16657 16658 7ff6f8fc8bb6 __std_exception_destroy 16657->16658 16658->16322 16660 7ff6f8fc45bc 16659->16660 16661 7ff6f8fc9400 2 API calls 16660->16661 16662 7ff6f8fc45e4 16661->16662 16663 7ff6f8fc9400 2 API calls 16662->16663 16664 7ff6f8fc45f7 16663->16664 18057 7ff6f8fd6004 16664->18057 16667 7ff6f8fcc5c0 _log10_special 8 API calls 16668 7ff6f8fc392b 16667->16668 16668->16312 16669 7ff6f8fc7f80 16668->16669 16670 7ff6f8fc7fa4 16669->16670 16671 7ff6f8fd0744 73 API calls 16670->16671 16672 7ff6f8fc807b __std_exception_destroy 16670->16672 16673 7ff6f8fc7fc0 16671->16673 16672->16316 16673->16672 18448 7ff6f8fd7938 16673->18448 16675 7ff6f8fd0744 73 API calls 16677 7ff6f8fc7fd5 16675->16677 16676 7ff6f8fd040c _fread_nolock 53 API calls 16676->16677 16677->16672 16677->16675 16677->16676 16679 7ff6f8fd00ec 16678->16679 18463 7ff6f8fcfe98 16679->18463 16681 7ff6f8fd0105 16681->16312 16683 7ff6f8fcc8c0 16682->16683 16684 7ff6f8fc2734 GetCurrentProcessId 16683->16684 16685 7ff6f8fc1c80 49 API calls 16684->16685 16686 7ff6f8fc2787 16685->16686 16687 7ff6f8fd49f4 49 API calls 16686->16687 16688 7ff6f8fc27cf 16687->16688 16689 7ff6f8fc2620 12 API calls 16688->16689 16690 7ff6f8fc27f1 16689->16690 16691 7ff6f8fcc5c0 _log10_special 8 API calls 16690->16691 16692 7ff6f8fc2801 16691->16692 16692->16377 16694 7ff6f8fc1c80 49 API calls 16693->16694 16695 7ff6f8fc44ed 16694->16695 16695->16353 16697 7ff6f8fc1c80 49 API calls 16696->16697 16698 7ff6f8fc4650 16697->16698 16698->16370 16700 7ff6f8fc6dc5 16699->16700 16701 7ff6f8fc3e6c 16700->16701 16702 7ff6f8fd4f78 _set_fmode 11 API calls 16700->16702 16705 7ff6f8fc7330 16701->16705 16703 7ff6f8fc6dd2 16702->16703 16704 7ff6f8fc2910 54 API calls 16703->16704 16704->16701 18474 7ff6f8fc1470 16705->18474 16707 7ff6f8fc7358 16708 7ff6f8fc74a9 __std_exception_destroy 16707->16708 16709 7ff6f8fc4620 49 API calls 16707->16709 16708->16406 16710 7ff6f8fc737a 16709->16710 18580 7ff6f8fc6350 16773->18580 16776 7ff6f8fc3399 16782 7ff6f8fc3670 16776->16782 16783 7ff6f8fc367e 16782->16783 16784 7ff6f8fc368f 16783->16784 18868 7ff6f8fc9050 FreeLibrary 16783->18868 16793 7ff6f8fd54dc EnterCriticalSection 16786->16793 16795 7ff6f8fc36bc GetModuleFileNameW 16794->16795 16795->16486 16795->16487 16797 7ff6f8fc932f FindClose 16796->16797 16798 7ff6f8fc9342 16796->16798 16797->16798 16799 7ff6f8fcc5c0 _log10_special 8 API calls 16798->16799 16800 7ff6f8fc371a 16799->16800 16800->16492 16800->16493 16802 7ff6f8fcc8c0 16801->16802 16803 7ff6f8fc2c70 GetCurrentProcessId 16802->16803 16832 7ff6f8fc26b0 16803->16832 16805 7ff6f8fc2cb9 16836 7ff6f8fd4c48 16805->16836 16808 7ff6f8fc26b0 48 API calls 16809 7ff6f8fc2d34 FormatMessageW 16808->16809 16811 7ff6f8fc2d7f MessageBoxW 16809->16811 16812 7ff6f8fc2d6d 16809->16812 16814 7ff6f8fcc5c0 _log10_special 8 API calls 16811->16814 16813 7ff6f8fc26b0 48 API calls 16812->16813 16813->16811 16815 7ff6f8fc2daf 16814->16815 16815->16490 16817 7ff6f8fc93b0 GetFinalPathNameByHandleW CloseHandle 16816->16817 16818 7ff6f8fc3730 16816->16818 16817->16818 16818->16500 16818->16501 16820 7ff6f8fc2834 16819->16820 16821 7ff6f8fc26b0 48 API calls 16820->16821 16822 7ff6f8fc2887 16821->16822 16823 7ff6f8fd4c48 48 API calls 16822->16823 16824 7ff6f8fc28d0 MessageBoxW 16823->16824 16825 7ff6f8fcc5c0 _log10_special 8 API calls 16824->16825 16826 7ff6f8fc2900 16825->16826 16826->16490 16828 7ff6f8fc94da WideCharToMultiByte 16827->16828 16831 7ff6f8fc9505 16827->16831 16830 7ff6f8fc951b __std_exception_destroy 16828->16830 16828->16831 16829 7ff6f8fc9522 WideCharToMultiByte 16829->16830 16830->16499 16831->16829 16831->16830 16833 7ff6f8fc26d5 16832->16833 16834 7ff6f8fd4c48 48 API calls 16833->16834 16835 7ff6f8fc26f8 16834->16835 16835->16805 16838 7ff6f8fd4ca2 16836->16838 16837 7ff6f8fd4cc7 16839 7ff6f8fda884 _invalid_parameter_noinfo 37 API calls 16837->16839 16838->16837 16840 7ff6f8fd4d03 16838->16840 16842 7ff6f8fd4cf1 16839->16842 16854 7ff6f8fd3000 16840->16854 16845 7ff6f8fcc5c0 _log10_special 8 API calls 16842->16845 16843 7ff6f8fd4de4 16846 7ff6f8fda9b8 __free_lconv_num 11 API calls 16843->16846 16847 7ff6f8fc2d04 16845->16847 16846->16842 16847->16808 16848 7ff6f8fd4db9 16850 7ff6f8fda9b8 __free_lconv_num 11 API calls 16848->16850 16849 7ff6f8fd4e0a 16849->16843 16852 7ff6f8fd4e14 16849->16852 16850->16842 16851 7ff6f8fd4db0 16851->16843 16851->16848 16853 7ff6f8fda9b8 __free_lconv_num 11 API calls 16852->16853 16853->16842 16855 7ff6f8fd303e 16854->16855 16856 7ff6f8fd302e 16854->16856 16857 7ff6f8fd3047 16855->16857 16861 7ff6f8fd3075 16855->16861 16858 7ff6f8fda884 _invalid_parameter_noinfo 37 API calls 16856->16858 16859 7ff6f8fda884 _invalid_parameter_noinfo 37 API calls 16857->16859 16860 7ff6f8fd306d 16858->16860 16859->16860 16860->16843 16860->16848 16860->16849 16860->16851 16861->16856 16861->16860 16865 7ff6f8fd3a14 16861->16865 16898 7ff6f8fd3460 16861->16898 16935 7ff6f8fd2bf0 16861->16935 16866 7ff6f8fd3a56 16865->16866 16867 7ff6f8fd3ac7 16865->16867 16868 7ff6f8fd3af1 16866->16868 16869 7ff6f8fd3a5c 16866->16869 16870 7ff6f8fd3acc 16867->16870 16875 7ff6f8fd3b20 16867->16875 16958 7ff6f8fd1dc4 16868->16958 16871 7ff6f8fd3a90 16869->16871 16872 7ff6f8fd3a61 16869->16872 16873 7ff6f8fd3ace 16870->16873 16874 7ff6f8fd3b01 16870->16874 16880 7ff6f8fd3a67 16871->16880 16883 7ff6f8fd3b2f 16871->16883 16877 7ff6f8fd3b37 16872->16877 16872->16880 16878 7ff6f8fd3a70 16873->16878 16887 7ff6f8fd3add 16873->16887 16965 7ff6f8fd19b4 16874->16965 16875->16877 16879 7ff6f8fd3b2a 16875->16879 16875->16883 16972 7ff6f8fd471c 16877->16972 16896 7ff6f8fd3b60 16878->16896 16938 7ff6f8fd41c8 16878->16938 16879->16868 16879->16883 16880->16878 16886 7ff6f8fd3aa2 16880->16886 16894 7ff6f8fd3a8b 16880->16894 16883->16896 16976 7ff6f8fd21d4 16883->16976 16886->16896 16948 7ff6f8fd4504 16886->16948 16887->16868 16889 7ff6f8fd3ae2 16887->16889 16889->16896 16954 7ff6f8fd45c8 16889->16954 16890 7ff6f8fcc5c0 _log10_special 8 API calls 16891 7ff6f8fd3e5a 16890->16891 16891->16861 16894->16896 16897 7ff6f8fd3d4c 16894->16897 16983 7ff6f8fd4830 16894->16983 16896->16890 16897->16896 16989 7ff6f8fdea78 16897->16989 16899 7ff6f8fd3484 16898->16899 16900 7ff6f8fd346e 16898->16900 16903 7ff6f8fda884 _invalid_parameter_noinfo 37 API calls 16899->16903 16904 7ff6f8fd34c4 16899->16904 16901 7ff6f8fd3a56 16900->16901 16902 7ff6f8fd3ac7 16900->16902 16900->16904 16905 7ff6f8fd3af1 16901->16905 16906 7ff6f8fd3a5c 16901->16906 16907 7ff6f8fd3b20 16902->16907 16908 7ff6f8fd3acc 16902->16908 16903->16904 16904->16861 16913 7ff6f8fd1dc4 38 API calls 16905->16913 16909 7ff6f8fd3a90 16906->16909 16910 7ff6f8fd3a61 16906->16910 16914 7ff6f8fd3b37 16907->16914 16916 7ff6f8fd3b2a 16907->16916 16920 7ff6f8fd3b2f 16907->16920 16911 7ff6f8fd3ace 16908->16911 16912 7ff6f8fd3b01 16908->16912 16917 7ff6f8fd3a67 16909->16917 16909->16920 16910->16914 16910->16917 16915 7ff6f8fd3a70 16911->16915 16924 7ff6f8fd3add 16911->16924 16918 7ff6f8fd19b4 38 API calls 16912->16918 16931 7ff6f8fd3a8b 16913->16931 16921 7ff6f8fd471c 45 API calls 16914->16921 16919 7ff6f8fd41c8 47 API calls 16915->16919 16934 7ff6f8fd3b60 16915->16934 16916->16905 16916->16920 16917->16915 16922 7ff6f8fd3aa2 16917->16922 16917->16931 16918->16931 16919->16931 16923 7ff6f8fd21d4 38 API calls 16920->16923 16920->16934 16921->16931 16925 7ff6f8fd4504 46 API calls 16922->16925 16922->16934 16923->16931 16924->16905 16926 7ff6f8fd3ae2 16924->16926 16925->16931 16929 7ff6f8fd45c8 37 API calls 16926->16929 16926->16934 16927 7ff6f8fcc5c0 _log10_special 8 API calls 16928 7ff6f8fd3e5a 16927->16928 16928->16861 16929->16931 16930 7ff6f8fd4830 45 API calls 16933 7ff6f8fd3d4c 16930->16933 16931->16930 16931->16933 16931->16934 16932 7ff6f8fdea78 46 API calls 16932->16933 16933->16932 16933->16934 16934->16927 17183 7ff6f8fd1038 16935->17183 16939 7ff6f8fd41ee 16938->16939 17001 7ff6f8fd0bf0 16939->17001 16944 7ff6f8fd4830 45 API calls 16945 7ff6f8fd4333 16944->16945 16946 7ff6f8fd4830 45 API calls 16945->16946 16947 7ff6f8fd43c1 16945->16947 16946->16947 16947->16894 16949 7ff6f8fd4539 16948->16949 16950 7ff6f8fd457e 16949->16950 16951 7ff6f8fd4557 16949->16951 16953 7ff6f8fd4830 45 API calls 16949->16953 16950->16894 16952 7ff6f8fdea78 46 API calls 16951->16952 16952->16950 16953->16951 16957 7ff6f8fd45e9 16954->16957 16955 7ff6f8fda884 _invalid_parameter_noinfo 37 API calls 16956 7ff6f8fd461a 16955->16956 16956->16894 16957->16955 16957->16956 16959 7ff6f8fd1df7 16958->16959 16960 7ff6f8fd1e26 16959->16960 16962 7ff6f8fd1ee3 16959->16962 16964 7ff6f8fd1e63 16960->16964 17137 7ff6f8fd0c98 16960->17137 16963 7ff6f8fda884 _invalid_parameter_noinfo 37 API calls 16962->16963 16963->16964 16964->16894 16966 7ff6f8fd19e7 16965->16966 16967 7ff6f8fd1a16 16966->16967 16969 7ff6f8fd1ad3 16966->16969 16968 7ff6f8fd0c98 12 API calls 16967->16968 16971 7ff6f8fd1a53 16967->16971 16968->16971 16970 7ff6f8fda884 _invalid_parameter_noinfo 37 API calls 16969->16970 16970->16971 16971->16894 16973 7ff6f8fd475f 16972->16973 16975 7ff6f8fd4763 __crtLCMapStringW 16973->16975 17145 7ff6f8fd47b8 16973->17145 16975->16894 16977 7ff6f8fd2207 16976->16977 16978 7ff6f8fd2236 16977->16978 16980 7ff6f8fd22f3 16977->16980 16979 7ff6f8fd0c98 12 API calls 16978->16979 16982 7ff6f8fd2273 16978->16982 16979->16982 16981 7ff6f8fda884 _invalid_parameter_noinfo 37 API calls 16980->16981 16981->16982 16982->16894 16984 7ff6f8fd4847 16983->16984 17149 7ff6f8fdda28 16984->17149 16990 7ff6f8fdeaa9 16989->16990 16999 7ff6f8fdeab7 16989->16999 16991 7ff6f8fdead7 16990->16991 16994 7ff6f8fd4830 45 API calls 16990->16994 16990->16999 16992 7ff6f8fdeb0f 16991->16992 16993 7ff6f8fdeae8 16991->16993 16996 7ff6f8fdeb9a 16992->16996 16997 7ff6f8fdeb39 16992->16997 16992->16999 17173 7ff6f8fe0110 16993->17173 16994->16991 16998 7ff6f8fdf910 _fread_nolock MultiByteToWideChar 16996->16998 16997->16999 17176 7ff6f8fdf910 16997->17176 16998->16999 16999->16897 17002 7ff6f8fd0c27 17001->17002 17008 7ff6f8fd0c16 17001->17008 17003 7ff6f8fdd66c _fread_nolock 12 API calls 17002->17003 17002->17008 17004 7ff6f8fd0c54 17003->17004 17005 7ff6f8fd0c68 17004->17005 17006 7ff6f8fda9b8 __free_lconv_num 11 API calls 17004->17006 17007 7ff6f8fda9b8 __free_lconv_num 11 API calls 17005->17007 17006->17005 17007->17008 17009 7ff6f8fde5e0 17008->17009 17010 7ff6f8fde5fd 17009->17010 17011 7ff6f8fde630 17009->17011 17012 7ff6f8fda884 _invalid_parameter_noinfo 37 API calls 17010->17012 17011->17010 17013 7ff6f8fde662 17011->17013 17022 7ff6f8fd4311 17012->17022 17019 7ff6f8fde775 17013->17019 17026 7ff6f8fde6aa 17013->17026 17014 7ff6f8fde867 17064 7ff6f8fddacc 17014->17064 17016 7ff6f8fde82d 17057 7ff6f8fdde64 17016->17057 17018 7ff6f8fde7fc 17050 7ff6f8fde144 17018->17050 17019->17014 17019->17016 17019->17018 17021 7ff6f8fde7bf 17019->17021 17024 7ff6f8fde7b5 17019->17024 17040 7ff6f8fde374 17021->17040 17022->16944 17022->16945 17024->17016 17025 7ff6f8fde7ba 17024->17025 17025->17018 17025->17021 17026->17022 17031 7ff6f8fda514 17026->17031 17029 7ff6f8fda970 _isindst 17 API calls 17030 7ff6f8fde8c4 17029->17030 17032 7ff6f8fda521 17031->17032 17033 7ff6f8fda52b 17031->17033 17032->17033 17038 7ff6f8fda546 17032->17038 17034 7ff6f8fd4f78 _set_fmode 11 API calls 17033->17034 17035 7ff6f8fda532 17034->17035 17037 7ff6f8fda950 _invalid_parameter_noinfo 37 API calls 17035->17037 17036 7ff6f8fda53e 17036->17022 17036->17029 17037->17036 17038->17036 17039 7ff6f8fd4f78 _set_fmode 11 API calls 17038->17039 17039->17035 17073 7ff6f8fe411c 17040->17073 17044 7ff6f8fde41c 17045 7ff6f8fde471 17044->17045 17046 7ff6f8fde43c 17044->17046 17049 7ff6f8fde420 17044->17049 17126 7ff6f8fddf60 17045->17126 17122 7ff6f8fde21c 17046->17122 17049->17022 17051 7ff6f8fe411c 38 API calls 17050->17051 17052 7ff6f8fde18e 17051->17052 17053 7ff6f8fe3b64 37 API calls 17052->17053 17054 7ff6f8fde1de 17053->17054 17055 7ff6f8fde1e2 17054->17055 17056 7ff6f8fde21c 45 API calls 17054->17056 17055->17022 17056->17055 17058 7ff6f8fe411c 38 API calls 17057->17058 17059 7ff6f8fddeaf 17058->17059 17060 7ff6f8fe3b64 37 API calls 17059->17060 17061 7ff6f8fddf07 17060->17061 17062 7ff6f8fddf0b 17061->17062 17063 7ff6f8fddf60 45 API calls 17061->17063 17062->17022 17063->17062 17065 7ff6f8fddb44 17064->17065 17066 7ff6f8fddb11 17064->17066 17068 7ff6f8fddb5c 17065->17068 17071 7ff6f8fddbdd 17065->17071 17067 7ff6f8fda884 _invalid_parameter_noinfo 37 API calls 17066->17067 17070 7ff6f8fddb3d __scrt_get_show_window_mode 17067->17070 17069 7ff6f8fdde64 46 API calls 17068->17069 17069->17070 17070->17022 17071->17070 17072 7ff6f8fd4830 45 API calls 17071->17072 17072->17070 17074 7ff6f8fe416f fegetenv 17073->17074 17075 7ff6f8fe7e9c 37 API calls 17074->17075 17078 7ff6f8fe41c2 17075->17078 17076 7ff6f8fe41ef 17081 7ff6f8fda514 __std_exception_copy 37 API calls 17076->17081 17077 7ff6f8fe42b2 17079 7ff6f8fe7e9c 37 API calls 17077->17079 17078->17077 17082 7ff6f8fe428c 17078->17082 17083 7ff6f8fe41dd 17078->17083 17080 7ff6f8fe42dc 17079->17080 17084 7ff6f8fe7e9c 37 API calls 17080->17084 17085 7ff6f8fe426d 17081->17085 17086 7ff6f8fda514 __std_exception_copy 37 API calls 17082->17086 17083->17076 17083->17077 17087 7ff6f8fe42ed 17084->17087 17088 7ff6f8fe5394 17085->17088 17092 7ff6f8fe4275 17085->17092 17086->17085 17090 7ff6f8fe8090 20 API calls 17087->17090 17089 7ff6f8fda970 _isindst 17 API calls 17088->17089 17091 7ff6f8fe53a9 17089->17091 17100 7ff6f8fe4356 __scrt_get_show_window_mode 17090->17100 17093 7ff6f8fcc5c0 _log10_special 8 API calls 17092->17093 17094 7ff6f8fde3c1 17093->17094 17118 7ff6f8fe3b64 17094->17118 17095 7ff6f8fe46ff __scrt_get_show_window_mode 17096 7ff6f8fe4397 memcpy_s 17111 7ff6f8fe47f3 memcpy_s __scrt_get_show_window_mode 17096->17111 17113 7ff6f8fe4cdb memcpy_s __scrt_get_show_window_mode 17096->17113 17097 7ff6f8fe4a3f 17098 7ff6f8fe3c80 37 API calls 17097->17098 17099 7ff6f8fe5157 17098->17099 17107 7ff6f8fe53ac memcpy_s 37 API calls 17099->17107 17116 7ff6f8fe51b2 17099->17116 17100->17095 17100->17096 17103 7ff6f8fd4f78 _set_fmode 11 API calls 17100->17103 17101 7ff6f8fe49eb 17101->17097 17102 7ff6f8fe53ac memcpy_s 37 API calls 17101->17102 17102->17097 17105 7ff6f8fe47d0 17103->17105 17104 7ff6f8fe5338 17108 7ff6f8fe7e9c 37 API calls 17104->17108 17106 7ff6f8fda950 _invalid_parameter_noinfo 37 API calls 17105->17106 17106->17096 17107->17116 17108->17092 17109 7ff6f8fd4f78 11 API calls _set_fmode 17109->17111 17110 7ff6f8fd4f78 11 API calls _set_fmode 17110->17113 17111->17101 17111->17109 17114 7ff6f8fda950 37 API calls _invalid_parameter_noinfo 17111->17114 17112 7ff6f8fe3c80 37 API calls 17112->17116 17113->17097 17113->17101 17113->17110 17117 7ff6f8fda950 37 API calls _invalid_parameter_noinfo 17113->17117 17114->17111 17115 7ff6f8fe53ac memcpy_s 37 API calls 17115->17116 17116->17104 17116->17112 17116->17115 17117->17113 17119 7ff6f8fe3b83 17118->17119 17120 7ff6f8fda884 _invalid_parameter_noinfo 37 API calls 17119->17120 17121 7ff6f8fe3bae memcpy_s 17119->17121 17120->17121 17121->17044 17123 7ff6f8fde248 memcpy_s 17122->17123 17124 7ff6f8fd4830 45 API calls 17123->17124 17125 7ff6f8fde302 memcpy_s __scrt_get_show_window_mode 17123->17125 17124->17125 17125->17049 17127 7ff6f8fddf9b 17126->17127 17131 7ff6f8fddfe8 memcpy_s 17126->17131 17128 7ff6f8fda884 _invalid_parameter_noinfo 37 API calls 17127->17128 17129 7ff6f8fddfc7 17128->17129 17129->17049 17130 7ff6f8fde053 17132 7ff6f8fda514 __std_exception_copy 37 API calls 17130->17132 17131->17130 17133 7ff6f8fd4830 45 API calls 17131->17133 17136 7ff6f8fde095 memcpy_s 17132->17136 17133->17130 17134 7ff6f8fda970 _isindst 17 API calls 17135 7ff6f8fde140 17134->17135 17136->17134 17138 7ff6f8fd0ccf 17137->17138 17139 7ff6f8fd0cbe 17137->17139 17138->17139 17140 7ff6f8fdd66c _fread_nolock 12 API calls 17138->17140 17139->16964 17141 7ff6f8fd0d00 17140->17141 17142 7ff6f8fd0d14 17141->17142 17143 7ff6f8fda9b8 __free_lconv_num 11 API calls 17141->17143 17144 7ff6f8fda9b8 __free_lconv_num 11 API calls 17142->17144 17143->17142 17144->17139 17146 7ff6f8fd47de 17145->17146 17147 7ff6f8fd47d6 17145->17147 17146->16975 17148 7ff6f8fd4830 45 API calls 17147->17148 17148->17146 17150 7ff6f8fd486f 17149->17150 17151 7ff6f8fdda41 17149->17151 17153 7ff6f8fdda94 17150->17153 17151->17150 17157 7ff6f8fe3374 17151->17157 17154 7ff6f8fddaad 17153->17154 17156 7ff6f8fd487f 17153->17156 17154->17156 17170 7ff6f8fe26c0 17154->17170 17156->16897 17158 7ff6f8fdb1c0 __CxxCallCatchBlock 45 API calls 17157->17158 17159 7ff6f8fe3383 17158->17159 17160 7ff6f8fe33ce 17159->17160 17169 7ff6f8fe0348 EnterCriticalSection 17159->17169 17160->17150 17171 7ff6f8fdb1c0 __CxxCallCatchBlock 45 API calls 17170->17171 17172 7ff6f8fe26c9 17171->17172 17179 7ff6f8fe6df8 17173->17179 17177 7ff6f8fdf919 MultiByteToWideChar 17176->17177 17182 7ff6f8fe6e5c 17179->17182 17180 7ff6f8fcc5c0 _log10_special 8 API calls 17181 7ff6f8fe012d 17180->17181 17181->16999 17182->17180 17184 7ff6f8fd107f 17183->17184 17185 7ff6f8fd106d 17183->17185 17187 7ff6f8fd108d 17184->17187 17191 7ff6f8fd10c9 17184->17191 17186 7ff6f8fd4f78 _set_fmode 11 API calls 17185->17186 17188 7ff6f8fd1072 17186->17188 17190 7ff6f8fda884 _invalid_parameter_noinfo 37 API calls 17187->17190 17189 7ff6f8fda950 _invalid_parameter_noinfo 37 API calls 17188->17189 17196 7ff6f8fd107d 17189->17196 17190->17196 17192 7ff6f8fd1445 17191->17192 17193 7ff6f8fd4f78 _set_fmode 11 API calls 17191->17193 17194 7ff6f8fd4f78 _set_fmode 11 API calls 17192->17194 17192->17196 17195 7ff6f8fd143a 17193->17195 17197 7ff6f8fd16d9 17194->17197 17199 7ff6f8fda950 _invalid_parameter_noinfo 37 API calls 17195->17199 17196->16861 17198 7ff6f8fda950 _invalid_parameter_noinfo 37 API calls 17197->17198 17198->17196 17199->17192 17201 7ff6f8fd0774 17200->17201 17228 7ff6f8fd04d4 17201->17228 17203 7ff6f8fd078d 17203->16515 17240 7ff6f8fd042c 17204->17240 17208 7ff6f8fcc8c0 17207->17208 17209 7ff6f8fc2930 GetCurrentProcessId 17208->17209 17210 7ff6f8fc1c80 49 API calls 17209->17210 17211 7ff6f8fc2979 17210->17211 17254 7ff6f8fd49f4 17211->17254 17216 7ff6f8fc1c80 49 API calls 17217 7ff6f8fc29ff 17216->17217 17284 7ff6f8fc2620 17217->17284 17220 7ff6f8fcc5c0 _log10_special 8 API calls 17221 7ff6f8fc2a31 17220->17221 17221->16554 17223 7ff6f8fc1b89 17222->17223 17224 7ff6f8fd0189 17222->17224 17223->16553 17223->16554 17225 7ff6f8fd4f78 _set_fmode 11 API calls 17224->17225 17226 7ff6f8fd018e 17225->17226 17227 7ff6f8fda950 _invalid_parameter_noinfo 37 API calls 17226->17227 17227->17223 17229 7ff6f8fd053e 17228->17229 17230 7ff6f8fd04fe 17228->17230 17229->17230 17232 7ff6f8fd054a 17229->17232 17231 7ff6f8fda884 _invalid_parameter_noinfo 37 API calls 17230->17231 17233 7ff6f8fd0525 17231->17233 17239 7ff6f8fd54dc EnterCriticalSection 17232->17239 17233->17203 17241 7ff6f8fc1a20 17240->17241 17242 7ff6f8fd0456 17240->17242 17241->16522 17241->16523 17242->17241 17243 7ff6f8fd04a2 17242->17243 17244 7ff6f8fd0465 __scrt_get_show_window_mode 17242->17244 17253 7ff6f8fd54dc EnterCriticalSection 17243->17253 17246 7ff6f8fd4f78 _set_fmode 11 API calls 17244->17246 17248 7ff6f8fd047a 17246->17248 17250 7ff6f8fda950 _invalid_parameter_noinfo 37 API calls 17248->17250 17250->17241 17258 7ff6f8fd4a4e 17254->17258 17255 7ff6f8fd4a73 17256 7ff6f8fda884 _invalid_parameter_noinfo 37 API calls 17255->17256 17260 7ff6f8fd4a9d 17256->17260 17257 7ff6f8fd4aaf 17293 7ff6f8fd2c80 17257->17293 17258->17255 17258->17257 17262 7ff6f8fcc5c0 _log10_special 8 API calls 17260->17262 17261 7ff6f8fd4b8c 17263 7ff6f8fda9b8 __free_lconv_num 11 API calls 17261->17263 17264 7ff6f8fc29c3 17262->17264 17263->17260 17272 7ff6f8fd51d0 17264->17272 17266 7ff6f8fd4bb0 17266->17261 17268 7ff6f8fd4bba 17266->17268 17267 7ff6f8fd4b61 17269 7ff6f8fda9b8 __free_lconv_num 11 API calls 17267->17269 17271 7ff6f8fda9b8 __free_lconv_num 11 API calls 17268->17271 17269->17260 17270 7ff6f8fd4b58 17270->17261 17270->17267 17271->17260 17273 7ff6f8fdb338 _set_fmode 11 API calls 17272->17273 17274 7ff6f8fd51e7 17273->17274 17275 7ff6f8fc29e5 17274->17275 17276 7ff6f8fdec08 _set_fmode 11 API calls 17274->17276 17279 7ff6f8fd5227 17274->17279 17275->17216 17277 7ff6f8fd521c 17276->17277 17278 7ff6f8fda9b8 __free_lconv_num 11 API calls 17277->17278 17278->17279 17279->17275 17431 7ff6f8fdec90 17279->17431 17282 7ff6f8fda970 _isindst 17 API calls 17283 7ff6f8fd526c 17282->17283 17285 7ff6f8fc262f 17284->17285 17286 7ff6f8fc9400 2 API calls 17285->17286 17287 7ff6f8fc2660 17286->17287 17288 7ff6f8fc266f MessageBoxW 17287->17288 17289 7ff6f8fc2683 MessageBoxA 17287->17289 17290 7ff6f8fc2690 17288->17290 17289->17290 17291 7ff6f8fcc5c0 _log10_special 8 API calls 17290->17291 17292 7ff6f8fc26a0 17291->17292 17292->17220 17294 7ff6f8fd2cbe 17293->17294 17295 7ff6f8fd2cae 17293->17295 17296 7ff6f8fd2cc7 17294->17296 17301 7ff6f8fd2cf5 17294->17301 17297 7ff6f8fda884 _invalid_parameter_noinfo 37 API calls 17295->17297 17298 7ff6f8fda884 _invalid_parameter_noinfo 37 API calls 17296->17298 17299 7ff6f8fd2ced 17297->17299 17298->17299 17299->17261 17299->17266 17299->17267 17299->17270 17300 7ff6f8fd4830 45 API calls 17300->17301 17301->17295 17301->17299 17301->17300 17303 7ff6f8fd2fa4 17301->17303 17307 7ff6f8fd3610 17301->17307 17333 7ff6f8fd32d8 17301->17333 17363 7ff6f8fd2b60 17301->17363 17305 7ff6f8fda884 _invalid_parameter_noinfo 37 API calls 17303->17305 17305->17295 17308 7ff6f8fd3652 17307->17308 17309 7ff6f8fd36c5 17307->17309 17310 7ff6f8fd36ef 17308->17310 17311 7ff6f8fd3658 17308->17311 17312 7ff6f8fd371f 17309->17312 17313 7ff6f8fd36ca 17309->17313 17380 7ff6f8fd1bc0 17310->17380 17315 7ff6f8fd372e 17311->17315 17317 7ff6f8fd365d 17311->17317 17312->17310 17312->17315 17331 7ff6f8fd3688 17312->17331 17314 7ff6f8fd36ff 17313->17314 17320 7ff6f8fd36cc 17313->17320 17387 7ff6f8fd17b0 17314->17387 17332 7ff6f8fd375d 17315->17332 17394 7ff6f8fd1fd0 17315->17394 17321 7ff6f8fd36a0 17317->17321 17323 7ff6f8fd366d 17317->17323 17317->17331 17320->17323 17324 7ff6f8fd36db 17320->17324 17321->17332 17376 7ff6f8fd4430 17321->17376 17323->17332 17366 7ff6f8fd3f74 17323->17366 17324->17310 17325 7ff6f8fd36e0 17324->17325 17328 7ff6f8fd45c8 37 API calls 17325->17328 17325->17332 17327 7ff6f8fcc5c0 _log10_special 8 API calls 17329 7ff6f8fd39f3 17327->17329 17328->17331 17329->17301 17331->17332 17401 7ff6f8fde8c8 17331->17401 17332->17327 17334 7ff6f8fd32e3 17333->17334 17335 7ff6f8fd32f9 17333->17335 17336 7ff6f8fd3337 17334->17336 17337 7ff6f8fd3652 17334->17337 17338 7ff6f8fd36c5 17334->17338 17335->17336 17339 7ff6f8fda884 _invalid_parameter_noinfo 37 API calls 17335->17339 17336->17301 17340 7ff6f8fd36ef 17337->17340 17341 7ff6f8fd3658 17337->17341 17342 7ff6f8fd371f 17338->17342 17343 7ff6f8fd36ca 17338->17343 17339->17336 17346 7ff6f8fd1bc0 38 API calls 17340->17346 17349 7ff6f8fd365d 17341->17349 17351 7ff6f8fd372e 17341->17351 17342->17340 17342->17351 17361 7ff6f8fd3688 17342->17361 17344 7ff6f8fd36ff 17343->17344 17345 7ff6f8fd36cc 17343->17345 17347 7ff6f8fd17b0 38 API calls 17344->17347 17353 7ff6f8fd36db 17345->17353 17355 7ff6f8fd366d 17345->17355 17346->17361 17347->17361 17348 7ff6f8fd3f74 47 API calls 17348->17361 17350 7ff6f8fd36a0 17349->17350 17349->17355 17349->17361 17356 7ff6f8fd4430 47 API calls 17350->17356 17362 7ff6f8fd375d 17350->17362 17352 7ff6f8fd1fd0 38 API calls 17351->17352 17351->17362 17352->17361 17353->17340 17354 7ff6f8fd36e0 17353->17354 17358 7ff6f8fd45c8 37 API calls 17354->17358 17354->17362 17355->17348 17355->17362 17356->17361 17357 7ff6f8fcc5c0 _log10_special 8 API calls 17359 7ff6f8fd39f3 17357->17359 17358->17361 17359->17301 17360 7ff6f8fde8c8 47 API calls 17360->17361 17361->17360 17361->17362 17362->17357 17414 7ff6f8fd0d84 17363->17414 17367 7ff6f8fd3f96 17366->17367 17368 7ff6f8fd0bf0 12 API calls 17367->17368 17369 7ff6f8fd3fde 17368->17369 17370 7ff6f8fde5e0 46 API calls 17369->17370 17371 7ff6f8fd40b1 17370->17371 17372 7ff6f8fd4830 45 API calls 17371->17372 17374 7ff6f8fd40d3 17371->17374 17372->17374 17373 7ff6f8fd4830 45 API calls 17375 7ff6f8fd415c 17373->17375 17374->17373 17374->17374 17374->17375 17375->17331 17377 7ff6f8fd44b0 17376->17377 17378 7ff6f8fd4448 17376->17378 17377->17331 17378->17377 17379 7ff6f8fde8c8 47 API calls 17378->17379 17379->17377 17381 7ff6f8fd1bf3 17380->17381 17382 7ff6f8fd1c22 17381->17382 17384 7ff6f8fd1cdf 17381->17384 17383 7ff6f8fd0bf0 12 API calls 17382->17383 17386 7ff6f8fd1c5f 17382->17386 17383->17386 17385 7ff6f8fda884 _invalid_parameter_noinfo 37 API calls 17384->17385 17385->17386 17386->17331 17388 7ff6f8fd17e3 17387->17388 17389 7ff6f8fd1812 17388->17389 17391 7ff6f8fd18cf 17388->17391 17390 7ff6f8fd0bf0 12 API calls 17389->17390 17393 7ff6f8fd184f 17389->17393 17390->17393 17392 7ff6f8fda884 _invalid_parameter_noinfo 37 API calls 17391->17392 17392->17393 17393->17331 17395 7ff6f8fd2003 17394->17395 17396 7ff6f8fd2032 17395->17396 17398 7ff6f8fd20ef 17395->17398 17397 7ff6f8fd0bf0 12 API calls 17396->17397 17400 7ff6f8fd206f 17396->17400 17397->17400 17399 7ff6f8fda884 _invalid_parameter_noinfo 37 API calls 17398->17399 17399->17400 17400->17331 17403 7ff6f8fde8f0 17401->17403 17402 7ff6f8fde935 17406 7ff6f8fde8f5 __scrt_get_show_window_mode 17402->17406 17410 7ff6f8fde91e __scrt_get_show_window_mode 17402->17410 17411 7ff6f8fe0858 17402->17411 17403->17402 17404 7ff6f8fd4830 45 API calls 17403->17404 17403->17406 17403->17410 17404->17402 17405 7ff6f8fda884 _invalid_parameter_noinfo 37 API calls 17405->17406 17406->17331 17410->17405 17410->17406 17412 7ff6f8fe087c WideCharToMultiByte 17411->17412 17415 7ff6f8fd0dc3 17414->17415 17416 7ff6f8fd0db1 17414->17416 17419 7ff6f8fd0dd0 17415->17419 17422 7ff6f8fd0e0d 17415->17422 17417 7ff6f8fd4f78 _set_fmode 11 API calls 17416->17417 17418 7ff6f8fd0db6 17417->17418 17420 7ff6f8fda950 _invalid_parameter_noinfo 37 API calls 17418->17420 17421 7ff6f8fda884 _invalid_parameter_noinfo 37 API calls 17419->17421 17426 7ff6f8fd0dc1 17420->17426 17421->17426 17423 7ff6f8fd0eb6 17422->17423 17424 7ff6f8fd4f78 _set_fmode 11 API calls 17422->17424 17425 7ff6f8fd4f78 _set_fmode 11 API calls 17423->17425 17423->17426 17427 7ff6f8fd0eab 17424->17427 17428 7ff6f8fd0f60 17425->17428 17426->17301 17429 7ff6f8fda950 _invalid_parameter_noinfo 37 API calls 17427->17429 17430 7ff6f8fda950 _invalid_parameter_noinfo 37 API calls 17428->17430 17429->17423 17430->17426 17435 7ff6f8fdecad 17431->17435 17432 7ff6f8fdecb2 17433 7ff6f8fd524d 17432->17433 17434 7ff6f8fd4f78 _set_fmode 11 API calls 17432->17434 17433->17275 17433->17282 17436 7ff6f8fdecbc 17434->17436 17435->17432 17435->17433 17438 7ff6f8fdecfc 17435->17438 17437 7ff6f8fda950 _invalid_parameter_noinfo 37 API calls 17436->17437 17437->17433 17438->17433 17439 7ff6f8fd4f78 _set_fmode 11 API calls 17438->17439 17439->17436 17441 7ff6f8fd82b5 17440->17441 17442 7ff6f8fd82c8 17440->17442 17443 7ff6f8fd4f78 _set_fmode 11 API calls 17441->17443 17450 7ff6f8fd7f2c 17442->17450 17445 7ff6f8fd82ba 17443->17445 17447 7ff6f8fda950 _invalid_parameter_noinfo 37 API calls 17445->17447 17448 7ff6f8fd82c6 17447->17448 17448->16574 17457 7ff6f8fe0348 EnterCriticalSection 17450->17457 17459 7ff6f8fc8823 __std_exception_destroy 17458->17459 17460 7ff6f8fc87a1 GetTokenInformation 17458->17460 17463 7ff6f8fc883c 17459->17463 17464 7ff6f8fc8836 CloseHandle 17459->17464 17461 7ff6f8fc87c2 GetLastError 17460->17461 17462 7ff6f8fc87cd 17460->17462 17461->17459 17461->17462 17462->17459 17465 7ff6f8fc87e9 GetTokenInformation 17462->17465 17463->16579 17464->17463 17465->17459 17466 7ff6f8fc880c 17465->17466 17466->17459 17467 7ff6f8fc8816 ConvertSidToStringSidW 17466->17467 17467->17459 17469 7ff6f8fcc8c0 17468->17469 17470 7ff6f8fc2b74 GetCurrentProcessId 17469->17470 17471 7ff6f8fc26b0 48 API calls 17470->17471 17472 7ff6f8fc2bc7 17471->17472 17473 7ff6f8fd4c48 48 API calls 17472->17473 17474 7ff6f8fc2c10 MessageBoxW 17473->17474 17475 7ff6f8fcc5c0 _log10_special 8 API calls 17474->17475 17476 7ff6f8fc2c40 17475->17476 17476->16589 17478 7ff6f8fc25e5 17477->17478 17479 7ff6f8fd4c48 48 API calls 17478->17479 17480 7ff6f8fc2604 17479->17480 17480->16605 17516 7ff6f8fd8804 17481->17516 17485 7ff6f8fc81cc 17484->17485 17486 7ff6f8fc9400 2 API calls 17485->17486 17487 7ff6f8fc81eb 17486->17487 17488 7ff6f8fc81f3 17487->17488 17489 7ff6f8fc8206 ExpandEnvironmentStringsW 17487->17489 17490 7ff6f8fc2810 49 API calls 17488->17490 17491 7ff6f8fc822c __std_exception_destroy 17489->17491 17497 7ff6f8fc81ff __std_exception_destroy 17490->17497 17492 7ff6f8fc8243 17491->17492 17493 7ff6f8fc8230 17491->17493 17498 7ff6f8fc82af 17492->17498 17499 7ff6f8fc8251 GetDriveTypeW 17492->17499 17495 7ff6f8fc2810 49 API calls 17493->17495 17494 7ff6f8fcc5c0 _log10_special 8 API calls 17496 7ff6f8fc839f 17494->17496 17495->17497 17497->17494 17654 7ff6f8fd7e78 17498->17654 17502 7ff6f8fc8285 17499->17502 17503 7ff6f8fc82a0 17499->17503 17557 7ff6f8fe15c8 17516->17557 17616 7ff6f8fe1340 17557->17616 17637 7ff6f8fe0348 EnterCriticalSection 17616->17637 17756 7ff6f8fc455a 17755->17756 17757 7ff6f8fc9400 2 API calls 17756->17757 17758 7ff6f8fc457f 17757->17758 17759 7ff6f8fcc5c0 _log10_special 8 API calls 17758->17759 17760 7ff6f8fc45a7 17759->17760 17760->16640 17762 7ff6f8fc7e1e 17761->17762 17763 7ff6f8fc7f42 17762->17763 17764 7ff6f8fc1c80 49 API calls 17762->17764 17765 7ff6f8fcc5c0 _log10_special 8 API calls 17763->17765 17769 7ff6f8fc7ea5 17764->17769 17766 7ff6f8fc7f73 17765->17766 17766->16640 17767 7ff6f8fc1c80 49 API calls 17767->17769 17768 7ff6f8fc4550 10 API calls 17768->17769 17769->17763 17769->17767 17769->17768 17770 7ff6f8fc9400 2 API calls 17769->17770 17771 7ff6f8fc7f13 CreateDirectoryW 17770->17771 17771->17763 17771->17769 17773 7ff6f8fc1613 17772->17773 17774 7ff6f8fc1637 17772->17774 17895 7ff6f8fc1050 17773->17895 17776 7ff6f8fc45b0 108 API calls 17774->17776 17777 7ff6f8fc164b 17776->17777 17779 7ff6f8fc1653 17777->17779 17780 7ff6f8fc1682 17777->17780 17778 7ff6f8fc1618 17781 7ff6f8fc162e 17778->17781 17784 7ff6f8fc2710 54 API calls 17778->17784 17782 7ff6f8fd4f78 _set_fmode 11 API calls 17779->17782 17783 7ff6f8fc45b0 108 API calls 17780->17783 17781->16640 17785 7ff6f8fc1658 17782->17785 17786 7ff6f8fc1696 17783->17786 17784->17781 17787 7ff6f8fc2910 54 API calls 17785->17787 17788 7ff6f8fc169e 17786->17788 17789 7ff6f8fc16b8 17786->17789 17790 7ff6f8fc1671 17787->17790 17791 7ff6f8fc2710 54 API calls 17788->17791 17792 7ff6f8fd0744 73 API calls 17789->17792 17790->16640 17793 7ff6f8fc16ae 17791->17793 17794 7ff6f8fc16cd 17792->17794 17800 7ff6f8fd00bc 74 API calls 17793->17800 17795 7ff6f8fc16d1 17794->17795 17796 7ff6f8fc16f9 17794->17796 17797 7ff6f8fd4f78 _set_fmode 11 API calls 17795->17797 17798 7ff6f8fc16ff 17796->17798 17799 7ff6f8fc1717 17796->17799 17801 7ff6f8fc16d6 17797->17801 17871 7ff6f8fc1210 17798->17871 17805 7ff6f8fc1739 17799->17805 17815 7ff6f8fc1761 17799->17815 17803 7ff6f8fc1829 17800->17803 17803->16640 17822 7ff6f8fc717b 17820->17822 17823 7ff6f8fc7134 17820->17823 17822->16640 17823->17822 17963 7ff6f8fd5094 17823->17963 17825 7ff6f8fc4191 17824->17825 17826 7ff6f8fc44d0 49 API calls 17825->17826 17827 7ff6f8fc41cb 17826->17827 17828 7ff6f8fc44d0 49 API calls 17827->17828 17829 7ff6f8fc41db 17828->17829 17830 7ff6f8fc41fd 17829->17830 17831 7ff6f8fc422c 17829->17831 17994 7ff6f8fc4100 17830->17994 17832 7ff6f8fc4100 51 API calls 17831->17832 17834 7ff6f8fc422a 17832->17834 17835 7ff6f8fc4257 17834->17835 17836 7ff6f8fc428c 17834->17836 18001 7ff6f8fc7ce0 17835->18001 17838 7ff6f8fc4100 51 API calls 17836->17838 17840 7ff6f8fc42b0 17838->17840 17869 7ff6f8fc1c80 49 API calls 17868->17869 17870 7ff6f8fc4464 17869->17870 17870->16640 17896 7ff6f8fc45b0 108 API calls 17895->17896 17897 7ff6f8fc108c 17896->17897 17898 7ff6f8fc1094 17897->17898 17899 7ff6f8fc10a9 17897->17899 17900 7ff6f8fc2710 54 API calls 17898->17900 17901 7ff6f8fd0744 73 API calls 17899->17901 17907 7ff6f8fc10a4 __std_exception_destroy 17900->17907 17902 7ff6f8fc10bf 17901->17902 17903 7ff6f8fc10c3 17902->17903 17904 7ff6f8fc10e6 17902->17904 17905 7ff6f8fd4f78 _set_fmode 11 API calls 17903->17905 17909 7ff6f8fc1122 17904->17909 17910 7ff6f8fc10f7 17904->17910 17906 7ff6f8fc10c8 17905->17906 17908 7ff6f8fc2910 54 API calls 17906->17908 17907->17778 17917 7ff6f8fc10e1 __std_exception_destroy 17908->17917 17911 7ff6f8fc1129 17909->17911 17920 7ff6f8fc113c 17909->17920 17912 7ff6f8fd4f78 _set_fmode 11 API calls 17910->17912 17913 7ff6f8fc1210 92 API calls 17911->17913 17914 7ff6f8fc1100 17912->17914 17913->17917 17919 7ff6f8fd040c _fread_nolock 53 API calls 17919->17920 17920->17917 17920->17919 17922 7ff6f8fc11ed 17920->17922 17923 7ff6f8fd4f78 _set_fmode 11 API calls 17922->17923 17964 7ff6f8fd50ce 17963->17964 17965 7ff6f8fd50a1 17963->17965 17966 7ff6f8fd50f1 17964->17966 17969 7ff6f8fd510d 17964->17969 17967 7ff6f8fd4f78 _set_fmode 11 API calls 17965->17967 17974 7ff6f8fd5058 17965->17974 17968 7ff6f8fd4f78 _set_fmode 11 API calls 17966->17968 17970 7ff6f8fd50ab 17967->17970 17971 7ff6f8fd50f6 17968->17971 17978 7ff6f8fd4fbc 17969->17978 17973 7ff6f8fda950 _invalid_parameter_noinfo 37 API calls 17970->17973 17975 7ff6f8fda950 _invalid_parameter_noinfo 37 API calls 17971->17975 17976 7ff6f8fd50b6 17973->17976 17974->17823 17977 7ff6f8fd5101 17975->17977 17976->17823 17977->17823 17979 7ff6f8fd4fe0 17978->17979 17980 7ff6f8fd4fdb 17978->17980 17979->17980 17981 7ff6f8fdb1c0 __CxxCallCatchBlock 45 API calls 17979->17981 17980->17977 17982 7ff6f8fd4ffb 17981->17982 17986 7ff6f8fdd9f4 17982->17986 17987 7ff6f8fd501e 17986->17987 17988 7ff6f8fdda09 17986->17988 17990 7ff6f8fdda60 17987->17990 17988->17987 17989 7ff6f8fe3374 45 API calls 17988->17989 17989->17987 17991 7ff6f8fdda75 17990->17991 17992 7ff6f8fdda88 17990->17992 17991->17992 17992->17980 17995 7ff6f8fc4126 17994->17995 17996 7ff6f8fd49f4 49 API calls 17995->17996 17997 7ff6f8fc414c 17996->17997 17998 7ff6f8fc415d 17997->17998 17999 7ff6f8fc4550 10 API calls 17997->17999 17998->17834 18000 7ff6f8fc416f 17999->18000 18000->17834 18002 7ff6f8fc7cf5 18001->18002 18058 7ff6f8fd5f38 18057->18058 18059 7ff6f8fd5f5e 18058->18059 18062 7ff6f8fd5f91 18058->18062 18060 7ff6f8fd4f78 _set_fmode 11 API calls 18059->18060 18061 7ff6f8fd5f63 18060->18061 18063 7ff6f8fda950 _invalid_parameter_noinfo 37 API calls 18061->18063 18064 7ff6f8fd5fa4 18062->18064 18065 7ff6f8fd5f97 18062->18065 18068 7ff6f8fc4606 18063->18068 18076 7ff6f8fdac98 18064->18076 18066 7ff6f8fd4f78 _set_fmode 11 API calls 18065->18066 18066->18068 18068->16667 18089 7ff6f8fe0348 EnterCriticalSection 18076->18089 18449 7ff6f8fd7968 18448->18449 18452 7ff6f8fd7444 18449->18452 18451 7ff6f8fd7981 18451->16677 18453 7ff6f8fd748e 18452->18453 18454 7ff6f8fd745f 18452->18454 18462 7ff6f8fd54dc EnterCriticalSection 18453->18462 18455 7ff6f8fda884 _invalid_parameter_noinfo 37 API calls 18454->18455 18457 7ff6f8fd747f 18455->18457 18457->18451 18464 7ff6f8fcfeb3 18463->18464 18465 7ff6f8fcfee1 18463->18465 18466 7ff6f8fda884 _invalid_parameter_noinfo 37 API calls 18464->18466 18467 7ff6f8fcfed3 18465->18467 18473 7ff6f8fd54dc EnterCriticalSection 18465->18473 18466->18467 18467->16681 18475 7ff6f8fc45b0 108 API calls 18474->18475 18476 7ff6f8fc1493 18475->18476 18477 7ff6f8fc14bc 18476->18477 18478 7ff6f8fc149b 18476->18478 18479 7ff6f8fd0744 73 API calls 18477->18479 18480 7ff6f8fc2710 54 API calls 18478->18480 18481 7ff6f8fc14d1 18479->18481 18482 7ff6f8fc14ab 18480->18482 18483 7ff6f8fc14d5 18481->18483 18484 7ff6f8fc14f8 18481->18484 18482->16707 18485 7ff6f8fd4f78 _set_fmode 11 API calls 18483->18485 18488 7ff6f8fc1532 18484->18488 18489 7ff6f8fc1508 18484->18489 18581 7ff6f8fc6365 18580->18581 18582 7ff6f8fc1c80 49 API calls 18581->18582 18583 7ff6f8fc63a1 18582->18583 18584 7ff6f8fc63cd 18583->18584 18585 7ff6f8fc63aa 18583->18585 18587 7ff6f8fc4620 49 API calls 18584->18587 18586 7ff6f8fc2710 54 API calls 18585->18586 18603 7ff6f8fc63c3 18586->18603 18588 7ff6f8fc63e5 18587->18588 18589 7ff6f8fc6403 18588->18589 18590 7ff6f8fc2710 54 API calls 18588->18590 18591 7ff6f8fc4550 10 API calls 18589->18591 18590->18589 18593 7ff6f8fc640d 18591->18593 18592 7ff6f8fcc5c0 _log10_special 8 API calls 18594 7ff6f8fc336e 18592->18594 18595 7ff6f8fc641b 18593->18595 18596 7ff6f8fc9070 3 API calls 18593->18596 18594->16776 18611 7ff6f8fc64f0 18594->18611 18597 7ff6f8fc4620 49 API calls 18595->18597 18596->18595 18603->18592 18760 7ff6f8fc53f0 18611->18760 18762 7ff6f8fc541c 18760->18762 18761 7ff6f8fc5424 18762->18761 18765 7ff6f8fc55c4 18762->18765 18791 7ff6f8fd6b14 18762->18791 18868->16784

                                                                                                                                                                                                                  Executed Functions

                                                                                                                                                                                                                  Function 00007FF6F8FC8BD0 Relevance: 70.3, APIs: 36, Strings: 4, Instructions: 257synchronizationwindowregistryCOMMON
                                                                                                                                                                                                                  Download Yara Rule

                                                                                                                                                                                                                  Control-flow Graph

                                                                                                                                                                                                                  • Executed
                                                                                                                                                                                                                  • Not Executed
                                                                                                                                                                                                                  control_flow_graph 0 7ff6f8fc8bd0-7ff6f8fc8d16 call 7ff6f8fcc8c0 call 7ff6f8fc9400 SetConsoleCtrlHandler GetStartupInfoW call 7ff6f8fd5460 call 7ff6f8fda4ec call 7ff6f8fd878c call 7ff6f8fd5460 call 7ff6f8fda4ec call 7ff6f8fd878c call 7ff6f8fd5460 call 7ff6f8fda4ec call 7ff6f8fd878c GetCommandLineW CreateProcessW 23 7ff6f8fc8d3d-7ff6f8fc8d79 RegisterClassW 0->23 24 7ff6f8fc8d18-7ff6f8fc8d38 GetLastError call 7ff6f8fc2c50 0->24 25 7ff6f8fc8d81-7ff6f8fc8dd5 CreateWindowExW 23->25 26 7ff6f8fc8d7b GetLastError 23->26 31 7ff6f8fc9029-7ff6f8fc904f call 7ff6f8fcc5c0 24->31 29 7ff6f8fc8ddf-7ff6f8fc8de4 ShowWindow 25->29 30 7ff6f8fc8dd7-7ff6f8fc8ddd GetLastError 25->30 26->25 32 7ff6f8fc8dea-7ff6f8fc8dfa WaitForSingleObject 29->32 30->32 34 7ff6f8fc8dfc 32->34 35 7ff6f8fc8e78-7ff6f8fc8e7f 32->35 37 7ff6f8fc8e00-7ff6f8fc8e03 34->37 38 7ff6f8fc8ec2-7ff6f8fc8ec9 35->38 39 7ff6f8fc8e81-7ff6f8fc8e91 WaitForSingleObject 35->39 44 7ff6f8fc8e05 GetLastError 37->44 45 7ff6f8fc8e0b-7ff6f8fc8e12 37->45 42 7ff6f8fc8ecf-7ff6f8fc8ee5 QueryPerformanceFrequency QueryPerformanceCounter 38->42 43 7ff6f8fc8fb0-7ff6f8fc8fc9 GetMessageW 38->43 40 7ff6f8fc8e97-7ff6f8fc8ea7 TerminateProcess 39->40 41 7ff6f8fc8fe8-7ff6f8fc8ff2 39->41 48 7ff6f8fc8eaf-7ff6f8fc8ebd WaitForSingleObject 40->48 49 7ff6f8fc8ea9 GetLastError 40->49 46 7ff6f8fc8ff4-7ff6f8fc8ffa DestroyWindow 41->46 47 7ff6f8fc9001-7ff6f8fc9025 GetExitCodeProcess CloseHandle * 2 41->47 50 7ff6f8fc8ef0-7ff6f8fc8f28 MsgWaitForMultipleObjects PeekMessageW 42->50 52 7ff6f8fc8fdf-7ff6f8fc8fe6 43->52 53 7ff6f8fc8fcb-7ff6f8fc8fd9 TranslateMessage DispatchMessageW 43->53 44->45 45->39 51 7ff6f8fc8e14-7ff6f8fc8e31 PeekMessageW 45->51 46->47 47->31 48->41 49->48 54 7ff6f8fc8f63-7ff6f8fc8f6a 50->54 55 7ff6f8fc8f2a 50->55 56 7ff6f8fc8e33-7ff6f8fc8e64 TranslateMessage DispatchMessageW PeekMessageW 51->56 57 7ff6f8fc8e66-7ff6f8fc8e76 WaitForSingleObject 51->57 52->41 52->43 53->52 54->43 59 7ff6f8fc8f6c-7ff6f8fc8f95 QueryPerformanceCounter 54->59 58 7ff6f8fc8f30-7ff6f8fc8f61 TranslateMessage DispatchMessageW PeekMessageW 55->58 56->56 56->57 57->35 57->37 58->54 58->58 59->50 60 7ff6f8fc8f9b-7ff6f8fc8fa2 59->60 60->41 61 7ff6f8fc8fa4-7ff6f8fc8fa8 60->61 61->43
                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                  Strings
                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                  • Source File: 00000000.00000002.1809060909.00007FF6F8FC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6F8FC0000, based on PE: true
                                                                                                                                                                                                                  • Associated: 00000000.00000002.1809003889.00007FF6F8FC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                  • Associated: 00000000.00000002.1809090760.00007FF6F8FEB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                  • Associated: 00000000.00000002.1809148599.00007FF6F8FFE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                  • Associated: 00000000.00000002.1809148599.00007FF6F9002000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                  • Associated: 00000000.00000002.1809223271.00007FF6F9004000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                  • Snapshot File: hcaresult_0_2_7ff6f8fc0000_dipwo1iToJ.jbxd
                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                  • API ID: Message$ErrorLast$ObjectProcessSingleWait$CloseCreateHandlePeekWindow_invalid_parameter_noinfo$ByteCharClassCodeCommandConsoleCtrlCurrentDestroyDispatchExitFormatHandlerInfoLineMultiRegisterStartupTerminateTranslateWide
                                                                                                                                                                                                                  • String ID: CreateProcessW$Failed to create child process!$PyInstaller Onefile Hidden Window$PyInstallerOnefileHiddenWindow
                                                                                                                                                                                                                  • API String ID: 3832162212-3165540532
                                                                                                                                                                                                                  • Opcode ID: f1b4a1f9842ac9cce6b2798ee34386867a7882a0850fd65476f94626d3f01840
                                                                                                                                                                                                                  • Instruction ID: f84bfb7af08be18d5aa9c5442da81fab72959eb7f67b1ea49a117f63d9bcd627
                                                                                                                                                                                                                  • Opcode Fuzzy Hash: f1b4a1f9842ac9cce6b2798ee34386867a7882a0850fd65476f94626d3f01840
                                                                                                                                                                                                                  • Instruction Fuzzy Hash: DED19632B1AB428AE7109F74E8542AD3761FF85BA8F400175DA6D93AD5EF3CD244D708
                                                                                                                                                                                                                  Function 00007FF6F8FC1000 Relevance: 61.8, APIs: 7, Strings: 28, Instructions: 509COMMON
                                                                                                                                                                                                                  Download Yara Rule

                                                                                                                                                                                                                  Control-flow Graph

                                                                                                                                                                                                                  • Executed
                                                                                                                                                                                                                  • Not Executed
                                                                                                                                                                                                                  control_flow_graph 62 7ff6f8fc1000-7ff6f8fc3806 call 7ff6f8fcfe88 call 7ff6f8fcfe90 call 7ff6f8fcc8c0 call 7ff6f8fd5460 call 7ff6f8fd54f4 call 7ff6f8fc36b0 76 7ff6f8fc3814-7ff6f8fc3836 call 7ff6f8fc1950 62->76 77 7ff6f8fc3808-7ff6f8fc380f 62->77 82 7ff6f8fc383c-7ff6f8fc3856 call 7ff6f8fc1c80 76->82 83 7ff6f8fc391b-7ff6f8fc3931 call 7ff6f8fc45b0 76->83 78 7ff6f8fc3c97-7ff6f8fc3cb2 call 7ff6f8fcc5c0 77->78 87 7ff6f8fc385b-7ff6f8fc389b call 7ff6f8fc8a20 82->87 90 7ff6f8fc3933-7ff6f8fc3960 call 7ff6f8fc7f80 83->90 91 7ff6f8fc396a-7ff6f8fc397f call 7ff6f8fc2710 83->91 97 7ff6f8fc38c1-7ff6f8fc38cc call 7ff6f8fd4fa0 87->97 98 7ff6f8fc389d-7ff6f8fc38a3 87->98 99 7ff6f8fc3984-7ff6f8fc39a6 call 7ff6f8fc1c80 90->99 100 7ff6f8fc3962-7ff6f8fc3965 call 7ff6f8fd00bc 90->100 101 7ff6f8fc3c8f 91->101 109 7ff6f8fc38d2-7ff6f8fc38e1 call 7ff6f8fc8a20 97->109 110 7ff6f8fc39fc-7ff6f8fc3a2a call 7ff6f8fc8b30 call 7ff6f8fc8b90 * 3 97->110 102 7ff6f8fc38af-7ff6f8fc38bd call 7ff6f8fc8b90 98->102 103 7ff6f8fc38a5-7ff6f8fc38ad 98->103 115 7ff6f8fc39b0-7ff6f8fc39b9 99->115 100->91 101->78 102->97 103->102 119 7ff6f8fc39f4-7ff6f8fc39f7 call 7ff6f8fd4fa0 109->119 120 7ff6f8fc38e7-7ff6f8fc38ed 109->120 138 7ff6f8fc3a2f-7ff6f8fc3a3e call 7ff6f8fc8a20 110->138 115->115 118 7ff6f8fc39bb-7ff6f8fc39d8 call 7ff6f8fc1950 115->118 118->87 130 7ff6f8fc39de-7ff6f8fc39ef call 7ff6f8fc2710 118->130 119->110 124 7ff6f8fc38f0-7ff6f8fc38fc 120->124 127 7ff6f8fc38fe-7ff6f8fc3903 124->127 128 7ff6f8fc3905-7ff6f8fc3908 124->128 127->124 127->128 128->119 131 7ff6f8fc390e-7ff6f8fc3916 call 7ff6f8fd4fa0 128->131 130->101 131->138 141 7ff6f8fc3b45-7ff6f8fc3b53 138->141 142 7ff6f8fc3a44-7ff6f8fc3a47 138->142 143 7ff6f8fc3b59-7ff6f8fc3b5d 141->143 144 7ff6f8fc3a67 141->144 142->141 145 7ff6f8fc3a4d-7ff6f8fc3a50 142->145 146 7ff6f8fc3a6b-7ff6f8fc3a90 call 7ff6f8fd4fa0 143->146 144->146 147 7ff6f8fc3b14-7ff6f8fc3b17 145->147 148 7ff6f8fc3a56-7ff6f8fc3a5a 145->148 157 7ff6f8fc3a92-7ff6f8fc3aa6 call 7ff6f8fc8b30 146->157 158 7ff6f8fc3aab-7ff6f8fc3ac0 146->158 150 7ff6f8fc3b2f-7ff6f8fc3b40 call 7ff6f8fc2710 147->150 151 7ff6f8fc3b19-7ff6f8fc3b1d 147->151 148->147 149 7ff6f8fc3a60 148->149 149->144 159 7ff6f8fc3c7f-7ff6f8fc3c87 150->159 151->150 153 7ff6f8fc3b1f-7ff6f8fc3b2a 151->153 153->146 157->158 161 7ff6f8fc3be8-7ff6f8fc3bfa call 7ff6f8fc8a20 158->161 162 7ff6f8fc3ac6-7ff6f8fc3aca 158->162 159->101 170 7ff6f8fc3c2e 161->170 171 7ff6f8fc3bfc-7ff6f8fc3c02 161->171 164 7ff6f8fc3ad0-7ff6f8fc3ae8 call 7ff6f8fd52c0 162->164 165 7ff6f8fc3bcd-7ff6f8fc3be2 call 7ff6f8fc1940 162->165 175 7ff6f8fc3b62-7ff6f8fc3b7a call 7ff6f8fd52c0 164->175 176 7ff6f8fc3aea-7ff6f8fc3b02 call 7ff6f8fd52c0 164->176 165->161 165->162 177 7ff6f8fc3c31-7ff6f8fc3c40 call 7ff6f8fd4fa0 170->177 173 7ff6f8fc3c1e-7ff6f8fc3c2c 171->173 174 7ff6f8fc3c04-7ff6f8fc3c1c 171->174 173->177 174->177 186 7ff6f8fc3b87-7ff6f8fc3b9f call 7ff6f8fd52c0 175->186 187 7ff6f8fc3b7c-7ff6f8fc3b80 175->187 176->165 188 7ff6f8fc3b08-7ff6f8fc3b0f 176->188 184 7ff6f8fc3d41-7ff6f8fc3d63 call 7ff6f8fc44d0 177->184 185 7ff6f8fc3c46-7ff6f8fc3c4a 177->185 199 7ff6f8fc3d71-7ff6f8fc3d82 call 7ff6f8fc1c80 184->199 200 7ff6f8fc3d65-7ff6f8fc3d6f call 7ff6f8fc4620 184->200 189 7ff6f8fc3c50-7ff6f8fc3c5f call 7ff6f8fc90e0 185->189 190 7ff6f8fc3cd4-7ff6f8fc3ce6 call 7ff6f8fc8a20 185->190 201 7ff6f8fc3ba1-7ff6f8fc3ba5 186->201 202 7ff6f8fc3bac-7ff6f8fc3bc4 call 7ff6f8fd52c0 186->202 187->186 188->165 204 7ff6f8fc3c61 189->204 205 7ff6f8fc3cb3-7ff6f8fc3cb6 call 7ff6f8fc8850 189->205 206 7ff6f8fc3d35-7ff6f8fc3d3c 190->206 207 7ff6f8fc3ce8-7ff6f8fc3ceb 190->207 214 7ff6f8fc3d87-7ff6f8fc3d96 199->214 200->214 201->202 202->165 217 7ff6f8fc3bc6 202->217 211 7ff6f8fc3c68 call 7ff6f8fc2710 204->211 216 7ff6f8fc3cbb-7ff6f8fc3cbd 205->216 206->211 207->206 212 7ff6f8fc3ced-7ff6f8fc3d10 call 7ff6f8fc1c80 207->212 225 7ff6f8fc3c6d-7ff6f8fc3c77 211->225 229 7ff6f8fc3d12-7ff6f8fc3d26 call 7ff6f8fc2710 call 7ff6f8fd4fa0 212->229 230 7ff6f8fc3d2b-7ff6f8fc3d33 call 7ff6f8fd4fa0 212->230 220 7ff6f8fc3dc4-7ff6f8fc3dda call 7ff6f8fc9400 214->220 221 7ff6f8fc3d98-7ff6f8fc3d9f 214->221 223 7ff6f8fc3cbf-7ff6f8fc3cc6 216->223 224 7ff6f8fc3cc8-7ff6f8fc3ccf 216->224 217->165 233 7ff6f8fc3de8-7ff6f8fc3e04 SetDllDirectoryW 220->233 234 7ff6f8fc3ddc 220->234 221->220 227 7ff6f8fc3da1-7ff6f8fc3da5 221->227 223->211 224->214 225->159 227->220 231 7ff6f8fc3da7-7ff6f8fc3dbe SetDllDirectoryW LoadLibraryExW 227->231 229->225 230->214 231->220 237 7ff6f8fc3f01-7ff6f8fc3f08 233->237 238 7ff6f8fc3e0a-7ff6f8fc3e19 call 7ff6f8fc8a20 233->238 234->233 240 7ff6f8fc3f0e-7ff6f8fc3f15 237->240 241 7ff6f8fc3ffc-7ff6f8fc4004 237->241 251 7ff6f8fc3e32-7ff6f8fc3e3c call 7ff6f8fd4fa0 238->251 252 7ff6f8fc3e1b-7ff6f8fc3e21 238->252 240->241 244 7ff6f8fc3f1b-7ff6f8fc3f25 call 7ff6f8fc33c0 240->244 245 7ff6f8fc4029-7ff6f8fc405b call 7ff6f8fc36a0 call 7ff6f8fc3360 call 7ff6f8fc3670 call 7ff6f8fc6fb0 call 7ff6f8fc6d60 241->245 246 7ff6f8fc4006-7ff6f8fc4023 PostMessageW GetMessageW 241->246 244->225 258 7ff6f8fc3f2b-7ff6f8fc3f3f call 7ff6f8fc90c0 244->258 246->245 263 7ff6f8fc3ef2-7ff6f8fc3efc call 7ff6f8fc8b30 251->263 264 7ff6f8fc3e42-7ff6f8fc3e48 251->264 255 7ff6f8fc3e23-7ff6f8fc3e2b 252->255 256 7ff6f8fc3e2d-7ff6f8fc3e2f 252->256 255->256 256->251 271 7ff6f8fc3f41-7ff6f8fc3f5e PostMessageW GetMessageW 258->271 272 7ff6f8fc3f64-7ff6f8fc3fa0 call 7ff6f8fc8b30 call 7ff6f8fc8bd0 call 7ff6f8fc6fb0 call 7ff6f8fc6d60 call 7ff6f8fc8ad0 258->272 263->237 264->263 268 7ff6f8fc3e4e-7ff6f8fc3e54 264->268 269 7ff6f8fc3e5f-7ff6f8fc3e61 268->269 270 7ff6f8fc3e56-7ff6f8fc3e58 268->270 269->237 274 7ff6f8fc3e67-7ff6f8fc3e83 call 7ff6f8fc6db0 call 7ff6f8fc7330 269->274 270->274 275 7ff6f8fc3e5a 270->275 271->272 306 7ff6f8fc3fa5-7ff6f8fc3fa7 272->306 289 7ff6f8fc3e8e-7ff6f8fc3e95 274->289 290 7ff6f8fc3e85-7ff6f8fc3e8c 274->290 275->237 293 7ff6f8fc3eaf-7ff6f8fc3eb9 call 7ff6f8fc71a0 289->293 294 7ff6f8fc3e97-7ff6f8fc3ea4 call 7ff6f8fc6df0 289->294 292 7ff6f8fc3edb-7ff6f8fc3ef0 call 7ff6f8fc2a50 call 7ff6f8fc6fb0 call 7ff6f8fc6d60 290->292 292->237 304 7ff6f8fc3ec4-7ff6f8fc3ed2 call 7ff6f8fc74e0 293->304 305 7ff6f8fc3ebb-7ff6f8fc3ec2 293->305 294->293 308 7ff6f8fc3ea6-7ff6f8fc3ead 294->308 304->237 318 7ff6f8fc3ed4 304->318 305->292 310 7ff6f8fc3fe9-7ff6f8fc3ff7 call 7ff6f8fc1900 306->310 311 7ff6f8fc3fa9-7ff6f8fc3fb3 call 7ff6f8fc9200 306->311 308->292 310->225 311->310 321 7ff6f8fc3fb5-7ff6f8fc3fca 311->321 318->292 322 7ff6f8fc3fe4 call 7ff6f8fc2a50 321->322 323 7ff6f8fc3fcc-7ff6f8fc3fdf call 7ff6f8fc2710 call 7ff6f8fc1900 321->323 322->310 323->225
                                                                                                                                                                                                                  Strings
                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                  • Source File: 00000000.00000002.1809060909.00007FF6F8FC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6F8FC0000, based on PE: true
                                                                                                                                                                                                                  • Associated: 00000000.00000002.1809003889.00007FF6F8FC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                  • Associated: 00000000.00000002.1809090760.00007FF6F8FEB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                  • Associated: 00000000.00000002.1809148599.00007FF6F8FFE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                  • Associated: 00000000.00000002.1809148599.00007FF6F9002000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                  • Associated: 00000000.00000002.1809223271.00007FF6F9004000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                  • Snapshot File: hcaresult_0_2_7ff6f8fc0000_dipwo1iToJ.jbxd
                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                  • API ID: ErrorFileLastModuleName
                                                                                                                                                                                                                  • String ID: Could not create temporary directory!$Could not load PyInstaller's embedded PKG archive from the executable (%s)$Could not side-load PyInstaller's PKG archive from external file (%s)$Failed to convert DLL search path!$Failed to initialize security descriptor for temporary directory!$Failed to load Tcl/Tk shared libraries for splash screen!$Failed to load splash screen resources!$Failed to remove temporary directory: %s$Failed to start splash screen!$Failed to unpack splash screen dependencies from PKG archive!$Invalid value in _PYI_PARENT_PROCESS_LEVEL: %s$MEI$PYINSTALLER_RESET_ENVIRONMENT$PYINSTALLER_STRICT_UNPACK_MODE$PYINSTALLER_SUPPRESS_SPLASH_SCREEN$Path exceeds PYI_PATH_MAX limit.$Py_GIL_DISABLED$VCRUNTIME140.dll$_PYI_APPLICATION_HOME_DIR$_PYI_APPLICATION_HOME_DIR not set for onefile child process!$_PYI_ARCHIVE_FILE$_PYI_PARENT_PROCESS_LEVEL$_PYI_SPLASH_IPC$pkg$pyi-contents-directory$pyi-disable-windowed-traceback$pyi-python-flag$pyi-runtime-tmpdir
                                                                                                                                                                                                                  • API String ID: 2776309574-4232158417
                                                                                                                                                                                                                  • Opcode ID: 230e5f2fbe18b706386c2e6c5de042c78cdf1bdf29ac743ce162c0a9040f007d
                                                                                                                                                                                                                  • Instruction ID: 509ec870e1c6db84bc4fff078b1bd943882bb168dbe9525d59cf2b482609542b
                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 230e5f2fbe18b706386c2e6c5de042c78cdf1bdf29ac743ce162c0a9040f007d
                                                                                                                                                                                                                  • Instruction Fuzzy Hash: F832A031A1E6825AFB15DB3194546B966A1AF467E0F8440B1DA7DC32C3FF2CE758E308
                                                                                                                                                                                                                  Function 00007FF6F8FE5C70 Relevance: 14.3, APIs: 6, Strings: 2, Instructions: 334timeCOMMON
                                                                                                                                                                                                                  Download Yara Rule

                                                                                                                                                                                                                  Control-flow Graph

                                                                                                                                                                                                                  • Executed
                                                                                                                                                                                                                  • Not Executed
                                                                                                                                                                                                                  control_flow_graph 477 7ff6f8fe5c70-7ff6f8fe5cab call 7ff6f8fe55f8 call 7ff6f8fe5600 call 7ff6f8fe5668 484 7ff6f8fe5ed5-7ff6f8fe5f21 call 7ff6f8fda970 call 7ff6f8fe55f8 call 7ff6f8fe5600 call 7ff6f8fe5668 477->484 485 7ff6f8fe5cb1-7ff6f8fe5cbc call 7ff6f8fe5608 477->485 511 7ff6f8fe605f-7ff6f8fe60cd call 7ff6f8fda970 call 7ff6f8fe15e8 484->511 512 7ff6f8fe5f27-7ff6f8fe5f32 call 7ff6f8fe5608 484->512 485->484 490 7ff6f8fe5cc2-7ff6f8fe5ccc 485->490 493 7ff6f8fe5cee-7ff6f8fe5cf2 490->493 494 7ff6f8fe5cce-7ff6f8fe5cd1 490->494 495 7ff6f8fe5cf5-7ff6f8fe5cfd 493->495 497 7ff6f8fe5cd4-7ff6f8fe5cdf 494->497 495->495 498 7ff6f8fe5cff-7ff6f8fe5d12 call 7ff6f8fdd66c 495->498 500 7ff6f8fe5ce1-7ff6f8fe5ce8 497->500 501 7ff6f8fe5cea-7ff6f8fe5cec 497->501 507 7ff6f8fe5d14-7ff6f8fe5d16 call 7ff6f8fda9b8 498->507 508 7ff6f8fe5d2a-7ff6f8fe5d36 call 7ff6f8fda9b8 498->508 500->497 500->501 501->493 504 7ff6f8fe5d1b-7ff6f8fe5d29 501->504 507->504 518 7ff6f8fe5d3d-7ff6f8fe5d45 508->518 529 7ff6f8fe60cf-7ff6f8fe60d6 511->529 530 7ff6f8fe60db-7ff6f8fe60de 511->530 512->511 520 7ff6f8fe5f38-7ff6f8fe5f43 call 7ff6f8fe5638 512->520 518->518 521 7ff6f8fe5d47-7ff6f8fe5d58 call 7ff6f8fe04e4 518->521 520->511 531 7ff6f8fe5f49-7ff6f8fe5f6c call 7ff6f8fda9b8 GetTimeZoneInformation 520->531 521->484 532 7ff6f8fe5d5e-7ff6f8fe5db4 call 7ff6f8fea540 * 4 call 7ff6f8fe5b8c 521->532 533 7ff6f8fe616b-7ff6f8fe616e 529->533 534 7ff6f8fe6115-7ff6f8fe6128 call 7ff6f8fdd66c 530->534 535 7ff6f8fe60e0 530->535 548 7ff6f8fe5f72-7ff6f8fe5f93 531->548 549 7ff6f8fe6034-7ff6f8fe605e call 7ff6f8fe55f0 call 7ff6f8fe55e0 call 7ff6f8fe55e8 531->549 589 7ff6f8fe5db6-7ff6f8fe5dba 532->589 539 7ff6f8fe60e3 533->539 540 7ff6f8fe6174-7ff6f8fe617c call 7ff6f8fe5c70 533->540 556 7ff6f8fe6133-7ff6f8fe614e call 7ff6f8fe15e8 534->556 557 7ff6f8fe612a 534->557 535->539 544 7ff6f8fe60e8-7ff6f8fe6114 call 7ff6f8fda9b8 call 7ff6f8fcc5c0 539->544 545 7ff6f8fe60e3 call 7ff6f8fe5eec 539->545 540->544 545->544 550 7ff6f8fe5f95-7ff6f8fe5f9b 548->550 551 7ff6f8fe5f9e-7ff6f8fe5fa5 548->551 550->551 559 7ff6f8fe5fa7-7ff6f8fe5faf 551->559 560 7ff6f8fe5fb9 551->560 572 7ff6f8fe6155-7ff6f8fe6167 call 7ff6f8fda9b8 556->572 573 7ff6f8fe6150-7ff6f8fe6153 556->573 564 7ff6f8fe612c-7ff6f8fe6131 call 7ff6f8fda9b8 557->564 559->560 566 7ff6f8fe5fb1-7ff6f8fe5fb7 559->566 569 7ff6f8fe5fbb-7ff6f8fe602f call 7ff6f8fea540 * 4 call 7ff6f8fe2bcc call 7ff6f8fe6184 * 2 560->569 564->535 566->569 569->549 572->533 573->564 591 7ff6f8fe5dc0-7ff6f8fe5dc4 589->591 592 7ff6f8fe5dbc 589->592 591->589 594 7ff6f8fe5dc6-7ff6f8fe5deb call 7ff6f8fd6bc8 591->594 592->591 600 7ff6f8fe5dee-7ff6f8fe5df2 594->600 602 7ff6f8fe5df4-7ff6f8fe5dff 600->602 603 7ff6f8fe5e01-7ff6f8fe5e05 600->603 602->603 605 7ff6f8fe5e07-7ff6f8fe5e0b 602->605 603->600 608 7ff6f8fe5e0d-7ff6f8fe5e35 call 7ff6f8fd6bc8 605->608 609 7ff6f8fe5e8c-7ff6f8fe5e90 605->609 617 7ff6f8fe5e53-7ff6f8fe5e57 608->617 618 7ff6f8fe5e37 608->618 610 7ff6f8fe5e92-7ff6f8fe5e94 609->610 611 7ff6f8fe5e97-7ff6f8fe5ea4 609->611 610->611 613 7ff6f8fe5ebf-7ff6f8fe5ece call 7ff6f8fe55f0 call 7ff6f8fe55e0 611->613 614 7ff6f8fe5ea6-7ff6f8fe5ebc call 7ff6f8fe5b8c 611->614 613->484 614->613 617->609 623 7ff6f8fe5e59-7ff6f8fe5e77 call 7ff6f8fd6bc8 617->623 621 7ff6f8fe5e3a-7ff6f8fe5e41 618->621 621->617 624 7ff6f8fe5e43-7ff6f8fe5e51 621->624 629 7ff6f8fe5e83-7ff6f8fe5e8a 623->629 624->617 624->621 629->609 630 7ff6f8fe5e79-7ff6f8fe5e7d 629->630 630->609 631 7ff6f8fe5e7f 630->631 631->629
                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                  • _get_daylight.LIBCMT ref: 00007FF6F8FE5CB5
                                                                                                                                                                                                                    • Part of subcall function 00007FF6F8FE5608: _invalid_parameter_noinfo.LIBCMT ref: 00007FF6F8FE561C
                                                                                                                                                                                                                    • Part of subcall function 00007FF6F8FDA9B8: RtlFreeHeap.NTDLL(?,?,?,00007FF6F8FE2D92,?,?,?,00007FF6F8FE2DCF,?,?,00000000,00007FF6F8FE3295,?,?,?,00007FF6F8FE31C7), ref: 00007FF6F8FDA9CE
                                                                                                                                                                                                                    • Part of subcall function 00007FF6F8FDA9B8: GetLastError.KERNEL32(?,?,?,00007FF6F8FE2D92,?,?,?,00007FF6F8FE2DCF,?,?,00000000,00007FF6F8FE3295,?,?,?,00007FF6F8FE31C7), ref: 00007FF6F8FDA9D8
                                                                                                                                                                                                                    • Part of subcall function 00007FF6F8FDA970: IsProcessorFeaturePresent.KERNEL32(?,?,?,?,00007FF6F8FDA94F,?,?,?,?,?,00007FF6F8FDA83A), ref: 00007FF6F8FDA979
                                                                                                                                                                                                                    • Part of subcall function 00007FF6F8FDA970: GetCurrentProcess.KERNEL32(?,?,?,?,00007FF6F8FDA94F,?,?,?,?,?,00007FF6F8FDA83A), ref: 00007FF6F8FDA99E
                                                                                                                                                                                                                  • _get_daylight.LIBCMT ref: 00007FF6F8FE5CA4
                                                                                                                                                                                                                    • Part of subcall function 00007FF6F8FE5668: _invalid_parameter_noinfo.LIBCMT ref: 00007FF6F8FE567C
                                                                                                                                                                                                                  • _get_daylight.LIBCMT ref: 00007FF6F8FE5F1A
                                                                                                                                                                                                                  • _get_daylight.LIBCMT ref: 00007FF6F8FE5F2B
                                                                                                                                                                                                                  • _get_daylight.LIBCMT ref: 00007FF6F8FE5F3C
                                                                                                                                                                                                                  • GetTimeZoneInformation.KERNELBASE(?,?,?,?,?,?,?,?,?,00000000,?,00007FF6F8FE617C), ref: 00007FF6F8FE5F63
                                                                                                                                                                                                                  Strings
                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                  • Source File: 00000000.00000002.1809060909.00007FF6F8FC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6F8FC0000, based on PE: true
                                                                                                                                                                                                                  • Associated: 00000000.00000002.1809003889.00007FF6F8FC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                  • Associated: 00000000.00000002.1809090760.00007FF6F8FEB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                  • Associated: 00000000.00000002.1809148599.00007FF6F8FFE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                  • Associated: 00000000.00000002.1809148599.00007FF6F9002000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                  • Associated: 00000000.00000002.1809223271.00007FF6F9004000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                  • Snapshot File: hcaresult_0_2_7ff6f8fc0000_dipwo1iToJ.jbxd
                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                  • API ID: _get_daylight$_invalid_parameter_noinfo$CurrentErrorFeatureFreeHeapInformationLastPresentProcessProcessorTimeZone
                                                                                                                                                                                                                  • String ID: Eastern Standard Time$Eastern Summer Time
                                                                                                                                                                                                                  • API String ID: 4070488512-239921721
                                                                                                                                                                                                                  • Opcode ID: 76424cc0ec02945f4fd2ccc640ea60475aa997d4131cc6c9dd67359800dfdabb
                                                                                                                                                                                                                  • Instruction ID: ab34d600d7f3d3b856a08dc34da618d4ca083411129ba88941a5ad10176a95a7
                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 76424cc0ec02945f4fd2ccc640ea60475aa997d4131cc6c9dd67359800dfdabb
                                                                                                                                                                                                                  • Instruction Fuzzy Hash: DED1E132A0A2524AE720AF35DC611B96351EF887E4F448176EA2DC76D5FF3CE441E748
                                                                                                                                                                                                                  Function 00007FF6F8FE69D4 Relevance: 13.8, APIs: 9, Instructions: 276fileCOMMON
                                                                                                                                                                                                                  Download Yara Rule

                                                                                                                                                                                                                  Control-flow Graph

                                                                                                                                                                                                                  • Executed
                                                                                                                                                                                                                  • Not Executed
                                                                                                                                                                                                                  control_flow_graph 691 7ff6f8fe69d4-7ff6f8fe6a47 call 7ff6f8fe6708 694 7ff6f8fe6a61-7ff6f8fe6a6b call 7ff6f8fd8590 691->694 695 7ff6f8fe6a49-7ff6f8fe6a52 call 7ff6f8fd4f58 691->695 701 7ff6f8fe6a6d-7ff6f8fe6a84 call 7ff6f8fd4f58 call 7ff6f8fd4f78 694->701 702 7ff6f8fe6a86-7ff6f8fe6aef CreateFileW 694->702 700 7ff6f8fe6a55-7ff6f8fe6a5c call 7ff6f8fd4f78 695->700 714 7ff6f8fe6da2-7ff6f8fe6dc2 700->714 701->700 705 7ff6f8fe6af1-7ff6f8fe6af7 702->705 706 7ff6f8fe6b6c-7ff6f8fe6b77 GetFileType 702->706 711 7ff6f8fe6b39-7ff6f8fe6b67 GetLastError call 7ff6f8fd4eec 705->711 712 7ff6f8fe6af9-7ff6f8fe6afd 705->712 708 7ff6f8fe6bca-7ff6f8fe6bd1 706->708 709 7ff6f8fe6b79-7ff6f8fe6bb4 GetLastError call 7ff6f8fd4eec CloseHandle 706->709 717 7ff6f8fe6bd3-7ff6f8fe6bd7 708->717 718 7ff6f8fe6bd9-7ff6f8fe6bdc 708->718 709->700 725 7ff6f8fe6bba-7ff6f8fe6bc5 call 7ff6f8fd4f78 709->725 711->700 712->711 719 7ff6f8fe6aff-7ff6f8fe6b37 CreateFileW 712->719 723 7ff6f8fe6be2-7ff6f8fe6c37 call 7ff6f8fd84a8 717->723 718->723 724 7ff6f8fe6bde 718->724 719->706 719->711 729 7ff6f8fe6c56-7ff6f8fe6c87 call 7ff6f8fe6488 723->729 730 7ff6f8fe6c39-7ff6f8fe6c45 call 7ff6f8fe6910 723->730 724->723 725->700 737 7ff6f8fe6c8d-7ff6f8fe6ccf 729->737 738 7ff6f8fe6c89-7ff6f8fe6c8b 729->738 730->729 736 7ff6f8fe6c47 730->736 739 7ff6f8fe6c49-7ff6f8fe6c51 call 7ff6f8fdab30 736->739 740 7ff6f8fe6cf1-7ff6f8fe6cfc 737->740 741 7ff6f8fe6cd1-7ff6f8fe6cd5 737->741 738->739 739->714 742 7ff6f8fe6d02-7ff6f8fe6d06 740->742 743 7ff6f8fe6da0 740->743 741->740 745 7ff6f8fe6cd7-7ff6f8fe6cec 741->745 742->743 746 7ff6f8fe6d0c-7ff6f8fe6d51 CloseHandle CreateFileW 742->746 743->714 745->740 748 7ff6f8fe6d53-7ff6f8fe6d81 GetLastError call 7ff6f8fd4eec call 7ff6f8fd86d0 746->748 749 7ff6f8fe6d86-7ff6f8fe6d9b 746->749 748->749 749->743
                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                  • Source File: 00000000.00000002.1809060909.00007FF6F8FC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6F8FC0000, based on PE: true
                                                                                                                                                                                                                  • Associated: 00000000.00000002.1809003889.00007FF6F8FC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                  • Associated: 00000000.00000002.1809090760.00007FF6F8FEB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                  • Associated: 00000000.00000002.1809148599.00007FF6F8FFE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                  • Associated: 00000000.00000002.1809148599.00007FF6F9002000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                  • Associated: 00000000.00000002.1809223271.00007FF6F9004000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                  • Snapshot File: hcaresult_0_2_7ff6f8fc0000_dipwo1iToJ.jbxd
                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                  • API ID: File$CreateErrorLast_invalid_parameter_noinfo$CloseHandle$Type
                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                  • API String ID: 1617910340-0
                                                                                                                                                                                                                  • Opcode ID: 4205a6958293653b93a25a06bf68436f7b6b11ca03fe036e6858b65a4e3d069e
                                                                                                                                                                                                                  • Instruction ID: 9f6c7a0bee11ecb65030a9e4611b053410df1e0c2c25da29b4206262150eef95
                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 4205a6958293653b93a25a06bf68436f7b6b11ca03fe036e6858b65a4e3d069e
                                                                                                                                                                                                                  • Instruction Fuzzy Hash: B7C1BF36B29A468AEB10CF79C4902AC3761FB49BA8B415275DB2E977D4EF3CE051D304
                                                                                                                                                                                                                  Function 00007FF6F8FC83B0 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 89fileCOMMON
                                                                                                                                                                                                                  Download Yara Rule

                                                                                                                                                                                                                  Control-flow Graph

                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                  • FindFirstFileW.KERNELBASE(?,00007FF6F8FC8B09,00007FF6F8FC3FA5), ref: 00007FF6F8FC841B
                                                                                                                                                                                                                  • RemoveDirectoryW.KERNEL32(?,00007FF6F8FC8B09,00007FF6F8FC3FA5), ref: 00007FF6F8FC849E
                                                                                                                                                                                                                  • DeleteFileW.KERNELBASE(?,00007FF6F8FC8B09,00007FF6F8FC3FA5), ref: 00007FF6F8FC84BD
                                                                                                                                                                                                                  • FindNextFileW.KERNELBASE(?,00007FF6F8FC8B09,00007FF6F8FC3FA5), ref: 00007FF6F8FC84CB
                                                                                                                                                                                                                  • FindClose.KERNELBASE(?,00007FF6F8FC8B09,00007FF6F8FC3FA5), ref: 00007FF6F8FC84DC
                                                                                                                                                                                                                  • RemoveDirectoryW.KERNELBASE(?,00007FF6F8FC8B09,00007FF6F8FC3FA5), ref: 00007FF6F8FC84E5
                                                                                                                                                                                                                  Strings
                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                  • Source File: 00000000.00000002.1809060909.00007FF6F8FC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6F8FC0000, based on PE: true
                                                                                                                                                                                                                  • Associated: 00000000.00000002.1809003889.00007FF6F8FC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                  • Associated: 00000000.00000002.1809090760.00007FF6F8FEB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                  • Associated: 00000000.00000002.1809148599.00007FF6F8FFE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                  • Associated: 00000000.00000002.1809148599.00007FF6F9002000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                  • Associated: 00000000.00000002.1809223271.00007FF6F9004000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                  • Snapshot File: hcaresult_0_2_7ff6f8fc0000_dipwo1iToJ.jbxd
                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                  • API ID: FileFind$DirectoryRemove$CloseDeleteFirstNext
                                                                                                                                                                                                                  • String ID: %s\*
                                                                                                                                                                                                                  • API String ID: 1057558799-766152087
                                                                                                                                                                                                                  • Opcode ID: 754801c57d3e7d892bd8d831a0c0450fb277ac1fd7854ad2b3e1f46bb6674256
                                                                                                                                                                                                                  • Instruction ID: 2246431b1d00d3c2c192d05b98fbb2764188c922be9ff84a9bbae162918aadb7
                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 754801c57d3e7d892bd8d831a0c0450fb277ac1fd7854ad2b3e1f46bb6674256
                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 01416C31A2E94289EB209B34E4441B96360FB967F0F800272D5ADC36C5FF3CD74AA708
                                                                                                                                                                                                                  Function 00007FF6F8FE5EEC Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 143timeCOMMON
                                                                                                                                                                                                                  Download Yara Rule

                                                                                                                                                                                                                  Control-flow Graph

                                                                                                                                                                                                                  • Executed
                                                                                                                                                                                                                  • Not Executed
                                                                                                                                                                                                                  control_flow_graph 1012 7ff6f8fe5eec-7ff6f8fe5f21 call 7ff6f8fe55f8 call 7ff6f8fe5600 call 7ff6f8fe5668 1019 7ff6f8fe605f-7ff6f8fe60cd call 7ff6f8fda970 call 7ff6f8fe15e8 1012->1019 1020 7ff6f8fe5f27-7ff6f8fe5f32 call 7ff6f8fe5608 1012->1020 1031 7ff6f8fe60cf-7ff6f8fe60d6 1019->1031 1032 7ff6f8fe60db-7ff6f8fe60de 1019->1032 1020->1019 1025 7ff6f8fe5f38-7ff6f8fe5f43 call 7ff6f8fe5638 1020->1025 1025->1019 1033 7ff6f8fe5f49-7ff6f8fe5f6c call 7ff6f8fda9b8 GetTimeZoneInformation 1025->1033 1034 7ff6f8fe616b-7ff6f8fe616e 1031->1034 1035 7ff6f8fe6115-7ff6f8fe6128 call 7ff6f8fdd66c 1032->1035 1036 7ff6f8fe60e0 1032->1036 1046 7ff6f8fe5f72-7ff6f8fe5f93 1033->1046 1047 7ff6f8fe6034-7ff6f8fe605e call 7ff6f8fe55f0 call 7ff6f8fe55e0 call 7ff6f8fe55e8 1033->1047 1038 7ff6f8fe60e3 1034->1038 1039 7ff6f8fe6174-7ff6f8fe617c call 7ff6f8fe5c70 1034->1039 1053 7ff6f8fe6133-7ff6f8fe614e call 7ff6f8fe15e8 1035->1053 1054 7ff6f8fe612a 1035->1054 1036->1038 1042 7ff6f8fe60e8-7ff6f8fe6114 call 7ff6f8fda9b8 call 7ff6f8fcc5c0 1038->1042 1043 7ff6f8fe60e3 call 7ff6f8fe5eec 1038->1043 1039->1042 1043->1042 1048 7ff6f8fe5f95-7ff6f8fe5f9b 1046->1048 1049 7ff6f8fe5f9e-7ff6f8fe5fa5 1046->1049 1048->1049 1056 7ff6f8fe5fa7-7ff6f8fe5faf 1049->1056 1057 7ff6f8fe5fb9 1049->1057 1067 7ff6f8fe6155-7ff6f8fe6167 call 7ff6f8fda9b8 1053->1067 1068 7ff6f8fe6150-7ff6f8fe6153 1053->1068 1060 7ff6f8fe612c-7ff6f8fe6131 call 7ff6f8fda9b8 1054->1060 1056->1057 1062 7ff6f8fe5fb1-7ff6f8fe5fb7 1056->1062 1064 7ff6f8fe5fbb-7ff6f8fe602f call 7ff6f8fea540 * 4 call 7ff6f8fe2bcc call 7ff6f8fe6184 * 2 1057->1064 1060->1036 1062->1064 1064->1047 1067->1034 1068->1060
                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                  • _get_daylight.LIBCMT ref: 00007FF6F8FE5F1A
                                                                                                                                                                                                                    • Part of subcall function 00007FF6F8FE5668: _invalid_parameter_noinfo.LIBCMT ref: 00007FF6F8FE567C
                                                                                                                                                                                                                  • _get_daylight.LIBCMT ref: 00007FF6F8FE5F2B
                                                                                                                                                                                                                    • Part of subcall function 00007FF6F8FE5608: _invalid_parameter_noinfo.LIBCMT ref: 00007FF6F8FE561C
                                                                                                                                                                                                                  • _get_daylight.LIBCMT ref: 00007FF6F8FE5F3C
                                                                                                                                                                                                                    • Part of subcall function 00007FF6F8FE5638: _invalid_parameter_noinfo.LIBCMT ref: 00007FF6F8FE564C
                                                                                                                                                                                                                    • Part of subcall function 00007FF6F8FDA9B8: RtlFreeHeap.NTDLL(?,?,?,00007FF6F8FE2D92,?,?,?,00007FF6F8FE2DCF,?,?,00000000,00007FF6F8FE3295,?,?,?,00007FF6F8FE31C7), ref: 00007FF6F8FDA9CE
                                                                                                                                                                                                                    • Part of subcall function 00007FF6F8FDA9B8: GetLastError.KERNEL32(?,?,?,00007FF6F8FE2D92,?,?,?,00007FF6F8FE2DCF,?,?,00000000,00007FF6F8FE3295,?,?,?,00007FF6F8FE31C7), ref: 00007FF6F8FDA9D8
                                                                                                                                                                                                                  • GetTimeZoneInformation.KERNELBASE(?,?,?,?,?,?,?,?,?,00000000,?,00007FF6F8FE617C), ref: 00007FF6F8FE5F63
                                                                                                                                                                                                                  Strings
                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                  • Source File: 00000000.00000002.1809060909.00007FF6F8FC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6F8FC0000, based on PE: true
                                                                                                                                                                                                                  • Associated: 00000000.00000002.1809003889.00007FF6F8FC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                  • Associated: 00000000.00000002.1809090760.00007FF6F8FEB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                  • Associated: 00000000.00000002.1809148599.00007FF6F8FFE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                  • Associated: 00000000.00000002.1809148599.00007FF6F9002000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                  • Associated: 00000000.00000002.1809223271.00007FF6F9004000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                  • Snapshot File: hcaresult_0_2_7ff6f8fc0000_dipwo1iToJ.jbxd
                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                  • API ID: _get_daylight_invalid_parameter_noinfo$ErrorFreeHeapInformationLastTimeZone
                                                                                                                                                                                                                  • String ID: Eastern Standard Time$Eastern Summer Time
                                                                                                                                                                                                                  • API String ID: 3458911817-239921721
                                                                                                                                                                                                                  • Opcode ID: 8084827ab6892e9bf44fc7ae7df730cc4e836e683a41a1d7f4ca7a201d78ec16
                                                                                                                                                                                                                  • Instruction ID: 603a0eb5b895c7d41e63285153edc7958d26fafe8f162db71c668345f9c6873e
                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 8084827ab6892e9bf44fc7ae7df730cc4e836e683a41a1d7f4ca7a201d78ec16
                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 2151B132A097428AE720DF31DC911A96361BB487E4F405179EA2DC76E6FF3CE400D748
                                                                                                                                                                                                                  Function 00007FF6F8FC92F0 Relevance: 3.0, APIs: 2, Instructions: 29COMMON
                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                  • Source File: 00000000.00000002.1809060909.00007FF6F8FC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6F8FC0000, based on PE: true
                                                                                                                                                                                                                  • Associated: 00000000.00000002.1809003889.00007FF6F8FC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                  • Associated: 00000000.00000002.1809090760.00007FF6F8FEB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                  • Associated: 00000000.00000002.1809148599.00007FF6F8FFE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                  • Associated: 00000000.00000002.1809148599.00007FF6F9002000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                  • Associated: 00000000.00000002.1809223271.00007FF6F9004000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                  • Snapshot File: hcaresult_0_2_7ff6f8fc0000_dipwo1iToJ.jbxd
                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                  • API ID: Find$CloseFileFirst
                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                  • API String ID: 2295610775-0
                                                                                                                                                                                                                  • Opcode ID: f8f1f0d53470ef13f354418d29ecb311e48373b0acb6529cbcbe83ca601eafdf
                                                                                                                                                                                                                  • Instruction ID: 93c002a92531e59296031fbd0663229ac20f7c84b406f09ac9979848a2617be2
                                                                                                                                                                                                                  • Opcode Fuzzy Hash: f8f1f0d53470ef13f354418d29ecb311e48373b0acb6529cbcbe83ca601eafdf
                                                                                                                                                                                                                  • Instruction Fuzzy Hash: E7F0C832A1A7418AF7608B70B4887667350AB883B4F440335DA7D436D4EF3CD249DB04
                                                                                                                                                                                                                  Function 00007FF6F8FE0938 Relevance: 2.0, APIs: 1, Instructions: 461COMMON
                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                  • Source File: 00000000.00000002.1809060909.00007FF6F8FC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6F8FC0000, based on PE: true
                                                                                                                                                                                                                  • Associated: 00000000.00000002.1809003889.00007FF6F8FC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                  • Associated: 00000000.00000002.1809090760.00007FF6F8FEB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                  • Associated: 00000000.00000002.1809148599.00007FF6F8FFE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                  • Associated: 00000000.00000002.1809148599.00007FF6F9002000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                  • Associated: 00000000.00000002.1809223271.00007FF6F9004000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                  • Snapshot File: hcaresult_0_2_7ff6f8fc0000_dipwo1iToJ.jbxd
                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                  • API ID: CurrentFeaturePresentProcessProcessor
                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                  • API String ID: 1010374628-0
                                                                                                                                                                                                                  • Opcode ID: 2d471da97334de2acf0262392bad6ca7d41a72817533bf8b70dbf69db73f0db4
                                                                                                                                                                                                                  • Instruction ID: 3d01e03b80c88635aeb21adfde27026b3fc49874b38980234a78e821bf251b3d
                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 2d471da97334de2acf0262392bad6ca7d41a72817533bf8b70dbf69db73f0db4
                                                                                                                                                                                                                  • Instruction Fuzzy Hash: A1027A32A0B64648EF65AF35A8412792691BF85BF0F454674DE7DC73E6FE3CA401A308
                                                                                                                                                                                                                  Function 00007FF6F8FC1950 Relevance: 22.9, APIs: 2, Strings: 11, Instructions: 184COMMON
                                                                                                                                                                                                                  Download Yara Rule

                                                                                                                                                                                                                  Control-flow Graph

                                                                                                                                                                                                                  • Executed
                                                                                                                                                                                                                  • Not Executed
                                                                                                                                                                                                                  control_flow_graph 329 7ff6f8fc1950-7ff6f8fc198b call 7ff6f8fc45b0 332 7ff6f8fc1991-7ff6f8fc19d1 call 7ff6f8fc7f80 329->332 333 7ff6f8fc1c4e-7ff6f8fc1c72 call 7ff6f8fcc5c0 329->333 338 7ff6f8fc19d7-7ff6f8fc19e7 call 7ff6f8fd0744 332->338 339 7ff6f8fc1c3b-7ff6f8fc1c3e call 7ff6f8fd00bc 332->339 344 7ff6f8fc19e9-7ff6f8fc1a03 call 7ff6f8fd4f78 call 7ff6f8fc2910 338->344 345 7ff6f8fc1a08-7ff6f8fc1a24 call 7ff6f8fd040c 338->345 343 7ff6f8fc1c43-7ff6f8fc1c4b 339->343 343->333 344->339 350 7ff6f8fc1a45-7ff6f8fc1a5a call 7ff6f8fd4f98 345->350 351 7ff6f8fc1a26-7ff6f8fc1a40 call 7ff6f8fd4f78 call 7ff6f8fc2910 345->351 359 7ff6f8fc1a5c-7ff6f8fc1a76 call 7ff6f8fd4f78 call 7ff6f8fc2910 350->359 360 7ff6f8fc1a7b-7ff6f8fc1afc call 7ff6f8fc1c80 * 2 call 7ff6f8fd0744 350->360 351->339 359->339 371 7ff6f8fc1b01-7ff6f8fc1b14 call 7ff6f8fd4fb4 360->371 374 7ff6f8fc1b35-7ff6f8fc1b4e call 7ff6f8fd040c 371->374 375 7ff6f8fc1b16-7ff6f8fc1b30 call 7ff6f8fd4f78 call 7ff6f8fc2910 371->375 380 7ff6f8fc1b50-7ff6f8fc1b6a call 7ff6f8fd4f78 call 7ff6f8fc2910 374->380 381 7ff6f8fc1b6f-7ff6f8fc1b8b call 7ff6f8fd0180 374->381 375->339 380->339 389 7ff6f8fc1b9e-7ff6f8fc1bac 381->389 390 7ff6f8fc1b8d-7ff6f8fc1b99 call 7ff6f8fc2710 381->390 389->339 393 7ff6f8fc1bb2-7ff6f8fc1bb9 389->393 390->339 395 7ff6f8fc1bc1-7ff6f8fc1bc7 393->395 396 7ff6f8fc1be0-7ff6f8fc1bef 395->396 397 7ff6f8fc1bc9-7ff6f8fc1bd6 395->397 396->396 398 7ff6f8fc1bf1-7ff6f8fc1bfa 396->398 397->398 399 7ff6f8fc1c0f 398->399 400 7ff6f8fc1bfc-7ff6f8fc1bff 398->400 402 7ff6f8fc1c11-7ff6f8fc1c24 399->402 400->399 401 7ff6f8fc1c01-7ff6f8fc1c04 400->401 401->399 403 7ff6f8fc1c06-7ff6f8fc1c09 401->403 404 7ff6f8fc1c26 402->404 405 7ff6f8fc1c2d-7ff6f8fc1c39 402->405 403->399 406 7ff6f8fc1c0b-7ff6f8fc1c0d 403->406 404->405 405->339 405->395 406->402
                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                    • Part of subcall function 00007FF6F8FC7F80: _fread_nolock.LIBCMT ref: 00007FF6F8FC802A
                                                                                                                                                                                                                  • _fread_nolock.LIBCMT ref: 00007FF6F8FC1A1B
                                                                                                                                                                                                                    • Part of subcall function 00007FF6F8FC2910: GetCurrentProcessId.KERNEL32(?,?,?,?,00000000,00000000,?,00000000,00007FF6F8FC1B6A), ref: 00007FF6F8FC295E
                                                                                                                                                                                                                  Strings
                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                  • Source File: 00000000.00000002.1809060909.00007FF6F8FC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6F8FC0000, based on PE: true
                                                                                                                                                                                                                  • Associated: 00000000.00000002.1809003889.00007FF6F8FC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                  • Associated: 00000000.00000002.1809090760.00007FF6F8FEB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                  • Associated: 00000000.00000002.1809148599.00007FF6F8FFE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                  • Associated: 00000000.00000002.1809148599.00007FF6F9002000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                  • Associated: 00000000.00000002.1809223271.00007FF6F9004000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                  • Snapshot File: hcaresult_0_2_7ff6f8fc0000_dipwo1iToJ.jbxd
                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                  • API ID: _fread_nolock$CurrentProcess
                                                                                                                                                                                                                  • String ID: Could not allocate buffer for TOC!$Could not allocate memory for archive structure!$Could not read full TOC!$Error on file.$Failed to read cookie!$Failed to seek to cookie position!$MEI$calloc$fread$fseek$malloc
                                                                                                                                                                                                                  • API String ID: 2397952137-3497178890
                                                                                                                                                                                                                  • Opcode ID: 6d43d2f5094c02a69a50d2278f5fdcc42b4033f4591644595bdd37c4696fd258
                                                                                                                                                                                                                  • Instruction ID: 201d39f4a7b75f6d45d5eadb890b04ef03c7ab24ec92ce8dae55b1e9ea57c789
                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 6d43d2f5094c02a69a50d2278f5fdcc42b4033f4591644595bdd37c4696fd258
                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 04819071E0A68289EB20DB34D0406F92391EF857D4F4044B1EAADC77D6FE3CE695A748
                                                                                                                                                                                                                  Function 00007FF6F8FC1600 Relevance: 22.9, APIs: 1, Strings: 12, Instructions: 145COMMON
                                                                                                                                                                                                                  Download Yara Rule

                                                                                                                                                                                                                  Control-flow Graph

                                                                                                                                                                                                                  • Executed
                                                                                                                                                                                                                  • Not Executed
                                                                                                                                                                                                                  control_flow_graph 407 7ff6f8fc1600-7ff6f8fc1611 408 7ff6f8fc1613-7ff6f8fc161c call 7ff6f8fc1050 407->408 409 7ff6f8fc1637-7ff6f8fc1651 call 7ff6f8fc45b0 407->409 416 7ff6f8fc162e-7ff6f8fc1636 408->416 417 7ff6f8fc161e-7ff6f8fc1629 call 7ff6f8fc2710 408->417 414 7ff6f8fc1653-7ff6f8fc1681 call 7ff6f8fd4f78 call 7ff6f8fc2910 409->414 415 7ff6f8fc1682-7ff6f8fc169c call 7ff6f8fc45b0 409->415 424 7ff6f8fc169e-7ff6f8fc16b3 call 7ff6f8fc2710 415->424 425 7ff6f8fc16b8-7ff6f8fc16cf call 7ff6f8fd0744 415->425 417->416 431 7ff6f8fc1821-7ff6f8fc1824 call 7ff6f8fd00bc 424->431 432 7ff6f8fc16d1-7ff6f8fc16f4 call 7ff6f8fd4f78 call 7ff6f8fc2910 425->432 433 7ff6f8fc16f9-7ff6f8fc16fd 425->433 441 7ff6f8fc1829-7ff6f8fc183b 431->441 446 7ff6f8fc1819-7ff6f8fc181c call 7ff6f8fd00bc 432->446 435 7ff6f8fc16ff-7ff6f8fc170b call 7ff6f8fc1210 433->435 436 7ff6f8fc1717-7ff6f8fc1737 call 7ff6f8fd4fb4 433->436 443 7ff6f8fc1710-7ff6f8fc1712 435->443 447 7ff6f8fc1761-7ff6f8fc176c 436->447 448 7ff6f8fc1739-7ff6f8fc175c call 7ff6f8fd4f78 call 7ff6f8fc2910 436->448 443->446 446->431 449 7ff6f8fc1802-7ff6f8fc180a call 7ff6f8fd4fa0 447->449 450 7ff6f8fc1772-7ff6f8fc1777 447->450 460 7ff6f8fc180f-7ff6f8fc1814 448->460 449->460 453 7ff6f8fc1780-7ff6f8fc17a2 call 7ff6f8fd040c 450->453 462 7ff6f8fc17a4-7ff6f8fc17bc call 7ff6f8fd0b4c 453->462 463 7ff6f8fc17da-7ff6f8fc17e6 call 7ff6f8fd4f78 453->463 460->446 469 7ff6f8fc17be-7ff6f8fc17c1 462->469 470 7ff6f8fc17c5-7ff6f8fc17d8 call 7ff6f8fd4f78 462->470 468 7ff6f8fc17ed-7ff6f8fc17f8 call 7ff6f8fc2910 463->468 475 7ff6f8fc17fd 468->475 469->453 472 7ff6f8fc17c3 469->472 470->468 472->475 475->449
                                                                                                                                                                                                                  Strings
                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                  • Source File: 00000000.00000002.1809060909.00007FF6F8FC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6F8FC0000, based on PE: true
                                                                                                                                                                                                                  • Associated: 00000000.00000002.1809003889.00007FF6F8FC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                  • Associated: 00000000.00000002.1809090760.00007FF6F8FEB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                  • Associated: 00000000.00000002.1809148599.00007FF6F8FFE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                  • Associated: 00000000.00000002.1809148599.00007FF6F9002000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                  • Associated: 00000000.00000002.1809223271.00007FF6F9004000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                  • Snapshot File: hcaresult_0_2_7ff6f8fc0000_dipwo1iToJ.jbxd
                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                  • API ID: CurrentProcess
                                                                                                                                                                                                                  • String ID: Failed to create symbolic link %s!$Failed to extract %s: failed to allocate temporary buffer!$Failed to extract %s: failed to open archive file!$Failed to extract %s: failed to open target file!$Failed to extract %s: failed to read data chunk!$Failed to extract %s: failed to seek to the entry's data!$Failed to extract %s: failed to write data chunk!$fopen$fread$fseek$fwrite$malloc
                                                                                                                                                                                                                  • API String ID: 2050909247-1550345328
                                                                                                                                                                                                                  • Opcode ID: bdb202e1f9bc7177cec46868f1cc56065c6c33e9ec8a8b0f81691881613973e0
                                                                                                                                                                                                                  • Instruction ID: fa3657ef2c2d10aecfc3a0510d6f4eae1468188f2fc8ae0e85d43cd294744cd2
                                                                                                                                                                                                                  • Opcode Fuzzy Hash: bdb202e1f9bc7177cec46868f1cc56065c6c33e9ec8a8b0f81691881613973e0
                                                                                                                                                                                                                  • Instruction Fuzzy Hash: E2519D31E0A6438AEB109B3194401A96361BF427F4F9445B1EE6C87BD2FE3CE795B708
                                                                                                                                                                                                                  Function 00007FF6F8FC8850 Relevance: 14.1, APIs: 3, Strings: 5, Instructions: 116COMMON
                                                                                                                                                                                                                  Download Yara Rule

                                                                                                                                                                                                                  Control-flow Graph

                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                  • GetTempPathW.KERNEL32(?,?,00000000,00007FF6F8FC3CBB), ref: 00007FF6F8FC88F4
                                                                                                                                                                                                                  • GetCurrentProcessId.KERNEL32(?,00000000,00007FF6F8FC3CBB), ref: 00007FF6F8FC88FA
                                                                                                                                                                                                                  • CreateDirectoryW.KERNELBASE(?,00000000,00007FF6F8FC3CBB), ref: 00007FF6F8FC893C
                                                                                                                                                                                                                    • Part of subcall function 00007FF6F8FC8A20: GetEnvironmentVariableW.KERNEL32(00007FF6F8FC388E), ref: 00007FF6F8FC8A57
                                                                                                                                                                                                                    • Part of subcall function 00007FF6F8FC8A20: ExpandEnvironmentStringsW.KERNEL32 ref: 00007FF6F8FC8A79
                                                                                                                                                                                                                    • Part of subcall function 00007FF6F8FD82A8: _invalid_parameter_noinfo.LIBCMT ref: 00007FF6F8FD82C1
                                                                                                                                                                                                                    • Part of subcall function 00007FF6F8FC2810: MessageBoxW.USER32 ref: 00007FF6F8FC28EA
                                                                                                                                                                                                                  Strings
                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                  • Source File: 00000000.00000002.1809060909.00007FF6F8FC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6F8FC0000, based on PE: true
                                                                                                                                                                                                                  • Associated: 00000000.00000002.1809003889.00007FF6F8FC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                  • Associated: 00000000.00000002.1809090760.00007FF6F8FEB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                  • Associated: 00000000.00000002.1809148599.00007FF6F8FFE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                  • Associated: 00000000.00000002.1809148599.00007FF6F9002000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                  • Associated: 00000000.00000002.1809223271.00007FF6F9004000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                  • Snapshot File: hcaresult_0_2_7ff6f8fc0000_dipwo1iToJ.jbxd
                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                  • API ID: Environment$CreateCurrentDirectoryExpandMessagePathProcessStringsTempVariable_invalid_parameter_noinfo
                                                                                                                                                                                                                  • String ID: LOADER: failed to set the TMP environment variable.$LOADER: length of teporary directory path exceeds maximum path length!$TMP$TMP$_MEI%d
                                                                                                                                                                                                                  • API String ID: 3563477958-1339014028
                                                                                                                                                                                                                  • Opcode ID: 4e349524156a31c65ddba45994ef87c37bf84ce1b0e485ec316371ea64373d4f
                                                                                                                                                                                                                  • Instruction ID: 0c81f039fee35c97b5ce5327fec95c1af3702f2d613ca4caad828772557920f1
                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 4e349524156a31c65ddba45994ef87c37bf84ce1b0e485ec316371ea64373d4f
                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 02418132B2B64248EB50AB36A8551B91391AF86BE0F504171DE2DC7BD7FE3CD705A308
                                                                                                                                                                                                                  Function 00007FF6F8FC1210 Relevance: 12.4, APIs: 1, Strings: 6, Instructions: 158COMMON
                                                                                                                                                                                                                  Download Yara Rule

                                                                                                                                                                                                                  Control-flow Graph

                                                                                                                                                                                                                  • Executed
                                                                                                                                                                                                                  • Not Executed
                                                                                                                                                                                                                  control_flow_graph 754 7ff6f8fc1210-7ff6f8fc126d call 7ff6f8fcbdf0 757 7ff6f8fc126f-7ff6f8fc1296 call 7ff6f8fc2710 754->757 758 7ff6f8fc1297-7ff6f8fc12af call 7ff6f8fd4fb4 754->758 763 7ff6f8fc12b1-7ff6f8fc12cf call 7ff6f8fd4f78 call 7ff6f8fc2910 758->763 764 7ff6f8fc12d4-7ff6f8fc12e4 call 7ff6f8fd4fb4 758->764 775 7ff6f8fc1439-7ff6f8fc144e call 7ff6f8fcbad0 call 7ff6f8fd4fa0 * 2 763->775 769 7ff6f8fc1309-7ff6f8fc131b 764->769 770 7ff6f8fc12e6-7ff6f8fc1304 call 7ff6f8fd4f78 call 7ff6f8fc2910 764->770 773 7ff6f8fc1320-7ff6f8fc1345 call 7ff6f8fd040c 769->773 770->775 783 7ff6f8fc1431 773->783 784 7ff6f8fc134b-7ff6f8fc1355 call 7ff6f8fd0180 773->784 792 7ff6f8fc1453-7ff6f8fc146d 775->792 783->775 784->783 790 7ff6f8fc135b-7ff6f8fc1367 784->790 791 7ff6f8fc1370-7ff6f8fc1398 call 7ff6f8fca230 790->791 795 7ff6f8fc1416-7ff6f8fc142c call 7ff6f8fc2710 791->795 796 7ff6f8fc139a-7ff6f8fc139d 791->796 795->783 797 7ff6f8fc1411 796->797 798 7ff6f8fc139f-7ff6f8fc13a9 796->798 797->795 800 7ff6f8fc13d4-7ff6f8fc13d7 798->800 801 7ff6f8fc13ab-7ff6f8fc13b9 call 7ff6f8fd0b4c 798->801 803 7ff6f8fc13d9-7ff6f8fc13e7 call 7ff6f8fe9ea0 800->803 804 7ff6f8fc13ea-7ff6f8fc13ef 800->804 806 7ff6f8fc13be-7ff6f8fc13c1 801->806 803->804 804->791 805 7ff6f8fc13f5-7ff6f8fc13f8 804->805 808 7ff6f8fc140c-7ff6f8fc140f 805->808 809 7ff6f8fc13fa-7ff6f8fc13fd 805->809 810 7ff6f8fc13cf-7ff6f8fc13d2 806->810 811 7ff6f8fc13c3-7ff6f8fc13cd call 7ff6f8fd0180 806->811 808->783 809->795 813 7ff6f8fc13ff-7ff6f8fc1407 809->813 810->795 811->804 811->810 813->773
                                                                                                                                                                                                                  Strings
                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                  • Source File: 00000000.00000002.1809060909.00007FF6F8FC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6F8FC0000, based on PE: true
                                                                                                                                                                                                                  • Associated: 00000000.00000002.1809003889.00007FF6F8FC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                  • Associated: 00000000.00000002.1809090760.00007FF6F8FEB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                  • Associated: 00000000.00000002.1809148599.00007FF6F8FFE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                  • Associated: 00000000.00000002.1809148599.00007FF6F9002000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                  • Associated: 00000000.00000002.1809223271.00007FF6F9004000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                  • Snapshot File: hcaresult_0_2_7ff6f8fc0000_dipwo1iToJ.jbxd
                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                  • API ID: CurrentProcess
                                                                                                                                                                                                                  • String ID: 1.3.1$Failed to extract %s: decompression resulted in return code %d!$Failed to extract %s: failed to allocate temporary input buffer!$Failed to extract %s: failed to allocate temporary output buffer!$Failed to extract %s: inflateInit() failed with return code %d!$malloc
                                                                                                                                                                                                                  • API String ID: 2050909247-2813020118
                                                                                                                                                                                                                  • Opcode ID: 4135646233a09d1bafe58e36eb504b74d27aad0b28d423605d6bf35aaf273347
                                                                                                                                                                                                                  • Instruction ID: 90955294b17f75dc6a400cc97060b5a7f1c4f4da73a002a99fe5dca55d4704bc
                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 4135646233a09d1bafe58e36eb504b74d27aad0b28d423605d6bf35aaf273347
                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 7A51C732A0A64289EB609B31A4403BA6291FF867E4F844171EE6DC77D6FE3CD751E704
                                                                                                                                                                                                                  Function 00007FF6F8FDED80 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 117libraryloaderCOMMONLIBRARYCODE
                                                                                                                                                                                                                  Download Yara Rule

                                                                                                                                                                                                                  Control-flow Graph

                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                  • FreeLibrary.KERNEL32(?,?,?,00007FF6F8FDF11A,?,?,-00000018,00007FF6F8FDADC3,?,?,?,00007FF6F8FDACBA,?,?,?,00007FF6F8FD5FAE), ref: 00007FF6F8FDEEFC
                                                                                                                                                                                                                  • GetProcAddress.KERNEL32(?,?,?,00007FF6F8FDF11A,?,?,-00000018,00007FF6F8FDADC3,?,?,?,00007FF6F8FDACBA,?,?,?,00007FF6F8FD5FAE), ref: 00007FF6F8FDEF08
                                                                                                                                                                                                                  Strings
                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                  • Source File: 00000000.00000002.1809060909.00007FF6F8FC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6F8FC0000, based on PE: true
                                                                                                                                                                                                                  • Associated: 00000000.00000002.1809003889.00007FF6F8FC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                  • Associated: 00000000.00000002.1809090760.00007FF6F8FEB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                  • Associated: 00000000.00000002.1809148599.00007FF6F8FFE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                  • Associated: 00000000.00000002.1809148599.00007FF6F9002000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                  • Associated: 00000000.00000002.1809223271.00007FF6F9004000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                  • Snapshot File: hcaresult_0_2_7ff6f8fc0000_dipwo1iToJ.jbxd
                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                  • API ID: AddressFreeLibraryProc
                                                                                                                                                                                                                  • String ID: api-ms-$ext-ms-
                                                                                                                                                                                                                  • API String ID: 3013587201-537541572
                                                                                                                                                                                                                  • Opcode ID: 2820b76ab0802fc58bac5aaef12ed6f6fffcf0c29b30edae647068643d5e49cf
                                                                                                                                                                                                                  • Instruction ID: d7f1694c6d638a4afcc6c521ab876df45abf2336f511741464144b088f117c33
                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 2820b76ab0802fc58bac5aaef12ed6f6fffcf0c29b30edae647068643d5e49cf
                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 9641E332B1A60249EB16CB3698046752292BF49BF0F894575DE2ED73C4FF3CE505A318
                                                                                                                                                                                                                  Function 00007FF6F8FC36B0 Relevance: 12.3, APIs: 2, Strings: 5, Instructions: 61COMMON
                                                                                                                                                                                                                  Download Yara Rule

                                                                                                                                                                                                                  Control-flow Graph

                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                  • GetModuleFileNameW.KERNEL32(?,00007FF6F8FC3804), ref: 00007FF6F8FC36E1
                                                                                                                                                                                                                  • GetLastError.KERNEL32(?,00007FF6F8FC3804), ref: 00007FF6F8FC36EB
                                                                                                                                                                                                                    • Part of subcall function 00007FF6F8FC2C50: GetCurrentProcessId.KERNEL32(?,?,?,?,?,?,?,?,00007FF6F8FC3706,?,00007FF6F8FC3804), ref: 00007FF6F8FC2C9E
                                                                                                                                                                                                                    • Part of subcall function 00007FF6F8FC2C50: FormatMessageW.KERNEL32(?,?,?,?,?,?,?,?,00007FF6F8FC3706,?,00007FF6F8FC3804), ref: 00007FF6F8FC2D63
                                                                                                                                                                                                                    • Part of subcall function 00007FF6F8FC2C50: MessageBoxW.USER32 ref: 00007FF6F8FC2D99
                                                                                                                                                                                                                  Strings
                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                  • Source File: 00000000.00000002.1809060909.00007FF6F8FC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6F8FC0000, based on PE: true
                                                                                                                                                                                                                  • Associated: 00000000.00000002.1809003889.00007FF6F8FC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                  • Associated: 00000000.00000002.1809090760.00007FF6F8FEB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                  • Associated: 00000000.00000002.1809148599.00007FF6F8FFE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                  • Associated: 00000000.00000002.1809148599.00007FF6F9002000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                  • Associated: 00000000.00000002.1809223271.00007FF6F9004000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                  • Snapshot File: hcaresult_0_2_7ff6f8fc0000_dipwo1iToJ.jbxd
                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                  • API ID: Message$CurrentErrorFileFormatLastModuleNameProcess
                                                                                                                                                                                                                  • String ID: Failed to convert executable path to UTF-8.$Failed to obtain executable path.$Failed to resolve full path to executable %ls.$GetModuleFileNameW$\\?\
                                                                                                                                                                                                                  • API String ID: 3187769757-2863816727
                                                                                                                                                                                                                  • Opcode ID: 6d8fde842cedad8fbf80b9c4aa3ce336361ac9392ce2c79ae57a11131fda94fc
                                                                                                                                                                                                                  • Instruction ID: 14b9bf6fde7ff3248b9e29ce45d2debfce601e70601bb07f1b1718664263a4a4
                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 6d8fde842cedad8fbf80b9c4aa3ce336361ac9392ce2c79ae57a11131fda94fc
                                                                                                                                                                                                                  • Instruction Fuzzy Hash: E2215E71B1E64289FB219731E8053B62251AF893E8F804172E67DC36D6FE2CE705E708
                                                                                                                                                                                                                  Function 00007FF6F8FDBACC Relevance: 10.8, APIs: 7, Instructions: 290COMMONLIBRARYCODE
                                                                                                                                                                                                                  Download Yara Rule

                                                                                                                                                                                                                  Control-flow Graph

                                                                                                                                                                                                                  • Executed
                                                                                                                                                                                                                  • Not Executed
                                                                                                                                                                                                                  control_flow_graph 899 7ff6f8fdbacc-7ff6f8fdbaf2 900 7ff6f8fdbaf4-7ff6f8fdbb08 call 7ff6f8fd4f58 call 7ff6f8fd4f78 899->900 901 7ff6f8fdbb0d-7ff6f8fdbb11 899->901 917 7ff6f8fdbefe 900->917 903 7ff6f8fdbee7-7ff6f8fdbef3 call 7ff6f8fd4f58 call 7ff6f8fd4f78 901->903 904 7ff6f8fdbb17-7ff6f8fdbb1e 901->904 923 7ff6f8fdbef9 call 7ff6f8fda950 903->923 904->903 906 7ff6f8fdbb24-7ff6f8fdbb52 904->906 906->903 909 7ff6f8fdbb58-7ff6f8fdbb5f 906->909 912 7ff6f8fdbb61-7ff6f8fdbb73 call 7ff6f8fd4f58 call 7ff6f8fd4f78 909->912 913 7ff6f8fdbb78-7ff6f8fdbb7b 909->913 912->923 915 7ff6f8fdbee3-7ff6f8fdbee5 913->915 916 7ff6f8fdbb81-7ff6f8fdbb87 913->916 920 7ff6f8fdbf01-7ff6f8fdbf18 915->920 916->915 921 7ff6f8fdbb8d-7ff6f8fdbb90 916->921 917->920 921->912 925 7ff6f8fdbb92-7ff6f8fdbbb7 921->925 923->917 928 7ff6f8fdbbea-7ff6f8fdbbf1 925->928 929 7ff6f8fdbbb9-7ff6f8fdbbbb 925->929 930 7ff6f8fdbbf3-7ff6f8fdbc1b call 7ff6f8fdd66c call 7ff6f8fda9b8 * 2 928->930 931 7ff6f8fdbbc6-7ff6f8fdbbdd call 7ff6f8fd4f58 call 7ff6f8fd4f78 call 7ff6f8fda950 928->931 932 7ff6f8fdbbe2-7ff6f8fdbbe8 929->932 933 7ff6f8fdbbbd-7ff6f8fdbbc4 929->933 960 7ff6f8fdbc1d-7ff6f8fdbc33 call 7ff6f8fd4f78 call 7ff6f8fd4f58 930->960 961 7ff6f8fdbc38-7ff6f8fdbc63 call 7ff6f8fdc2f4 930->961 965 7ff6f8fdbd70 931->965 936 7ff6f8fdbc68-7ff6f8fdbc7f 932->936 933->931 933->932 937 7ff6f8fdbc81-7ff6f8fdbc89 936->937 938 7ff6f8fdbcfa-7ff6f8fdbd04 call 7ff6f8fe398c 936->938 937->938 941 7ff6f8fdbc8b-7ff6f8fdbc8d 937->941 951 7ff6f8fdbd8e 938->951 952 7ff6f8fdbd0a-7ff6f8fdbd1f 938->952 941->938 945 7ff6f8fdbc8f-7ff6f8fdbca5 941->945 945->938 949 7ff6f8fdbca7-7ff6f8fdbcb3 945->949 949->938 954 7ff6f8fdbcb5-7ff6f8fdbcb7 949->954 956 7ff6f8fdbd93-7ff6f8fdbdb3 ReadFile 951->956 952->951 957 7ff6f8fdbd21-7ff6f8fdbd33 GetConsoleMode 952->957 954->938 959 7ff6f8fdbcb9-7ff6f8fdbcd1 954->959 962 7ff6f8fdbead-7ff6f8fdbeb6 GetLastError 956->962 963 7ff6f8fdbdb9-7ff6f8fdbdc1 956->963 957->951 964 7ff6f8fdbd35-7ff6f8fdbd3d 957->964 959->938 969 7ff6f8fdbcd3-7ff6f8fdbcdf 959->969 960->965 961->936 966 7ff6f8fdbed3-7ff6f8fdbed6 962->966 967 7ff6f8fdbeb8-7ff6f8fdbece call 7ff6f8fd4f78 call 7ff6f8fd4f58 962->967 963->962 971 7ff6f8fdbdc7 963->971 964->956 973 7ff6f8fdbd3f-7ff6f8fdbd61 ReadConsoleW 964->973 968 7ff6f8fdbd73-7ff6f8fdbd7d call 7ff6f8fda9b8 965->968 979 7ff6f8fdbedc-7ff6f8fdbede 966->979 980 7ff6f8fdbd69-7ff6f8fdbd6b call 7ff6f8fd4eec 966->980 967->965 968->920 969->938 978 7ff6f8fdbce1-7ff6f8fdbce3 969->978 982 7ff6f8fdbdce-7ff6f8fdbde3 971->982 974 7ff6f8fdbd63 GetLastError 973->974 975 7ff6f8fdbd82-7ff6f8fdbd8c 973->975 974->980 975->982 978->938 987 7ff6f8fdbce5-7ff6f8fdbcf5 978->987 979->968 980->965 982->968 989 7ff6f8fdbde5-7ff6f8fdbdf0 982->989 987->938 992 7ff6f8fdbdf2-7ff6f8fdbe0b call 7ff6f8fdb6e4 989->992 993 7ff6f8fdbe17-7ff6f8fdbe1f 989->993 998 7ff6f8fdbe10-7ff6f8fdbe12 992->998 994 7ff6f8fdbe21-7ff6f8fdbe33 993->994 995 7ff6f8fdbe9b-7ff6f8fdbea8 call 7ff6f8fdb524 993->995 999 7ff6f8fdbe35 994->999 1000 7ff6f8fdbe8e-7ff6f8fdbe96 994->1000 995->998 998->968 1003 7ff6f8fdbe3a-7ff6f8fdbe41 999->1003 1000->968 1004 7ff6f8fdbe43-7ff6f8fdbe47 1003->1004 1005 7ff6f8fdbe7d-7ff6f8fdbe88 1003->1005 1006 7ff6f8fdbe63 1004->1006 1007 7ff6f8fdbe49-7ff6f8fdbe50 1004->1007 1005->1000 1009 7ff6f8fdbe69-7ff6f8fdbe79 1006->1009 1007->1006 1008 7ff6f8fdbe52-7ff6f8fdbe56 1007->1008 1008->1006 1010 7ff6f8fdbe58-7ff6f8fdbe61 1008->1010 1009->1003 1011 7ff6f8fdbe7b 1009->1011 1010->1009 1011->1000
                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                  • Source File: 00000000.00000002.1809060909.00007FF6F8FC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6F8FC0000, based on PE: true
                                                                                                                                                                                                                  • Associated: 00000000.00000002.1809003889.00007FF6F8FC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                  • Associated: 00000000.00000002.1809090760.00007FF6F8FEB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                  • Associated: 00000000.00000002.1809148599.00007FF6F8FFE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                  • Associated: 00000000.00000002.1809148599.00007FF6F9002000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                  • Associated: 00000000.00000002.1809223271.00007FF6F9004000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                  • Snapshot File: hcaresult_0_2_7ff6f8fc0000_dipwo1iToJ.jbxd
                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                  • API ID: _invalid_parameter_noinfo
                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                  • API String ID: 3215553584-0
                                                                                                                                                                                                                  • Opcode ID: 71330427dde7a49afb2283bb308656113f98e0c66a4f806cd66398b14c9322eb
                                                                                                                                                                                                                  • Instruction ID: 62d1667df87871b71bff5abd6cd2fb54b483799c7e028086f56d434a245fc4d1
                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 71330427dde7a49afb2283bb308656113f98e0c66a4f806cd66398b14c9322eb
                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 0CC1E43390A68689E7219F2594402BD7B62FB81BE0F954171EB6E837E1EE7CE4459308
                                                                                                                                                                                                                  Function 00007FF6F8FC8760 Relevance: 10.6, APIs: 7, Instructions: 63COMMON
                                                                                                                                                                                                                  Download Yara Rule

                                                                                                                                                                                                                  Control-flow Graph

                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                  • Source File: 00000000.00000002.1809060909.00007FF6F8FC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6F8FC0000, based on PE: true
                                                                                                                                                                                                                  • Associated: 00000000.00000002.1809003889.00007FF6F8FC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                  • Associated: 00000000.00000002.1809090760.00007FF6F8FEB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                  • Associated: 00000000.00000002.1809148599.00007FF6F8FFE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                  • Associated: 00000000.00000002.1809148599.00007FF6F9002000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                  • Associated: 00000000.00000002.1809223271.00007FF6F9004000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                  • Snapshot File: hcaresult_0_2_7ff6f8fc0000_dipwo1iToJ.jbxd
                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                  • API ID: Token$InformationProcess$CloseConvertCurrentErrorHandleLastOpenString
                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                  • API String ID: 995526605-0
                                                                                                                                                                                                                  • Opcode ID: ccba17952e233d5b695068aab9421341a55ed3ebff0a2a14ee99ad80d8ea5500
                                                                                                                                                                                                                  • Instruction ID: 2295f1732c83f882dabbe0616ba183f9d47697b68ea1bbbd8ad5154c4fb2bd27
                                                                                                                                                                                                                  • Opcode Fuzzy Hash: ccba17952e233d5b695068aab9421341a55ed3ebff0a2a14ee99ad80d8ea5500
                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 53217331B1D64246EB109B65F45026AA3A1FF857F0F500275E77C83AE9EE6CD6449704
                                                                                                                                                                                                                  Function 00007FF6F8FC90E0 Relevance: 9.1, APIs: 2, Strings: 4, Instructions: 64COMMON
                                                                                                                                                                                                                  Download Yara Rule

                                                                                                                                                                                                                  Control-flow Graph

                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                    • Part of subcall function 00007FF6F8FC8760: GetCurrentProcess.KERNEL32 ref: 00007FF6F8FC8780
                                                                                                                                                                                                                    • Part of subcall function 00007FF6F8FC8760: OpenProcessToken.ADVAPI32 ref: 00007FF6F8FC8793
                                                                                                                                                                                                                    • Part of subcall function 00007FF6F8FC8760: GetTokenInformation.KERNELBASE ref: 00007FF6F8FC87B8
                                                                                                                                                                                                                    • Part of subcall function 00007FF6F8FC8760: GetLastError.KERNEL32 ref: 00007FF6F8FC87C2
                                                                                                                                                                                                                    • Part of subcall function 00007FF6F8FC8760: GetTokenInformation.KERNELBASE ref: 00007FF6F8FC8802
                                                                                                                                                                                                                    • Part of subcall function 00007FF6F8FC8760: ConvertSidToStringSidW.ADVAPI32 ref: 00007FF6F8FC881E
                                                                                                                                                                                                                    • Part of subcall function 00007FF6F8FC8760: CloseHandle.KERNEL32 ref: 00007FF6F8FC8836
                                                                                                                                                                                                                  • LocalFree.KERNEL32(?,00007FF6F8FC3C55), ref: 00007FF6F8FC916C
                                                                                                                                                                                                                  • LocalFree.KERNEL32(?,00007FF6F8FC3C55), ref: 00007FF6F8FC9175
                                                                                                                                                                                                                  Strings
                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                  • Source File: 00000000.00000002.1809060909.00007FF6F8FC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6F8FC0000, based on PE: true
                                                                                                                                                                                                                  • Associated: 00000000.00000002.1809003889.00007FF6F8FC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                  • Associated: 00000000.00000002.1809090760.00007FF6F8FEB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                  • Associated: 00000000.00000002.1809148599.00007FF6F8FFE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                  • Associated: 00000000.00000002.1809148599.00007FF6F9002000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                  • Associated: 00000000.00000002.1809223271.00007FF6F9004000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                  • Snapshot File: hcaresult_0_2_7ff6f8fc0000_dipwo1iToJ.jbxd
                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                  • API ID: Token$FreeInformationLocalProcess$CloseConvertCurrentErrorHandleLastOpenString
                                                                                                                                                                                                                  • String ID: D:(A;;FA;;;%s)$D:(A;;FA;;;%s)(A;;FA;;;%s)$S-1-3-4$Security descriptor string length exceeds PYI_PATH_MAX!
                                                                                                                                                                                                                  • API String ID: 6828938-1529539262
                                                                                                                                                                                                                  • Opcode ID: 3eb7115bd34229e0b110e4578eeeb93c66e7230f7a251aed45e8d0dbb8b27e08
                                                                                                                                                                                                                  • Instruction ID: 2cc636904f5a60e6ced0e43030feeac9b7892a47cb001317f0ff8f62fc3c0d64
                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 3eb7115bd34229e0b110e4578eeeb93c66e7230f7a251aed45e8d0dbb8b27e08
                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 39216131A1A74289E710AB30E4192EA6351EF857E0F440475EA6DD3BD7FF3CD605A744
                                                                                                                                                                                                                  Function 00007FF6F8FC7E10 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 81COMMON
                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                  • CreateDirectoryW.KERNELBASE(00000000,?,00007FF6F8FC352C,?,00000000,00007FF6F8FC3F23), ref: 00007FF6F8FC7F22
                                                                                                                                                                                                                  Strings
                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                  • Source File: 00000000.00000002.1809060909.00007FF6F8FC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6F8FC0000, based on PE: true
                                                                                                                                                                                                                  • Associated: 00000000.00000002.1809003889.00007FF6F8FC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                  • Associated: 00000000.00000002.1809090760.00007FF6F8FEB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                  • Associated: 00000000.00000002.1809148599.00007FF6F8FFE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                  • Associated: 00000000.00000002.1809148599.00007FF6F9002000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                  • Associated: 00000000.00000002.1809223271.00007FF6F9004000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                  • Snapshot File: hcaresult_0_2_7ff6f8fc0000_dipwo1iToJ.jbxd
                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                  • API ID: CreateDirectory
                                                                                                                                                                                                                  • String ID: %.*s$%s%c$\
                                                                                                                                                                                                                  • API String ID: 4241100979-1685191245
                                                                                                                                                                                                                  • Opcode ID: b1106a047486010b66b16d7d561c3e0e79f8eec2dc114c611d5a943da294bb6a
                                                                                                                                                                                                                  • Instruction ID: cb16104eb0c468203a475566dd9d4f8814c2ec160aadd27e12a46075c2820bc9
                                                                                                                                                                                                                  • Opcode Fuzzy Hash: b1106a047486010b66b16d7d561c3e0e79f8eec2dc114c611d5a943da294bb6a
                                                                                                                                                                                                                  • Instruction Fuzzy Hash: DE31E331B1AAC549EB219B35A8503EA6354EF85BF0F400270EA7D83BCAEE2CD305D704
                                                                                                                                                                                                                  Function 00007FF6F8FDCFD0 Relevance: 6.2, APIs: 4, Instructions: 218COMMON
                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                  • GetConsoleMode.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF6F8FDCFBB), ref: 00007FF6F8FDD0EC
                                                                                                                                                                                                                  • GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF6F8FDCFBB), ref: 00007FF6F8FDD177
                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                  • Source File: 00000000.00000002.1809060909.00007FF6F8FC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6F8FC0000, based on PE: true
                                                                                                                                                                                                                  • Associated: 00000000.00000002.1809003889.00007FF6F8FC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                  • Associated: 00000000.00000002.1809090760.00007FF6F8FEB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                  • Associated: 00000000.00000002.1809148599.00007FF6F8FFE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                  • Associated: 00000000.00000002.1809148599.00007FF6F9002000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                  • Associated: 00000000.00000002.1809223271.00007FF6F9004000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                  • Snapshot File: hcaresult_0_2_7ff6f8fc0000_dipwo1iToJ.jbxd
                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                  • API ID: ConsoleErrorLastMode
                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                  • API String ID: 953036326-0
                                                                                                                                                                                                                  • Opcode ID: 6e58aef6e17acf8d0a0aea0d946e1cce7a25eacb923cf4c64ad3114965f560b8
                                                                                                                                                                                                                  • Instruction ID: 9f3c3f3c20c938cee16a9ba7890618f6db03e026b2f685556f3947eb65f19ba8
                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 6e58aef6e17acf8d0a0aea0d946e1cce7a25eacb923cf4c64ad3114965f560b8
                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 3491D233E1A6528AF750AF7598402BD2BA2EB44BE8F145179DF2E936C4EE3CD4429704
                                                                                                                                                                                                                  Function 00007FF6F8FDF9FC Relevance: 6.2, APIs: 4, Instructions: 162COMMON
                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                  • Source File: 00000000.00000002.1809060909.00007FF6F8FC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6F8FC0000, based on PE: true
                                                                                                                                                                                                                  • Associated: 00000000.00000002.1809003889.00007FF6F8FC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                  • Associated: 00000000.00000002.1809090760.00007FF6F8FEB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                  • Associated: 00000000.00000002.1809148599.00007FF6F8FFE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                  • Associated: 00000000.00000002.1809148599.00007FF6F9002000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                  • Associated: 00000000.00000002.1809223271.00007FF6F9004000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                  • Snapshot File: hcaresult_0_2_7ff6f8fc0000_dipwo1iToJ.jbxd
                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                  • API ID: _get_daylight$_isindst
                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                  • API String ID: 4170891091-0
                                                                                                                                                                                                                  • Opcode ID: 4d98307b2f9efdc6516e3695475c092fba069f5f92b05f4e8f1f7e1348ba3a44
                                                                                                                                                                                                                  • Instruction ID: 0452490a201b0b7d6415b073c18cfd6c29de8b34a671e2355f957307de89715e
                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 4d98307b2f9efdc6516e3695475c092fba069f5f92b05f4e8f1f7e1348ba3a44
                                                                                                                                                                                                                  • Instruction Fuzzy Hash: D651D573F0A1128EEB14CF349951ABC2762EB543B8F500275DE2ED3AE5EF38A4029704
                                                                                                                                                                                                                  Function 00007FF6F8FD57EC Relevance: 6.1, APIs: 4, Instructions: 119pipeCOMMON
                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                  • Source File: 00000000.00000002.1809060909.00007FF6F8FC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6F8FC0000, based on PE: true
                                                                                                                                                                                                                  • Associated: 00000000.00000002.1809003889.00007FF6F8FC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                  • Associated: 00000000.00000002.1809090760.00007FF6F8FEB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                  • Associated: 00000000.00000002.1809148599.00007FF6F8FFE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                  • Associated: 00000000.00000002.1809148599.00007FF6F9002000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                  • Associated: 00000000.00000002.1809223271.00007FF6F9004000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                  • Snapshot File: hcaresult_0_2_7ff6f8fc0000_dipwo1iToJ.jbxd
                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                  • API ID: File$ErrorHandleInformationLastNamedPeekPipeType
                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                  • API String ID: 2780335769-0
                                                                                                                                                                                                                  • Opcode ID: 9a0c598da5bacb08a65281ee6853743b6bc645484a6b27ddd69bc7d98502ecbe
                                                                                                                                                                                                                  • Instruction ID: 4a9dfae7a86ddb3c772f6e37722f7eecc17f3c928f2f7d8875bebebc7da61068
                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 9a0c598da5bacb08a65281ee6853743b6bc645484a6b27ddd69bc7d98502ecbe
                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 71518C33E096418EFB10DF71D8503BD23A2AB48BA8F148475DF69976C9EF38D441A709
                                                                                                                                                                                                                  Function 00007FF6F8FD5698 Relevance: 6.1, APIs: 4, Instructions: 90fileCOMMON
                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                  • Source File: 00000000.00000002.1809060909.00007FF6F8FC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6F8FC0000, based on PE: true
                                                                                                                                                                                                                  • Associated: 00000000.00000002.1809003889.00007FF6F8FC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                  • Associated: 00000000.00000002.1809090760.00007FF6F8FEB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                  • Associated: 00000000.00000002.1809148599.00007FF6F8FFE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                  • Associated: 00000000.00000002.1809148599.00007FF6F9002000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                  • Associated: 00000000.00000002.1809223271.00007FF6F9004000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                  • Snapshot File: hcaresult_0_2_7ff6f8fc0000_dipwo1iToJ.jbxd
                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                  • API ID: CloseCreateFileHandle_invalid_parameter_noinfo
                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                  • API String ID: 1279662727-0
                                                                                                                                                                                                                  • Opcode ID: 24238bc47b860f74abc13910c6a37bc7991964e3dbe0c30fb6d15975fbdc4001
                                                                                                                                                                                                                  • Instruction ID: 991721680511ecb1656f4518aba9896e3bf5277f2c145b0c14d0bd90714c52bb
                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 24238bc47b860f74abc13910c6a37bc7991964e3dbe0c30fb6d15975fbdc4001
                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 4E41A133D197828BE7509B3099103697361FB987B4F108374EBAC87AD2EF6CA5E09704
                                                                                                                                                                                                                  Function 00007FF6F8FCCCAC Relevance: 4.6, APIs: 3, Instructions: 94COMMON
                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                  • Source File: 00000000.00000002.1809060909.00007FF6F8FC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6F8FC0000, based on PE: true
                                                                                                                                                                                                                  • Associated: 00000000.00000002.1809003889.00007FF6F8FC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                  • Associated: 00000000.00000002.1809090760.00007FF6F8FEB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                  • Associated: 00000000.00000002.1809148599.00007FF6F8FFE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                  • Associated: 00000000.00000002.1809148599.00007FF6F9002000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                  • Associated: 00000000.00000002.1809223271.00007FF6F9004000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                  • Snapshot File: hcaresult_0_2_7ff6f8fc0000_dipwo1iToJ.jbxd
                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                  • API ID: __scrt_acquire_startup_lock__scrt_dllmain_crt_thread_attach__scrt_get_show_window_mode__scrt_release_startup_lock
                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                  • API String ID: 3251591375-0
                                                                                                                                                                                                                  • Opcode ID: bd18f10481fc1cc14ce46c2a249e6ab71ba61d2437927de899b0ff225cfe2228
                                                                                                                                                                                                                  • Instruction ID: b26e5a556e3809c065a2acad19c70920da886ff9f067c750cc05a7b36ba9096e
                                                                                                                                                                                                                  • Opcode Fuzzy Hash: bd18f10481fc1cc14ce46c2a249e6ab71ba61d2437927de899b0ff225cfe2228
                                                                                                                                                                                                                  • Instruction Fuzzy Hash: BB315A31E0A20349FB24AB7498113B91792AF423E4F4404B8DA7DCB2D7FE2CA705E218
                                                                                                                                                                                                                  Function 00007FF6F8FD9AA0 Relevance: 4.5, APIs: 3, Instructions: 14COMMON
                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                  • Source File: 00000000.00000002.1809060909.00007FF6F8FC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6F8FC0000, based on PE: true
                                                                                                                                                                                                                  • Associated: 00000000.00000002.1809003889.00007FF6F8FC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                  • Associated: 00000000.00000002.1809090760.00007FF6F8FEB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                  • Associated: 00000000.00000002.1809148599.00007FF6F8FFE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                  • Associated: 00000000.00000002.1809148599.00007FF6F9002000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                  • Associated: 00000000.00000002.1809223271.00007FF6F9004000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                  • Snapshot File: hcaresult_0_2_7ff6f8fc0000_dipwo1iToJ.jbxd
                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                  • API ID: Process$CurrentExitTerminate
                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                  • API String ID: 1703294689-0
                                                                                                                                                                                                                  • Opcode ID: 230ddfbeb2cfdc83e04e02b0fbb537ff9f96aef2fd2a5ab3fdce6eee95276a48
                                                                                                                                                                                                                  • Instruction ID: 4e88987f7a9b6c1d39e817599524bc1fbb03f724a8cede60e9ebe8a2d2220ea7
                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 230ddfbeb2cfdc83e04e02b0fbb537ff9f96aef2fd2a5ab3fdce6eee95276a48
                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 7CD06736B0A6464AEB142BB0589907812926F487A1B5414B8D92B973D3FD2CA4496308
                                                                                                                                                                                                                  Function 00007FF6F8FD01AC Relevance: 3.2, APIs: 2, Instructions: 177COMMONLIBRARYCODE
                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                  • Source File: 00000000.00000002.1809060909.00007FF6F8FC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6F8FC0000, based on PE: true
                                                                                                                                                                                                                  • Associated: 00000000.00000002.1809003889.00007FF6F8FC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                  • Associated: 00000000.00000002.1809090760.00007FF6F8FEB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                  • Associated: 00000000.00000002.1809148599.00007FF6F8FFE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                  • Associated: 00000000.00000002.1809148599.00007FF6F9002000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                  • Associated: 00000000.00000002.1809223271.00007FF6F9004000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                  • Snapshot File: hcaresult_0_2_7ff6f8fc0000_dipwo1iToJ.jbxd
                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                  • API ID: _invalid_parameter_noinfo
                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                  • API String ID: 3215553584-0
                                                                                                                                                                                                                  • Opcode ID: 2fd4b9cf4e2c203a215f80a0453bc9b94d2a0e119ef729a2f51343e3c0f92604
                                                                                                                                                                                                                  • Instruction ID: b32426c6bc6de5d9141ff66928b5cc47daee5976ca798bbaac20b4223c6133b2
                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 2fd4b9cf4e2c203a215f80a0453bc9b94d2a0e119ef729a2f51343e3c0f92604
                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 8951B273A0B2428EEF289A36940067E6692ABC4BF4F144774DF7D877C5EE3CD401A618
                                                                                                                                                                                                                  Function 00007FF6F8FDC1A4 Relevance: 3.0, APIs: 2, Instructions: 46COMMONLIBRARYCODE
                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                  • Source File: 00000000.00000002.1809060909.00007FF6F8FC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6F8FC0000, based on PE: true
                                                                                                                                                                                                                  • Associated: 00000000.00000002.1809003889.00007FF6F8FC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                  • Associated: 00000000.00000002.1809090760.00007FF6F8FEB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                  • Associated: 00000000.00000002.1809148599.00007FF6F8FFE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                  • Associated: 00000000.00000002.1809148599.00007FF6F9002000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                  • Associated: 00000000.00000002.1809223271.00007FF6F9004000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                  • Snapshot File: hcaresult_0_2_7ff6f8fc0000_dipwo1iToJ.jbxd
                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                  • API ID: ErrorFileLastPointer
                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                  • API String ID: 2976181284-0
                                                                                                                                                                                                                  • Opcode ID: fe8bab274ce7bcf2293d1df97f88808174c3604892bb54168c1d2d59b6616a84
                                                                                                                                                                                                                  • Instruction ID: 76b3696af12265a9e53946c8514ab6f34c674a3c6104329502e1a04fb32bad84
                                                                                                                                                                                                                  • Opcode Fuzzy Hash: fe8bab274ce7bcf2293d1df97f88808174c3604892bb54168c1d2d59b6616a84
                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 50112372718A8289DB108B35E8040696362BB41BF0F540371EF7D8B7E8EF3CD0029704
                                                                                                                                                                                                                  Function 00007FF6F8FD5994 Relevance: 3.0, APIs: 2, Instructions: 40timeCOMMON
                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                  • FileTimeToSystemTime.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF6F8FD58A9), ref: 00007FF6F8FD59C7
                                                                                                                                                                                                                  • SystemTimeToTzSpecificLocalTime.KERNELBASE(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF6F8FD58A9), ref: 00007FF6F8FD59DD
                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                  • Source File: 00000000.00000002.1809060909.00007FF6F8FC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6F8FC0000, based on PE: true
                                                                                                                                                                                                                  • Associated: 00000000.00000002.1809003889.00007FF6F8FC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                  • Associated: 00000000.00000002.1809090760.00007FF6F8FEB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                  • Associated: 00000000.00000002.1809148599.00007FF6F8FFE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                  • Associated: 00000000.00000002.1809148599.00007FF6F9002000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                  • Associated: 00000000.00000002.1809223271.00007FF6F9004000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                  • Snapshot File: hcaresult_0_2_7ff6f8fc0000_dipwo1iToJ.jbxd
                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                  • API ID: Time$System$FileLocalSpecific
                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                  • API String ID: 1707611234-0
                                                                                                                                                                                                                  • Opcode ID: 3eb82881f56b5e10c0b4ae1229c4961d4f4fc58e8f6ff53d00dfea58f30bf4d5
                                                                                                                                                                                                                  • Instruction ID: 8c82b1ac318242098e3635e7e11cb8313ee08f36eaf971d36c76a6c0b019cc3b
                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 3eb82881f56b5e10c0b4ae1229c4961d4f4fc58e8f6ff53d00dfea58f30bf4d5
                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 1811913361D6128AEB548B20A84113AB7A1FB887B1F500275FBADC29D8FF3CD014EB04
                                                                                                                                                                                                                  Function 00007FF6F8FDA9B8 Relevance: 3.0, APIs: 2, Instructions: 19memoryCOMMONLIBRARYCODE
                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                  • RtlFreeHeap.NTDLL(?,?,?,00007FF6F8FE2D92,?,?,?,00007FF6F8FE2DCF,?,?,00000000,00007FF6F8FE3295,?,?,?,00007FF6F8FE31C7), ref: 00007FF6F8FDA9CE
                                                                                                                                                                                                                  • GetLastError.KERNEL32(?,?,?,00007FF6F8FE2D92,?,?,?,00007FF6F8FE2DCF,?,?,00000000,00007FF6F8FE3295,?,?,?,00007FF6F8FE31C7), ref: 00007FF6F8FDA9D8
                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                  • Source File: 00000000.00000002.1809060909.00007FF6F8FC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6F8FC0000, based on PE: true
                                                                                                                                                                                                                  • Associated: 00000000.00000002.1809003889.00007FF6F8FC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                  • Associated: 00000000.00000002.1809090760.00007FF6F8FEB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                  • Associated: 00000000.00000002.1809148599.00007FF6F8FFE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                  • Associated: 00000000.00000002.1809148599.00007FF6F9002000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                  • Associated: 00000000.00000002.1809223271.00007FF6F9004000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                  • Snapshot File: hcaresult_0_2_7ff6f8fc0000_dipwo1iToJ.jbxd
                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                  • API ID: ErrorFreeHeapLast
                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                  • API String ID: 485612231-0
                                                                                                                                                                                                                  • Opcode ID: 4768bb9444967098c6ff0662bce39d003f3d6bed11959a3c87c06bce48e858a7
                                                                                                                                                                                                                  • Instruction ID: feb707cb35af371423aa557f727a3a656d87bd941d4a19c90ade3fc7ceb238a3
                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 4768bb9444967098c6ff0662bce39d003f3d6bed11959a3c87c06bce48e858a7
                                                                                                                                                                                                                  • Instruction Fuzzy Hash: C4E08632F0B2035AFF055BB2984613812526F947E0F4405B4CA3DD32E1FE2C6985A318
                                                                                                                                                                                                                  Function 00007FF6F8FDABC8 Relevance: 2.6, APIs: 2, Instructions: 59COMMON
                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                  • CloseHandle.KERNELBASE(?,?,?,00007FF6F8FDAA45,?,?,00000000,00007FF6F8FDAAFA), ref: 00007FF6F8FDAC36
                                                                                                                                                                                                                  • GetLastError.KERNEL32(?,?,?,00007FF6F8FDAA45,?,?,00000000,00007FF6F8FDAAFA), ref: 00007FF6F8FDAC40
                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                  • Source File: 00000000.00000002.1809060909.00007FF6F8FC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6F8FC0000, based on PE: true
                                                                                                                                                                                                                  • Associated: 00000000.00000002.1809003889.00007FF6F8FC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                  • Associated: 00000000.00000002.1809090760.00007FF6F8FEB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                  • Associated: 00000000.00000002.1809148599.00007FF6F8FFE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                  • Associated: 00000000.00000002.1809148599.00007FF6F9002000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                  • Associated: 00000000.00000002.1809223271.00007FF6F9004000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                  • Snapshot File: hcaresult_0_2_7ff6f8fc0000_dipwo1iToJ.jbxd
                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                  • API ID: CloseErrorHandleLast
                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                  • API String ID: 918212764-0
                                                                                                                                                                                                                  • Opcode ID: 1c4273fb4a414bd16749861b25ace672462e960675883ae7dbf138385109c950
                                                                                                                                                                                                                  • Instruction ID: 6940588f9b1506e6b3a63ef22404735fab446ce3b210f328419031e0a473ef97
                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 1c4273fb4a414bd16749861b25ace672462e960675883ae7dbf138385109c950
                                                                                                                                                                                                                  • Instruction Fuzzy Hash: B621A432B2E6424AEBA0577194512791693AF847F0F0846B9DB3EC73D5EE6CE446A30C
                                                                                                                                                                                                                  Function 00007FF6F8FDBF1C Relevance: 1.6, APIs: 1, Instructions: 112COMMONLIBRARYCODE
                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                  • Source File: 00000000.00000002.1809060909.00007FF6F8FC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6F8FC0000, based on PE: true
                                                                                                                                                                                                                  • Associated: 00000000.00000002.1809003889.00007FF6F8FC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                  • Associated: 00000000.00000002.1809090760.00007FF6F8FEB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                  • Associated: 00000000.00000002.1809148599.00007FF6F8FFE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                  • Associated: 00000000.00000002.1809148599.00007FF6F9002000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                  • Associated: 00000000.00000002.1809223271.00007FF6F9004000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                  • Snapshot File: hcaresult_0_2_7ff6f8fc0000_dipwo1iToJ.jbxd
                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                  • API ID: _invalid_parameter_noinfo
                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                  • API String ID: 3215553584-0
                                                                                                                                                                                                                  • Opcode ID: 83fd655adac635c1bfef66338e564e5d3c087748e58eff1a34e14c1f5e77bb28
                                                                                                                                                                                                                  • Instruction ID: 23c06b043e534e969ff61cdab74d526035c4c38e4fb94bdf7f79686af9665a1b
                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 83fd655adac635c1bfef66338e564e5d3c087748e58eff1a34e14c1f5e77bb28
                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 1341C13390A2018BEB349B75A54127973A2EB56BE0F500171DBAAC36D1EF2DE403DB59
                                                                                                                                                                                                                  Function 00007FF6F8FC7F80 Relevance: 1.6, APIs: 1, Instructions: 85COMMON
                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                  • Source File: 00000000.00000002.1809060909.00007FF6F8FC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6F8FC0000, based on PE: true
                                                                                                                                                                                                                  • Associated: 00000000.00000002.1809003889.00007FF6F8FC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                  • Associated: 00000000.00000002.1809090760.00007FF6F8FEB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                  • Associated: 00000000.00000002.1809148599.00007FF6F8FFE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                  • Associated: 00000000.00000002.1809148599.00007FF6F9002000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                  • Associated: 00000000.00000002.1809223271.00007FF6F9004000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                  • Snapshot File: hcaresult_0_2_7ff6f8fc0000_dipwo1iToJ.jbxd
                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                  • API ID: _fread_nolock
                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                  • API String ID: 840049012-0
                                                                                                                                                                                                                  • Opcode ID: 9308b687cf4eea5a9f9c2c4d0625b2a01abdca647666c74d71e3793018cb6a8d
                                                                                                                                                                                                                  • Instruction ID: 2ff879456e5647b595fbdbf94edb33921640710527a8594da5edc1ba7c8b38f6
                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 9308b687cf4eea5a9f9c2c4d0625b2a01abdca647666c74d71e3793018cb6a8d
                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 0421E631B6A65149FB109A3265003BA9741FF46BE4F8C4070EE2D8B7C7EE3DE245D208
                                                                                                                                                                                                                  Function 00007FF6F8FDB9AC Relevance: 1.6, APIs: 1, Instructions: 79COMMONLIBRARYCODE
                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                  • Source File: 00000000.00000002.1809060909.00007FF6F8FC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6F8FC0000, based on PE: true
                                                                                                                                                                                                                  • Associated: 00000000.00000002.1809003889.00007FF6F8FC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                  • Associated: 00000000.00000002.1809090760.00007FF6F8FEB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                  • Associated: 00000000.00000002.1809148599.00007FF6F8FFE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                  • Associated: 00000000.00000002.1809148599.00007FF6F9002000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                  • Associated: 00000000.00000002.1809223271.00007FF6F9004000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                  • Snapshot File: hcaresult_0_2_7ff6f8fc0000_dipwo1iToJ.jbxd
                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                  • API ID: _invalid_parameter_noinfo
                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                  • API String ID: 3215553584-0
                                                                                                                                                                                                                  • Opcode ID: e965e93cbe1d72adb8351a0dc15ff4730447cd31f91a428760958f4d16ec249d
                                                                                                                                                                                                                  • Instruction ID: b569d15b094e7544a48c6e42eddba262bee4739ac25a37a5097de7caf09e3692
                                                                                                                                                                                                                  • Opcode Fuzzy Hash: e965e93cbe1d72adb8351a0dc15ff4730447cd31f91a428760958f4d16ec249d
                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 3831C133A1A64289E7116F75884137C2A51AF40BF4F8205B5EB7D833E2EF7CE441A729
                                                                                                                                                                                                                  Function 00007FF6F8FD99D1 Relevance: 1.6, APIs: 1, Instructions: 61COMMON
                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                  • Source File: 00000000.00000002.1809060909.00007FF6F8FC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6F8FC0000, based on PE: true
                                                                                                                                                                                                                  • Associated: 00000000.00000002.1809003889.00007FF6F8FC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                  • Associated: 00000000.00000002.1809090760.00007FF6F8FEB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                  • Associated: 00000000.00000002.1809148599.00007FF6F8FFE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                  • Associated: 00000000.00000002.1809148599.00007FF6F9002000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                  • Associated: 00000000.00000002.1809223271.00007FF6F9004000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                  • Snapshot File: hcaresult_0_2_7ff6f8fc0000_dipwo1iToJ.jbxd
                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                  • API ID: HandleModule$AddressFreeLibraryProc
                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                  • API String ID: 3947729631-0
                                                                                                                                                                                                                  • Opcode ID: c67799cafce48778543f3f8f4be5d8193b6380671b5390c3378b203fc6564281
                                                                                                                                                                                                                  • Instruction ID: 33355fda9a75a28de86f42604dea73f465a3aa973e7bb9aa410c3688218d8da7
                                                                                                                                                                                                                  • Opcode Fuzzy Hash: c67799cafce48778543f3f8f4be5d8193b6380671b5390c3378b203fc6564281
                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 2E216B33B066828EEB648FB4C4882AC33A2EB04768F544675D72D87AD5EF78D584D744
                                                                                                                                                                                                                  Function 00007FF6F8FD6004 Relevance: 1.6, APIs: 1, Instructions: 55COMMON
                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                  • Source File: 00000000.00000002.1809060909.00007FF6F8FC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6F8FC0000, based on PE: true
                                                                                                                                                                                                                  • Associated: 00000000.00000002.1809003889.00007FF6F8FC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                  • Associated: 00000000.00000002.1809090760.00007FF6F8FEB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                  • Associated: 00000000.00000002.1809148599.00007FF6F8FFE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                  • Associated: 00000000.00000002.1809148599.00007FF6F9002000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                  • Associated: 00000000.00000002.1809223271.00007FF6F9004000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                  • Snapshot File: hcaresult_0_2_7ff6f8fc0000_dipwo1iToJ.jbxd
                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                  • API ID: _invalid_parameter_noinfo
                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                  • API String ID: 3215553584-0
                                                                                                                                                                                                                  • Opcode ID: d0ecc1d4814c8292f6d285d86e9f4332b8d7141ecd04c52723bb65a1ba9d936a
                                                                                                                                                                                                                  • Instruction ID: 6e6d2d52d951ca21c390a2b54fcc0eefaa965e837d5fd0a77bb1238cd1e0aeae
                                                                                                                                                                                                                  • Opcode Fuzzy Hash: d0ecc1d4814c8292f6d285d86e9f4332b8d7141ecd04c52723bb65a1ba9d936a
                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 1711A433A0E64149EB609F61980117DA366AF49BE0F440571EF5CDBAD6EF3DD400A708
                                                                                                                                                                                                                  Function 00007FF6F8FE63C4 Relevance: 1.6, APIs: 1, Instructions: 54COMMON
                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                  • Source File: 00000000.00000002.1809060909.00007FF6F8FC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6F8FC0000, based on PE: true
                                                                                                                                                                                                                  • Associated: 00000000.00000002.1809003889.00007FF6F8FC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                  • Associated: 00000000.00000002.1809090760.00007FF6F8FEB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                  • Associated: 00000000.00000002.1809148599.00007FF6F8FFE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                  • Associated: 00000000.00000002.1809148599.00007FF6F9002000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                  • Associated: 00000000.00000002.1809223271.00007FF6F9004000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                  • Snapshot File: hcaresult_0_2_7ff6f8fc0000_dipwo1iToJ.jbxd
                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                  • API ID: _invalid_parameter_noinfo
                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                  • API String ID: 3215553584-0
                                                                                                                                                                                                                  • Opcode ID: 3ea3ce3b0d542221f39e0ec21b1c29adddc4a64aa4be1ebee55588f6cedcbaa9
                                                                                                                                                                                                                  • Instruction ID: fb1ca54aa8b9cb68321df7d50206c6788fb30862cc3153b084bee94f122acbc5
                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 3ea3ce3b0d542221f39e0ec21b1c29adddc4a64aa4be1ebee55588f6cedcbaa9
                                                                                                                                                                                                                  • Instruction Fuzzy Hash: CC219272619A468ADB618F28D44037976A1FB84BE4F144234E6ADC76D9EF3CD410DB04
                                                                                                                                                                                                                  Function 00007FF6F8FD042C Relevance: 1.5, APIs: 1, Instructions: 48COMMONLIBRARYCODE
                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                  • Source File: 00000000.00000002.1809060909.00007FF6F8FC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6F8FC0000, based on PE: true
                                                                                                                                                                                                                  • Associated: 00000000.00000002.1809003889.00007FF6F8FC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                  • Associated: 00000000.00000002.1809090760.00007FF6F8FEB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                  • Associated: 00000000.00000002.1809148599.00007FF6F8FFE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                  • Associated: 00000000.00000002.1809148599.00007FF6F9002000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                  • Associated: 00000000.00000002.1809223271.00007FF6F9004000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                  • Snapshot File: hcaresult_0_2_7ff6f8fc0000_dipwo1iToJ.jbxd
                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                  • API ID: _invalid_parameter_noinfo
                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                  • API String ID: 3215553584-0
                                                                                                                                                                                                                  • Opcode ID: 8e9754deeba93abb4745aa2efb451e77357aefa8fb0fbddb16feb6c8c90fdd62
                                                                                                                                                                                                                  • Instruction ID: d772a13325d8719168274032a12d51493332f3bfd5e7c16f5bc9756e23d95137
                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 8e9754deeba93abb4745aa2efb451e77357aefa8fb0fbddb16feb6c8c90fdd62
                                                                                                                                                                                                                  • Instruction Fuzzy Hash: E7018E32A0974148EB049B629901469A692BF96FF0B0846B1EF7C97BD6EE3CE4116308
                                                                                                                                                                                                                  Function 00007FF6F8FD7F6C Relevance: 1.5, APIs: 1, Instructions: 43COMMON
                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                  • Source File: 00000000.00000002.1809060909.00007FF6F8FC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6F8FC0000, based on PE: true
                                                                                                                                                                                                                  • Associated: 00000000.00000002.1809003889.00007FF6F8FC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                  • Associated: 00000000.00000002.1809090760.00007FF6F8FEB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                  • Associated: 00000000.00000002.1809148599.00007FF6F8FFE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                  • Associated: 00000000.00000002.1809148599.00007FF6F9002000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                  • Associated: 00000000.00000002.1809223271.00007FF6F9004000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                  • Snapshot File: hcaresult_0_2_7ff6f8fc0000_dipwo1iToJ.jbxd
                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                  • API ID: _invalid_parameter_noinfo
                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                  • API String ID: 3215553584-0
                                                                                                                                                                                                                  • Opcode ID: 6832eb5f98ca96f5e7cd25db8366a3c1a8b2d6b45623d2691d830cdd3d76c9ad
                                                                                                                                                                                                                  • Instruction ID: ddd158e47d95c626c74babbdfb660c6737dfee1685ae0fbbab11495d6b9ad090
                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 6832eb5f98ca96f5e7cd25db8366a3c1a8b2d6b45623d2691d830cdd3d76c9ad
                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 19018B32A1E28748FB605A35690117D5692AF447F0F0445B9EB7CCB6DAFF2CA440A249
                                                                                                                                                                                                                  Function 00007FF6F8FD82A8 Relevance: 1.5, APIs: 1, Instructions: 19COMMON
                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                  • Source File: 00000000.00000002.1809060909.00007FF6F8FC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6F8FC0000, based on PE: true
                                                                                                                                                                                                                  • Associated: 00000000.00000002.1809003889.00007FF6F8FC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                  • Associated: 00000000.00000002.1809090760.00007FF6F8FEB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                  • Associated: 00000000.00000002.1809148599.00007FF6F8FFE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                  • Associated: 00000000.00000002.1809148599.00007FF6F9002000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                  • Associated: 00000000.00000002.1809223271.00007FF6F9004000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                  • Snapshot File: hcaresult_0_2_7ff6f8fc0000_dipwo1iToJ.jbxd
                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                  • API ID: _invalid_parameter_noinfo
                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                  • API String ID: 3215553584-0
                                                                                                                                                                                                                  • Opcode ID: 3541b91b086c77dfe17527b78ee7977ece0d5fdea915d925a3ffaee66e22a6c2
                                                                                                                                                                                                                  • Instruction ID: f76601aa3ba9f0ffc60f59e921d606794152d6d0779beeacf0ee3d1840f197de
                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 3541b91b086c77dfe17527b78ee7977ece0d5fdea915d925a3ffaee66e22a6c2
                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 76E08CB2F2A6078EF7103AB5448217922124F553E2F4448B0EB29C73D3FE2C6848723D
                                                                                                                                                                                                                  Function 00007FF6F8FDD66C Relevance: 1.3, APIs: 1, Instructions: 29memoryCOMMONLIBRARYCODE
                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                  • HeapAlloc.KERNEL32(?,?,?,00007FF6F8FD0D00,?,?,?,00007FF6F8FD236A,?,?,?,?,?,00007FF6F8FD3B59), ref: 00007FF6F8FDD6AA
                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                  • Source File: 00000000.00000002.1809060909.00007FF6F8FC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6F8FC0000, based on PE: true
                                                                                                                                                                                                                  • Associated: 00000000.00000002.1809003889.00007FF6F8FC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                  • Associated: 00000000.00000002.1809090760.00007FF6F8FEB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                  • Associated: 00000000.00000002.1809148599.00007FF6F8FFE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                  • Associated: 00000000.00000002.1809148599.00007FF6F9002000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                  • Associated: 00000000.00000002.1809223271.00007FF6F9004000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                  • Snapshot File: hcaresult_0_2_7ff6f8fc0000_dipwo1iToJ.jbxd
                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                  • API ID: AllocHeap
                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                  • API String ID: 4292702814-0
                                                                                                                                                                                                                  • Opcode ID: 5ab6faa5eb5c52a79f6ef15f458d67d4847db3a002ac7bba2a3205d093894568
                                                                                                                                                                                                                  • Instruction ID: 4f581a4a81071ea327d2e8b4aa60b1eaf2df503a2f28a7c71ee77aab974d61ce
                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 5ab6faa5eb5c52a79f6ef15f458d67d4847db3a002ac7bba2a3205d093894568
                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 5CF03A22B0B2024EFF657BB1581167812924F547F0F0906B0EA3EC72D5FE2CA440A658

                                                                                                                                                                                                                  Non-executed Functions

                                                                                                                                                                                                                  Function 00007FF6F8FC76B0 Relevance: 177.1, APIs: 66, Strings: 35, Instructions: 314libraryloaderCOMMON
                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                  Strings
                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                  • Source File: 00000000.00000002.1809060909.00007FF6F8FC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6F8FC0000, based on PE: true
                                                                                                                                                                                                                  • Associated: 00000000.00000002.1809003889.00007FF6F8FC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                  • Associated: 00000000.00000002.1809090760.00007FF6F8FEB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                  • Associated: 00000000.00000002.1809148599.00007FF6F8FFE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                  • Associated: 00000000.00000002.1809148599.00007FF6F9002000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                  • Associated: 00000000.00000002.1809223271.00007FF6F9004000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                  • Snapshot File: hcaresult_0_2_7ff6f8fc0000_dipwo1iToJ.jbxd
                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                  • API ID: AddressErrorLastProc
                                                                                                                                                                                                                  • String ID: Failed to get address for %hs$GetProcAddress$Tcl_Alloc$Tcl_ConditionFinalize$Tcl_ConditionNotify$Tcl_ConditionWait$Tcl_CreateInterp$Tcl_CreateObjCommand$Tcl_CreateThread$Tcl_DeleteInterp$Tcl_DoOneEvent$Tcl_EvalEx$Tcl_EvalFile$Tcl_EvalObjv$Tcl_Finalize$Tcl_FinalizeThread$Tcl_FindExecutable$Tcl_Free$Tcl_GetCurrentThread$Tcl_GetObjResult$Tcl_GetString$Tcl_GetVar2$Tcl_Init$Tcl_JoinThread$Tcl_MutexFinalize$Tcl_MutexLock$Tcl_MutexUnlock$Tcl_NewByteArrayObj$Tcl_NewStringObj$Tcl_SetVar2$Tcl_SetVar2Ex$Tcl_ThreadAlert$Tcl_ThreadQueueEvent$Tk_GetNumMainWindows$Tk_Init
                                                                                                                                                                                                                  • API String ID: 199729137-3427451314
                                                                                                                                                                                                                  • Opcode ID: 0a662de07e299f73dada83b080b335429a490c7fb48c0bc5bb894b33d2b2cc2e
                                                                                                                                                                                                                  • Instruction ID: c339a7b503fd7f3466c9e57c5bb30ce09d51ea53179d8c0090c89470b6e321a1
                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 0a662de07e299f73dada83b080b335429a490c7fb48c0bc5bb894b33d2b2cc2e
                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 2102C330A0FB0789FB55AF79A8105B422A1AF057F5B8010B5D53E976E5FF3CB648A318
                                                                                                                                                                                                                  Function 00007FF6F8FE411C Relevance: 24.0, APIs: 9, Strings: 4, Instructions: 1226COMMON
                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                  Strings
                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                  • Source File: 00000000.00000002.1809060909.00007FF6F8FC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6F8FC0000, based on PE: true
                                                                                                                                                                                                                  • Associated: 00000000.00000002.1809003889.00007FF6F8FC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                  • Associated: 00000000.00000002.1809090760.00007FF6F8FEB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                  • Associated: 00000000.00000002.1809148599.00007FF6F8FFE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                  • Associated: 00000000.00000002.1809148599.00007FF6F9002000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                  • Associated: 00000000.00000002.1809223271.00007FF6F9004000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                  • Snapshot File: hcaresult_0_2_7ff6f8fc0000_dipwo1iToJ.jbxd
                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                  • API ID: _invalid_parameter_noinfo$memcpy_s$fegetenv
                                                                                                                                                                                                                  • String ID: 1#IND$1#INF$1#QNAN$1#SNAN
                                                                                                                                                                                                                  • API String ID: 808467561-2761157908
                                                                                                                                                                                                                  • Opcode ID: 5eb30dd7dc62229e37aa5031b27090d50e2656cb9eae334aa241f26caa9cb01e
                                                                                                                                                                                                                  • Instruction ID: 5131fe55cf08a6993c49ab25a08779146551f5de102a7e2ad847fa4fd286a361
                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 5eb30dd7dc62229e37aa5031b27090d50e2656cb9eae334aa241f26caa9cb01e
                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 89B2C272A1A6828FE7248E74D8407FD77A1FB643D8F501179DA2997AC4EF38A900DB44
                                                                                                                                                                                                                  Function 00007FF6F8FCAD1D Relevance: 12.0, Strings: 9, Instructions: 744COMMON
                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                  Strings
                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                  • Source File: 00000000.00000002.1809060909.00007FF6F8FC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6F8FC0000, based on PE: true
                                                                                                                                                                                                                  • Associated: 00000000.00000002.1809003889.00007FF6F8FC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                  • Associated: 00000000.00000002.1809090760.00007FF6F8FEB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                  • Associated: 00000000.00000002.1809148599.00007FF6F8FFE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                  • Associated: 00000000.00000002.1809148599.00007FF6F9002000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                  • Associated: 00000000.00000002.1809223271.00007FF6F9004000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                  • Snapshot File: hcaresult_0_2_7ff6f8fc0000_dipwo1iToJ.jbxd
                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                  • API ID:
                                                                                                                                                                                                                  • String ID: invalid bit length repeat$invalid code -- missing end-of-block$invalid code lengths set$invalid distance code$invalid distance too far back$invalid distances set$invalid literal/length code$invalid literal/lengths set$too many length or distance symbols
                                                                                                                                                                                                                  • API String ID: 0-2665694366
                                                                                                                                                                                                                  • Opcode ID: 183baba8c618070380c74d0f680cff30a06716a401d1faaba0935d79222a4dc0
                                                                                                                                                                                                                  • Instruction ID: 5ae5b863b7b8b674c374495782c3cc1c24fd369333190efd2eee729e71c5ec08
                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 183baba8c618070380c74d0f680cff30a06716a401d1faaba0935d79222a4dc0
                                                                                                                                                                                                                  • Instruction Fuzzy Hash: A1523572A192A68BD7948F24D458B7E3BADFB45390F414138E65A837C1EF3CEA44DB04
                                                                                                                                                                                                                  Function 00007FF6F8FCD19C Relevance: 10.6, APIs: 7, Instructions: 71COMMON
                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                  • Source File: 00000000.00000002.1809060909.00007FF6F8FC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6F8FC0000, based on PE: true
                                                                                                                                                                                                                  • Associated: 00000000.00000002.1809003889.00007FF6F8FC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                  • Associated: 00000000.00000002.1809090760.00007FF6F8FEB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                  • Associated: 00000000.00000002.1809148599.00007FF6F8FFE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                  • Associated: 00000000.00000002.1809148599.00007FF6F9002000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                  • Associated: 00000000.00000002.1809223271.00007FF6F9004000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                  • Snapshot File: hcaresult_0_2_7ff6f8fc0000_dipwo1iToJ.jbxd
                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                  • API ID: ExceptionFilterPresentUnhandled$CaptureContextDebuggerEntryFeatureFunctionLookupProcessorUnwindVirtual
                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                  • API String ID: 3140674995-0
                                                                                                                                                                                                                  • Opcode ID: e81d7d82d421bb6c6595da19fcb57285cd54aee8b88ef40036ddb2a35706c3b0
                                                                                                                                                                                                                  • Instruction ID: b83e341319e6fc5828cbd1d6a91cb499e33ee2471da968f6ca93d51efea6c276
                                                                                                                                                                                                                  • Opcode Fuzzy Hash: e81d7d82d421bb6c6595da19fcb57285cd54aee8b88ef40036ddb2a35706c3b0
                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 4C315272709B8189EB609F60E8403EE7360FB85754F444039DA5D97B95EF3CD648D714
                                                                                                                                                                                                                  Function 00007FF6F8FDA684 Relevance: 9.1, APIs: 6, Instructions: 83COMMONLIBRARYCODE
                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                  • Source File: 00000000.00000002.1809060909.00007FF6F8FC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6F8FC0000, based on PE: true
                                                                                                                                                                                                                  • Associated: 00000000.00000002.1809003889.00007FF6F8FC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                  • Associated: 00000000.00000002.1809090760.00007FF6F8FEB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                  • Associated: 00000000.00000002.1809148599.00007FF6F8FFE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                  • Associated: 00000000.00000002.1809148599.00007FF6F9002000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                  • Associated: 00000000.00000002.1809223271.00007FF6F9004000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                  • Snapshot File: hcaresult_0_2_7ff6f8fc0000_dipwo1iToJ.jbxd
                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                  • API ID: ExceptionFilterUnhandled$CaptureContextDebuggerEntryFunctionLookupPresentUnwindVirtual
                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                  • API String ID: 1239891234-0
                                                                                                                                                                                                                  • Opcode ID: 823e7cd4caae9fc37a1281b2c5c5551f9de180c5e8ac7c275112a8c84bbfd9bf
                                                                                                                                                                                                                  • Instruction ID: 2ff0af9f776c5e1e4d74639dddb300e999eb213eb88d929bd1e5768b820ae3f0
                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 823e7cd4caae9fc37a1281b2c5c5551f9de180c5e8ac7c275112a8c84bbfd9bf
                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 39317432619B8189D760CF35E8402AE73A4FB897A4F540135EA9D87B95EF3CC545CB04
                                                                                                                                                                                                                  Function 00007FF6F8FE18E4 Relevance: 7.8, APIs: 5, Instructions: 282COMMON
                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                  • Source File: 00000000.00000002.1809060909.00007FF6F8FC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6F8FC0000, based on PE: true
                                                                                                                                                                                                                  • Associated: 00000000.00000002.1809003889.00007FF6F8FC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                  • Associated: 00000000.00000002.1809090760.00007FF6F8FEB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                  • Associated: 00000000.00000002.1809148599.00007FF6F8FFE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                  • Associated: 00000000.00000002.1809148599.00007FF6F9002000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                  • Associated: 00000000.00000002.1809223271.00007FF6F9004000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                  • Snapshot File: hcaresult_0_2_7ff6f8fc0000_dipwo1iToJ.jbxd
                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                  • API ID: FileFindFirst_invalid_parameter_noinfo
                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                  • API String ID: 2227656907-0
                                                                                                                                                                                                                  • Opcode ID: 5fde642f47360a120b3bbdc49a752417dcdc94f7dd720a243365bab1f94d45be
                                                                                                                                                                                                                  • Instruction ID: a0049f307e9c142f15703f1762eccca086aa1220a2bec0de9edf7d39ea695bc0
                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 5fde642f47360a120b3bbdc49a752417dcdc94f7dd720a243365bab1f94d45be
                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 49B1C432F1A68649EB619B3694001B963A5EB44BF5F444171EA6EC7BC5FE3CE481E308
                                                                                                                                                                                                                  Function 00007FF6F8FCD080 Relevance: 6.0, APIs: 4, Instructions: 39timethreadCOMMON
                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                  • Source File: 00000000.00000002.1809060909.00007FF6F8FC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6F8FC0000, based on PE: true
                                                                                                                                                                                                                  • Associated: 00000000.00000002.1809003889.00007FF6F8FC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                  • Associated: 00000000.00000002.1809090760.00007FF6F8FEB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                  • Associated: 00000000.00000002.1809148599.00007FF6F8FFE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                  • Associated: 00000000.00000002.1809148599.00007FF6F9002000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                  • Associated: 00000000.00000002.1809223271.00007FF6F9004000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                  • Snapshot File: hcaresult_0_2_7ff6f8fc0000_dipwo1iToJ.jbxd
                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                  • API ID: CurrentTime$CounterFilePerformanceProcessQuerySystemThread
                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                  • API String ID: 2933794660-0
                                                                                                                                                                                                                  • Opcode ID: c7e0dc91749b0d7e19b464317103f3c41f17e8dff95374d43b780ecdfe6bf67b
                                                                                                                                                                                                                  • Instruction ID: 5827fbda55b5fd23a397198d9bdab2bbbfd4673e8c0f0e1e6d21787113893ac1
                                                                                                                                                                                                                  • Opcode Fuzzy Hash: c7e0dc91749b0d7e19b464317103f3c41f17e8dff95374d43b780ecdfe6bf67b
                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 3E114C32B15B068AEB00CB70E8442A933A4FB597A8F440E31DA2D877A4EF3CD1588344
                                                                                                                                                                                                                  Function 00007FF6F8FE3C80 Relevance: 4.8, APIs: 3, Instructions: 340COMMON
                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                  • Source File: 00000000.00000002.1809060909.00007FF6F8FC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6F8FC0000, based on PE: true
                                                                                                                                                                                                                  • Associated: 00000000.00000002.1809003889.00007FF6F8FC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                  • Associated: 00000000.00000002.1809090760.00007FF6F8FEB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                  • Associated: 00000000.00000002.1809148599.00007FF6F8FFE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                  • Associated: 00000000.00000002.1809148599.00007FF6F9002000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                  • Associated: 00000000.00000002.1809223271.00007FF6F9004000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                  • Snapshot File: hcaresult_0_2_7ff6f8fc0000_dipwo1iToJ.jbxd
                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                  • API ID: memcpy_s
                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                  • API String ID: 1502251526-0
                                                                                                                                                                                                                  • Opcode ID: 723df14fe8405c9280d13974b9e0b256372cd2939c4def8ecbac686ef57d643c
                                                                                                                                                                                                                  • Instruction ID: f97e9080eea9c82f43a1d47678935845a7e3fdaa3abc55778520c10378280824
                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 723df14fe8405c9280d13974b9e0b256372cd2939c4def8ecbac686ef57d643c
                                                                                                                                                                                                                  • Instruction Fuzzy Hash: B0C10972B1A6868BDB24CF29E04866AB791F7947D4F448138DB5E83784EF3DE904CB44
                                                                                                                                                                                                                  Function 00007FF6F8FCA4E4 Relevance: 4.1, Strings: 3, Instructions: 398COMMON
                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                  Strings
                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                  • Source File: 00000000.00000002.1809060909.00007FF6F8FC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6F8FC0000, based on PE: true
                                                                                                                                                                                                                  • Associated: 00000000.00000002.1809003889.00007FF6F8FC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                  • Associated: 00000000.00000002.1809090760.00007FF6F8FEB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                  • Associated: 00000000.00000002.1809148599.00007FF6F8FFE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                  • Associated: 00000000.00000002.1809148599.00007FF6F9002000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                  • Associated: 00000000.00000002.1809223271.00007FF6F9004000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                  • Snapshot File: hcaresult_0_2_7ff6f8fc0000_dipwo1iToJ.jbxd
                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                  • API ID:
                                                                                                                                                                                                                  • String ID: $header crc mismatch$unknown header flags set
                                                                                                                                                                                                                  • API String ID: 0-1127688429
                                                                                                                                                                                                                  • Opcode ID: 41de47797cb66f1826093f4b1d60416fd99d26d25a53ce6bfd127eaa39bdfb5e
                                                                                                                                                                                                                  • Instruction ID: ba4be0a5d1062f42625c942f6d1bdac7b68e73da031ffde5c3ce1ae7f56cd811
                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 41de47797cb66f1826093f4b1d60416fd99d26d25a53ce6bfd127eaa39bdfb5e
                                                                                                                                                                                                                  • Instruction Fuzzy Hash: A0F1F5B2A093C58FE7918F259089B3A3AA9FF46790F0541B4DA59873D2EF38E740D744
                                                                                                                                                                                                                  Function 00007FF6F8FE9798 Relevance: 3.2, APIs: 2, Instructions: 227COMMONLIBRARYCODE
                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                  • Source File: 00000000.00000002.1809060909.00007FF6F8FC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6F8FC0000, based on PE: true
                                                                                                                                                                                                                  • Associated: 00000000.00000002.1809003889.00007FF6F8FC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                  • Associated: 00000000.00000002.1809090760.00007FF6F8FEB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                  • Associated: 00000000.00000002.1809148599.00007FF6F8FFE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                  • Associated: 00000000.00000002.1809148599.00007FF6F9002000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                  • Associated: 00000000.00000002.1809223271.00007FF6F9004000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                  • Snapshot File: hcaresult_0_2_7ff6f8fc0000_dipwo1iToJ.jbxd
                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                  • API ID: ExceptionRaise_clrfp
                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                  • API String ID: 15204871-0
                                                                                                                                                                                                                  • Opcode ID: 2f74b2cda317b12825bead48c90720a79ba1abfeed249303701d480a1679e454
                                                                                                                                                                                                                  • Instruction ID: 81e090dbbae496a0a9bad01a34f66a973e59e92f5e59deea95d32609e3ecea21
                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 2f74b2cda317b12825bead48c90720a79ba1abfeed249303701d480a1679e454
                                                                                                                                                                                                                  • Instruction Fuzzy Hash: F9B17A73A05B898FEB15CF29C88A36C3BA0F784B98F148861DA6D837A4DF39D451C714
                                                                                                                                                                                                                  Function 00007FF6F8FD3A14 Relevance: 2.8, Strings: 2, Instructions: 350COMMON
                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                  Strings
                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                  • Source File: 00000000.00000002.1809060909.00007FF6F8FC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6F8FC0000, based on PE: true
                                                                                                                                                                                                                  • Associated: 00000000.00000002.1809003889.00007FF6F8FC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                  • Associated: 00000000.00000002.1809090760.00007FF6F8FEB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                  • Associated: 00000000.00000002.1809148599.00007FF6F8FFE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                  • Associated: 00000000.00000002.1809148599.00007FF6F9002000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                  • Associated: 00000000.00000002.1809223271.00007FF6F9004000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                  • Snapshot File: hcaresult_0_2_7ff6f8fc0000_dipwo1iToJ.jbxd
                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                  • API ID:
                                                                                                                                                                                                                  • String ID: $
                                                                                                                                                                                                                  • API String ID: 0-227171996
                                                                                                                                                                                                                  • Opcode ID: 3098a868bf4d382f942c0283459ab4806c0f53f7eb332f8174ba39f6fc7772a0
                                                                                                                                                                                                                  • Instruction ID: 8b3f71b25ddbc40bc48c9e5da1a74213befa65faebb2542ded7e35d2d42761eb
                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 3098a868bf4d382f942c0283459ab4806c0f53f7eb332f8174ba39f6fc7772a0
                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 59E1B437A0A6464BDB688B35845013DA3A2FB45BE4F140275DF6E876D4FF29D842E708
                                                                                                                                                                                                                  Function 00007FF6F8FCA34B Relevance: 2.7, Strings: 2, Instructions: 216COMMON
                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                  Strings
                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                  • Source File: 00000000.00000002.1809060909.00007FF6F8FC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6F8FC0000, based on PE: true
                                                                                                                                                                                                                  • Associated: 00000000.00000002.1809003889.00007FF6F8FC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                  • Associated: 00000000.00000002.1809090760.00007FF6F8FEB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                  • Associated: 00000000.00000002.1809148599.00007FF6F8FFE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                  • Associated: 00000000.00000002.1809148599.00007FF6F9002000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                  • Associated: 00000000.00000002.1809223271.00007FF6F9004000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                  • Snapshot File: hcaresult_0_2_7ff6f8fc0000_dipwo1iToJ.jbxd
                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                  • API ID:
                                                                                                                                                                                                                  • String ID: incorrect header check$invalid window size
                                                                                                                                                                                                                  • API String ID: 0-900081337
                                                                                                                                                                                                                  • Opcode ID: 5aba513b73eb8988df982bd12c0510577381bb82701c7147ce4cedc0b53fa8f7
                                                                                                                                                                                                                  • Instruction ID: 49410a244fa7b68bbbde64872d487c127d0a5c8c6a3179ae4548e22ce4a4eb8e
                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 5aba513b73eb8988df982bd12c0510577381bb82701c7147ce4cedc0b53fa8f7
                                                                                                                                                                                                                  • Instruction Fuzzy Hash: C391E972A192D68FE7A48E24D44DB3E3A99FB413A0F114175DA6A877C1EF38E740DB04
                                                                                                                                                                                                                  Function 00007FF6F8FDDF60 Relevance: 2.6, Strings: 2, Instructions: 144COMMON
                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                  Strings
                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                  • Source File: 00000000.00000002.1809060909.00007FF6F8FC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6F8FC0000, based on PE: true
                                                                                                                                                                                                                  • Associated: 00000000.00000002.1809003889.00007FF6F8FC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                  • Associated: 00000000.00000002.1809090760.00007FF6F8FEB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                  • Associated: 00000000.00000002.1809148599.00007FF6F8FFE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                  • Associated: 00000000.00000002.1809148599.00007FF6F9002000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                  • Associated: 00000000.00000002.1809223271.00007FF6F9004000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                  • Snapshot File: hcaresult_0_2_7ff6f8fc0000_dipwo1iToJ.jbxd
                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                  • API ID:
                                                                                                                                                                                                                  • String ID: e+000$gfff
                                                                                                                                                                                                                  • API String ID: 0-3030954782
                                                                                                                                                                                                                  • Opcode ID: b62be3d0480bbbd0e022829aa0980c84d51f153df7fa61e27e52cad2b39beef0
                                                                                                                                                                                                                  • Instruction ID: f900690daa31e34c5b053161bfe87d2857f3b7d3dee0b77bd49d81984fbb2d36
                                                                                                                                                                                                                  • Opcode Fuzzy Hash: b62be3d0480bbbd0e022829aa0980c84d51f153df7fa61e27e52cad2b39beef0
                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 9C515873B192C14AE7258A3598057697B92E744BE4F48D2B1CBBC87AC5EE7DE040D704
                                                                                                                                                                                                                  Function 00007FF6F8FDDACC Relevance: 1.5, Strings: 1, Instructions: 254COMMON
                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                  Strings
                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                  • Source File: 00000000.00000002.1809060909.00007FF6F8FC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6F8FC0000, based on PE: true
                                                                                                                                                                                                                  • Associated: 00000000.00000002.1809003889.00007FF6F8FC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                  • Associated: 00000000.00000002.1809090760.00007FF6F8FEB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                  • Associated: 00000000.00000002.1809148599.00007FF6F8FFE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                  • Associated: 00000000.00000002.1809148599.00007FF6F9002000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                  • Associated: 00000000.00000002.1809223271.00007FF6F9004000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                  • Snapshot File: hcaresult_0_2_7ff6f8fc0000_dipwo1iToJ.jbxd
                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                  • API ID:
                                                                                                                                                                                                                  • String ID: gfffffff
                                                                                                                                                                                                                  • API String ID: 0-1523873471
                                                                                                                                                                                                                  • Opcode ID: bcab6200947a377332474fa44b4677218d40dcace4b26705986274372b0e4f91
                                                                                                                                                                                                                  • Instruction ID: 89bc0aa122ac7623428c640e250105313200cf4e574cb8dd0bf301af48d81709
                                                                                                                                                                                                                  • Opcode Fuzzy Hash: bcab6200947a377332474fa44b4677218d40dcace4b26705986274372b0e4f91
                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 6AA13473A0A7864BEB21DB39A4007A97B92AB647E4F048071DFAD877C5EE3DE501D304
                                                                                                                                                                                                                  Function 00007FF6F8FD8804 Relevance: 1.4, Strings: 1, Instructions: 177COMMON
                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                  Strings
                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                  • Source File: 00000000.00000002.1809060909.00007FF6F8FC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6F8FC0000, based on PE: true
                                                                                                                                                                                                                  • Associated: 00000000.00000002.1809003889.00007FF6F8FC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                  • Associated: 00000000.00000002.1809090760.00007FF6F8FEB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                  • Associated: 00000000.00000002.1809148599.00007FF6F8FFE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                  • Associated: 00000000.00000002.1809148599.00007FF6F9002000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                  • Associated: 00000000.00000002.1809223271.00007FF6F9004000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                  • Snapshot File: hcaresult_0_2_7ff6f8fc0000_dipwo1iToJ.jbxd
                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                  • API ID: _invalid_parameter_noinfo
                                                                                                                                                                                                                  • String ID: TMP
                                                                                                                                                                                                                  • API String ID: 3215553584-3125297090
                                                                                                                                                                                                                  • Opcode ID: 5f14576829c2a404d65bc8e6713cc3c63392e5e443677cfdf71167dbae88db0a
                                                                                                                                                                                                                  • Instruction ID: b51bf62687ed4ef080b19796234d327c8d4a8913ccf56a619b14a74303404193
                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 5f14576829c2a404d65bc8e6713cc3c63392e5e443677cfdf71167dbae88db0a
                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 6851B222F3A34249FB64AB36590117A52926F44BE4F5889B4DF6DC37D2FE3CE441620D
                                                                                                                                                                                                                  Function 00007FF6F8FE34F0 Relevance: 1.3, APIs: 1, Instructions: 7memoryCOMMON
                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                  • Source File: 00000000.00000002.1809060909.00007FF6F8FC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6F8FC0000, based on PE: true
                                                                                                                                                                                                                  • Associated: 00000000.00000002.1809003889.00007FF6F8FC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                  • Associated: 00000000.00000002.1809090760.00007FF6F8FEB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                  • Associated: 00000000.00000002.1809148599.00007FF6F8FFE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                  • Associated: 00000000.00000002.1809148599.00007FF6F9002000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                  • Associated: 00000000.00000002.1809223271.00007FF6F9004000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                  • Snapshot File: hcaresult_0_2_7ff6f8fc0000_dipwo1iToJ.jbxd
                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                  • API ID: HeapProcess
                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                  • API String ID: 54951025-0
                                                                                                                                                                                                                  • Opcode ID: 39e33fd4700d97162abc6aa121af668d241eeaeaed41ff08026f27548e358ff0
                                                                                                                                                                                                                  • Instruction ID: 89ed36b8e632263b21bcc9a4d03b032f4ed92bea1c049ddce3837032af29f59b
                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 39e33fd4700d97162abc6aa121af668d241eeaeaed41ff08026f27548e358ff0
                                                                                                                                                                                                                  • Instruction Fuzzy Hash: BCB09230E0BA02C6EB0A2F216C8621822A57F48750FD80178C02C92370EE2C20E56710
                                                                                                                                                                                                                  Function 00007FF6F8FD3610 Relevance: .3, Instructions: 327COMMON
                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                  • Source File: 00000000.00000002.1809060909.00007FF6F8FC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6F8FC0000, based on PE: true
                                                                                                                                                                                                                  • Associated: 00000000.00000002.1809003889.00007FF6F8FC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                  • Associated: 00000000.00000002.1809090760.00007FF6F8FEB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                  • Associated: 00000000.00000002.1809148599.00007FF6F8FFE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                  • Associated: 00000000.00000002.1809148599.00007FF6F9002000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                  • Associated: 00000000.00000002.1809223271.00007FF6F9004000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                  • Snapshot File: hcaresult_0_2_7ff6f8fc0000_dipwo1iToJ.jbxd
                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                  • API ID:
                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                  • API String ID:
                                                                                                                                                                                                                  • Opcode ID: 5f2a1199bc68cddcf3b08423a19983f3afdde0c7e054ddf4c3f66946da216a90
                                                                                                                                                                                                                  • Instruction ID: ee98b5721b11829a6b496a2f2034f1683a66eb80f52a1677c094bd7c7a09d714
                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 5f2a1199bc68cddcf3b08423a19983f3afdde0c7e054ddf4c3f66946da216a90
                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 3FD1B673A0A6424BEB688B35805063DA3A2AB45BE8F144275CF2D876D5FF39E845E304
                                                                                                                                                                                                                  Function 00007FF6F8FC9870 Relevance: .3, Instructions: 287COMMON
                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                  • Source File: 00000000.00000002.1809060909.00007FF6F8FC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6F8FC0000, based on PE: true
                                                                                                                                                                                                                  • Associated: 00000000.00000002.1809003889.00007FF6F8FC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                  • Associated: 00000000.00000002.1809090760.00007FF6F8FEB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                  • Associated: 00000000.00000002.1809148599.00007FF6F8FFE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                  • Associated: 00000000.00000002.1809148599.00007FF6F9002000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                  • Associated: 00000000.00000002.1809223271.00007FF6F9004000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                  • Snapshot File: hcaresult_0_2_7ff6f8fc0000_dipwo1iToJ.jbxd
                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                  • API ID:
                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                  • API String ID:
                                                                                                                                                                                                                  • Opcode ID: 069bb313382d3adaff5ac451a95cb3dd74dda88d5dd80987c9f0d361d468a953
                                                                                                                                                                                                                  • Instruction ID: bf4231f53255827578622fab97121409db7011dc48d5ba60b94974aca503576f
                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 069bb313382d3adaff5ac451a95cb3dd74dda88d5dd80987c9f0d361d468a953
                                                                                                                                                                                                                  • Instruction Fuzzy Hash: C6C1B0762181E08BD289EB29E47947A73D0F78934DB95406BEF87477C6CB3CA514EB10
                                                                                                                                                                                                                  Function 00007FF6F8FD2C80 Relevance: .2, Instructions: 241COMMON
                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                  • Source File: 00000000.00000002.1809060909.00007FF6F8FC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6F8FC0000, based on PE: true
                                                                                                                                                                                                                  • Associated: 00000000.00000002.1809003889.00007FF6F8FC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                  • Associated: 00000000.00000002.1809090760.00007FF6F8FEB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                  • Associated: 00000000.00000002.1809148599.00007FF6F8FFE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                  • Associated: 00000000.00000002.1809148599.00007FF6F9002000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                  • Associated: 00000000.00000002.1809223271.00007FF6F9004000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                  • Snapshot File: hcaresult_0_2_7ff6f8fc0000_dipwo1iToJ.jbxd
                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                  • API ID:
                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                  • API String ID:
                                                                                                                                                                                                                  • Opcode ID: 2617fd8e8f043c0917c6a56c5cabdca8b91b1cd744d59a3c82f21f331bc63c74
                                                                                                                                                                                                                  • Instruction ID: e625b35af324e6c6473e2d9626592d197bfdf87ee1c4a66917595f7788e33e0f
                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 2617fd8e8f043c0917c6a56c5cabdca8b91b1cd744d59a3c82f21f331bc63c74
                                                                                                                                                                                                                  • Instruction Fuzzy Hash: D0B17E73A0A78589E7658F39C05012C3BA2E749BA8F240575CB5DC73D9EF39E441E788
                                                                                                                                                                                                                  Function 00007FF6F8FDE5E0 Relevance: .2, Instructions: 198COMMON
                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                  • Source File: 00000000.00000002.1809060909.00007FF6F8FC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6F8FC0000, based on PE: true
                                                                                                                                                                                                                  • Associated: 00000000.00000002.1809003889.00007FF6F8FC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                  • Associated: 00000000.00000002.1809090760.00007FF6F8FEB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                  • Associated: 00000000.00000002.1809148599.00007FF6F8FFE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                  • Associated: 00000000.00000002.1809148599.00007FF6F9002000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                  • Associated: 00000000.00000002.1809223271.00007FF6F9004000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                  • Snapshot File: hcaresult_0_2_7ff6f8fc0000_dipwo1iToJ.jbxd
                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                  • API ID:
                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                  • API String ID:
                                                                                                                                                                                                                  • Opcode ID: 73948b09e9837a821f5a3b4bbb106c60bdc2a86aaa707f45330964650836ebfe
                                                                                                                                                                                                                  • Instruction ID: 6e28d21e55fdb13beb8583e324825cd85afa987439cbfcc6987b1f83d3a6b69c
                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 73948b09e9837a821f5a3b4bbb106c60bdc2a86aaa707f45330964650836ebfe
                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 64811573A193814AE7B4CB3994403797A92FB457E4F544275DBAE87BC5EE3CE4009B04
                                                                                                                                                                                                                  Function 00007FF6F8FE6488 Relevance: .2, Instructions: 183COMMON
                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                  • Source File: 00000000.00000002.1809060909.00007FF6F8FC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6F8FC0000, based on PE: true
                                                                                                                                                                                                                  • Associated: 00000000.00000002.1809003889.00007FF6F8FC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                  • Associated: 00000000.00000002.1809090760.00007FF6F8FEB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                  • Associated: 00000000.00000002.1809148599.00007FF6F8FFE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                  • Associated: 00000000.00000002.1809148599.00007FF6F9002000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                  • Associated: 00000000.00000002.1809223271.00007FF6F9004000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                  • Snapshot File: hcaresult_0_2_7ff6f8fc0000_dipwo1iToJ.jbxd
                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                  • API ID: _invalid_parameter_noinfo
                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                  • API String ID: 3215553584-0
                                                                                                                                                                                                                  • Opcode ID: 0ac6b4c320f8a85a272a2d207e476957e076465a5e78eda0eae0a584ad6410a5
                                                                                                                                                                                                                  • Instruction ID: 6e6c3cfe5588313fc2ea21ad217beec1bbf0a225eddf892c9b588091a7d3a0bb
                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 0ac6b4c320f8a85a272a2d207e476957e076465a5e78eda0eae0a584ad6410a5
                                                                                                                                                                                                                  • Instruction Fuzzy Hash: D761D732F1A29A4EF7649E38845423D6681AF507F0F1542B9D63ECB6D5FE6DE800E708
                                                                                                                                                                                                                  Function 00007FF6F8FD19B4 Relevance: .1, Instructions: 146COMMON
                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                  • Source File: 00000000.00000002.1809060909.00007FF6F8FC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6F8FC0000, based on PE: true
                                                                                                                                                                                                                  • Associated: 00000000.00000002.1809003889.00007FF6F8FC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                  • Associated: 00000000.00000002.1809090760.00007FF6F8FEB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                  • Associated: 00000000.00000002.1809148599.00007FF6F8FFE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                  • Associated: 00000000.00000002.1809148599.00007FF6F9002000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                  • Associated: 00000000.00000002.1809223271.00007FF6F9004000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                  • Snapshot File: hcaresult_0_2_7ff6f8fc0000_dipwo1iToJ.jbxd
                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                  • API ID:
                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                  • API String ID:
                                                                                                                                                                                                                  • Opcode ID: 68a3f5aab59b2fac328bd6ba34d5b1cd1fa94c6914f84dc4a79da3b9d8ff9a98
                                                                                                                                                                                                                  • Instruction ID: 47ce34e9f6320e7770177d897ae019cb49faab06c448b915803f0f4a43dfa7a1
                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 68a3f5aab59b2fac328bd6ba34d5b1cd1fa94c6914f84dc4a79da3b9d8ff9a98
                                                                                                                                                                                                                  • Instruction Fuzzy Hash: D8517137E196528AE7248B39C04022873A2EB45BB8F244171CF5D977D4EF3AE893D744
                                                                                                                                                                                                                  Function 00007FF6F8FD21D4 Relevance: .1, Instructions: 146COMMON
                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                  • Source File: 00000000.00000002.1809060909.00007FF6F8FC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6F8FC0000, based on PE: true
                                                                                                                                                                                                                  • Associated: 00000000.00000002.1809003889.00007FF6F8FC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                  • Associated: 00000000.00000002.1809090760.00007FF6F8FEB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                  • Associated: 00000000.00000002.1809148599.00007FF6F8FFE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                  • Associated: 00000000.00000002.1809148599.00007FF6F9002000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                  • Associated: 00000000.00000002.1809223271.00007FF6F9004000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                  • Snapshot File: hcaresult_0_2_7ff6f8fc0000_dipwo1iToJ.jbxd
                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                  • API ID:
                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                  • API String ID:
                                                                                                                                                                                                                  • Opcode ID: 8e69dfdcc94a0aa650623f7423aa354004c1f2fa01d5c1268249020d4c21f447
                                                                                                                                                                                                                  • Instruction ID: 036cfd047d33f05f0cd653dcfec52773de3161e86094d466f88402465b8a7259
                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 8e69dfdcc94a0aa650623f7423aa354004c1f2fa01d5c1268249020d4c21f447
                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 8E515E33A196518AE7248B39C04022C23A2EB54BA9F244171DF6DC77D4EF3AF843E794
                                                                                                                                                                                                                  Function 00007FF6F8FD1DC4 Relevance: .1, Instructions: 146COMMON
                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                  • Source File: 00000000.00000002.1809060909.00007FF6F8FC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6F8FC0000, based on PE: true
                                                                                                                                                                                                                  • Associated: 00000000.00000002.1809003889.00007FF6F8FC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                  • Associated: 00000000.00000002.1809090760.00007FF6F8FEB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                  • Associated: 00000000.00000002.1809148599.00007FF6F8FFE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                  • Associated: 00000000.00000002.1809148599.00007FF6F9002000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                  • Associated: 00000000.00000002.1809223271.00007FF6F9004000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                  • Snapshot File: hcaresult_0_2_7ff6f8fc0000_dipwo1iToJ.jbxd
                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                  • API ID:
                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                  • API String ID:
                                                                                                                                                                                                                  • Opcode ID: 27099d1c67046ba5536a5c52bb1b19252402c8bb4a5167aa336477e7b6d5f807
                                                                                                                                                                                                                  • Instruction ID: 15dff0fa1491abbf39108222ac17a49f74489d8243610fac1bc39837d3ad62fe
                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 27099d1c67046ba5536a5c52bb1b19252402c8bb4a5167aa336477e7b6d5f807
                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 35516537E1965389E7248B39D04022873A2EB44BB8F244171CF5D877D4EF3AE892D744
                                                                                                                                                                                                                  Function 00007FF6F8FD1BC0 Relevance: .1, Instructions: 145COMMON
                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                  • Source File: 00000000.00000002.1809060909.00007FF6F8FC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6F8FC0000, based on PE: true
                                                                                                                                                                                                                  • Associated: 00000000.00000002.1809003889.00007FF6F8FC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                  • Associated: 00000000.00000002.1809090760.00007FF6F8FEB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                  • Associated: 00000000.00000002.1809148599.00007FF6F8FFE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                  • Associated: 00000000.00000002.1809148599.00007FF6F9002000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                  • Associated: 00000000.00000002.1809223271.00007FF6F9004000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                  • Snapshot File: hcaresult_0_2_7ff6f8fc0000_dipwo1iToJ.jbxd
                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                  • API ID:
                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                  • API String ID:
                                                                                                                                                                                                                  • Opcode ID: dc981bf603441a130e1c6ba5e96f77be0c3c60e19ec03e3d560a09712d731568
                                                                                                                                                                                                                  • Instruction ID: 0a0d6cd2771cacdb83a089ee22c6519bf96a07f7e5c22160021c5c4f53f69e39
                                                                                                                                                                                                                  • Opcode Fuzzy Hash: dc981bf603441a130e1c6ba5e96f77be0c3c60e19ec03e3d560a09712d731568
                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 52518233E196528AE7248B39C04026877A2EB45BA8F244171CF5D977D4EF3AE883D748
                                                                                                                                                                                                                  Function 00007FF6F8FD17B0 Relevance: .1, Instructions: 145COMMON
                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                  • Source File: 00000000.00000002.1809060909.00007FF6F8FC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6F8FC0000, based on PE: true
                                                                                                                                                                                                                  • Associated: 00000000.00000002.1809003889.00007FF6F8FC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                  • Associated: 00000000.00000002.1809090760.00007FF6F8FEB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                  • Associated: 00000000.00000002.1809148599.00007FF6F8FFE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                  • Associated: 00000000.00000002.1809148599.00007FF6F9002000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                  • Associated: 00000000.00000002.1809223271.00007FF6F9004000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                  • Snapshot File: hcaresult_0_2_7ff6f8fc0000_dipwo1iToJ.jbxd
                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                  • API ID:
                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                  • API String ID:
                                                                                                                                                                                                                  • Opcode ID: 3943df286285c50b07f09d339b53caaa0afa34ddfac4fad96d8a3f7ffd6ad23b
                                                                                                                                                                                                                  • Instruction ID: dac0bd97138b41c835c5d9112fe3db38e16aeca6aa187689fa04f55a3f780994
                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 3943df286285c50b07f09d339b53caaa0afa34ddfac4fad96d8a3f7ffd6ad23b
                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 33519637E1965289E7248B39D04023CA7A2EB44BA8F349171CF5C977D4DF3AE892E744
                                                                                                                                                                                                                  Function 00007FF6F8FD1FD0 Relevance: .1, Instructions: 145COMMON
                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                  • Source File: 00000000.00000002.1809060909.00007FF6F8FC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6F8FC0000, based on PE: true
                                                                                                                                                                                                                  • Associated: 00000000.00000002.1809003889.00007FF6F8FC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                  • Associated: 00000000.00000002.1809090760.00007FF6F8FEB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                  • Associated: 00000000.00000002.1809148599.00007FF6F8FFE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                  • Associated: 00000000.00000002.1809148599.00007FF6F9002000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                  • Associated: 00000000.00000002.1809223271.00007FF6F9004000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                  • Snapshot File: hcaresult_0_2_7ff6f8fc0000_dipwo1iToJ.jbxd
                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                  • API ID:
                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                  • API String ID:
                                                                                                                                                                                                                  • Opcode ID: e734bc54909bdf7d9c6fd1772be64da5dc64d4f5bf3044a39ac3ba7850561882
                                                                                                                                                                                                                  • Instruction ID: 73f0aa16203bf22922b0614033eefc88e68e48e7e468f936861ca94797a2d97c
                                                                                                                                                                                                                  • Opcode Fuzzy Hash: e734bc54909bdf7d9c6fd1772be64da5dc64d4f5bf3044a39ac3ba7850561882
                                                                                                                                                                                                                  • Instruction Fuzzy Hash: FA518237A1965189E7248B39C44422827A2EB44BA8F249171CB5CD77E4EF3AFC43D784
                                                                                                                                                                                                                  Function 00007FF6F8FD5DA0 Relevance: .1, Instructions: 138COMMON
                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                  • Source File: 00000000.00000002.1809060909.00007FF6F8FC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6F8FC0000, based on PE: true
                                                                                                                                                                                                                  • Associated: 00000000.00000002.1809003889.00007FF6F8FC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                  • Associated: 00000000.00000002.1809090760.00007FF6F8FEB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                  • Associated: 00000000.00000002.1809148599.00007FF6F8FFE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                  • Associated: 00000000.00000002.1809148599.00007FF6F9002000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                  • Associated: 00000000.00000002.1809223271.00007FF6F9004000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                  • Snapshot File: hcaresult_0_2_7ff6f8fc0000_dipwo1iToJ.jbxd
                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                  • API ID:
                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                  • API String ID:
                                                                                                                                                                                                                  • Opcode ID: dde3b7cfbcf26fc8d7513faefc9a59c4b8821272907dfbb35b6db6355186da00
                                                                                                                                                                                                                  • Instruction ID: 49a07dce7747bf1b25b83cd957e0196a42a88f975bc28152c16877815ab73156
                                                                                                                                                                                                                  • Opcode Fuzzy Hash: dde3b7cfbcf26fc8d7513faefc9a59c4b8821272907dfbb35b6db6355186da00
                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 4741947380B64A4CFB6599380D046B857829F6ABF1E5853F0DEB9DB3C2FD0C29869109
                                                                                                                                                                                                                  Function 00007FF6F8FD9F10 Relevance: .1, Instructions: 126COMMON
                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                  • Source File: 00000000.00000002.1809060909.00007FF6F8FC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6F8FC0000, based on PE: true
                                                                                                                                                                                                                  • Associated: 00000000.00000002.1809003889.00007FF6F8FC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                  • Associated: 00000000.00000002.1809090760.00007FF6F8FEB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                  • Associated: 00000000.00000002.1809148599.00007FF6F8FFE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                  • Associated: 00000000.00000002.1809148599.00007FF6F9002000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                  • Associated: 00000000.00000002.1809223271.00007FF6F9004000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                  • Snapshot File: hcaresult_0_2_7ff6f8fc0000_dipwo1iToJ.jbxd
                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                  • API ID: ErrorFreeHeapLast
                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                  • API String ID: 485612231-0
                                                                                                                                                                                                                  • Opcode ID: 4700cc90785079b7bb7a0602c46334a4ae9c6cdcc1bc7f68a8ec9cd099c19dcc
                                                                                                                                                                                                                  • Instruction ID: 8cc4e547a090c2c295504664865bfee6f4e9bf4a4361664e117f3e206f46c0f0
                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 4700cc90785079b7bb7a0602c46334a4ae9c6cdcc1bc7f68a8ec9cd099c19dcc
                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 86410333715A5586EF04CF7ADA55169B3A2BB88FE0B099032DE1DD7B98EE3CC4419308
                                                                                                                                                                                                                  Function 00007FF6F8FD8154 Relevance: .1, Instructions: 98COMMON
                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                  • Source File: 00000000.00000002.1809060909.00007FF6F8FC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6F8FC0000, based on PE: true
                                                                                                                                                                                                                  • Associated: 00000000.00000002.1809003889.00007FF6F8FC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                  • Associated: 00000000.00000002.1809090760.00007FF6F8FEB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                  • Associated: 00000000.00000002.1809148599.00007FF6F8FFE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                  • Associated: 00000000.00000002.1809148599.00007FF6F9002000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                  • Associated: 00000000.00000002.1809223271.00007FF6F9004000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                  • Snapshot File: hcaresult_0_2_7ff6f8fc0000_dipwo1iToJ.jbxd
                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                  • API ID:
                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                  • API String ID:
                                                                                                                                                                                                                  • Opcode ID: 12404f4f4f1323fea4d4e583727f71dd7b5a0d93f2e51056eadc76cf5c92dd81
                                                                                                                                                                                                                  • Instruction ID: 9e645e32f8866a2f2b762b8f132c5cc37058a49e9bfd552d82c20d73cf851bb2
                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 12404f4f4f1323fea4d4e583727f71dd7b5a0d93f2e51056eadc76cf5c92dd81
                                                                                                                                                                                                                  • Instruction Fuzzy Hash: A931C733B2AB4285E7649F35684013D76D6AB85BE0F144279EB6D93BD5EF3CD1025308
                                                                                                                                                                                                                  Function 00007FF6F8FE95E0 Relevance: .0, Instructions: 32COMMON
                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                  • Source File: 00000000.00000002.1809060909.00007FF6F8FC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6F8FC0000, based on PE: true
                                                                                                                                                                                                                  • Associated: 00000000.00000002.1809003889.00007FF6F8FC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                  • Associated: 00000000.00000002.1809090760.00007FF6F8FEB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                  • Associated: 00000000.00000002.1809148599.00007FF6F8FFE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                  • Associated: 00000000.00000002.1809148599.00007FF6F9002000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                  • Associated: 00000000.00000002.1809223271.00007FF6F9004000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                  • Snapshot File: hcaresult_0_2_7ff6f8fc0000_dipwo1iToJ.jbxd
                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                  • API ID:
                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                  • API String ID:
                                                                                                                                                                                                                  • Opcode ID: bcf48121633763fd2f6aa1741893fa818c421e56c797f7e3558f0bc07bbc94c0
                                                                                                                                                                                                                  • Instruction ID: e9a0f0b62c49c40139d74d10dfcad6e2c659da09ed5d860059f22c2999128a1a
                                                                                                                                                                                                                  • Opcode Fuzzy Hash: bcf48121633763fd2f6aa1741893fa818c421e56c797f7e3558f0bc07bbc94c0
                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 22F068717282568ADB998F69A84262977D0F7083C0F40A03DD59DC3B58EE3CD0619F04
                                                                                                                                                                                                                  Function 00007FF6F8FCD37C Relevance: .0, Instructions: 2COMMON
                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                  • Source File: 00000000.00000002.1809060909.00007FF6F8FC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6F8FC0000, based on PE: true
                                                                                                                                                                                                                  • Associated: 00000000.00000002.1809003889.00007FF6F8FC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                  • Associated: 00000000.00000002.1809090760.00007FF6F8FEB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                  • Associated: 00000000.00000002.1809148599.00007FF6F8FFE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                  • Associated: 00000000.00000002.1809148599.00007FF6F9002000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                  • Associated: 00000000.00000002.1809223271.00007FF6F9004000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                  • Snapshot File: hcaresult_0_2_7ff6f8fc0000_dipwo1iToJ.jbxd
                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                  • API ID:
                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                  • API String ID:
                                                                                                                                                                                                                  • Opcode ID: e6acc2ec838af36dd9636ef9e1d94249ffac8b7a33868b0b47a68aa66541c0b8
                                                                                                                                                                                                                  • Instruction ID: 4501398c0426ae015565f16186abe0b17790bb0849d542c462c54715d4dfec75
                                                                                                                                                                                                                  • Opcode Fuzzy Hash: e6acc2ec838af36dd9636ef9e1d94249ffac8b7a33868b0b47a68aa66541c0b8
                                                                                                                                                                                                                  • Instruction Fuzzy Hash: A0A00131A0E80AD8E7459B20A8900292320BB513A4B8000B1E02D970E5AE2DA600A318
                                                                                                                                                                                                                  Function 00007FF6F8FC5820 Relevance: 229.6, APIs: 86, Strings: 45, Instructions: 400libraryloaderCOMMON
                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                  • GetProcAddress.KERNEL32(?,00007FF6F8FC64BF,?,00007FF6F8FC336E), ref: 00007FF6F8FC5830
                                                                                                                                                                                                                  • GetLastError.KERNEL32(?,00007FF6F8FC64BF,?,00007FF6F8FC336E), ref: 00007FF6F8FC5842
                                                                                                                                                                                                                  • GetProcAddress.KERNEL32(?,00007FF6F8FC64BF,?,00007FF6F8FC336E), ref: 00007FF6F8FC5879
                                                                                                                                                                                                                  • GetLastError.KERNEL32(?,00007FF6F8FC64BF,?,00007FF6F8FC336E), ref: 00007FF6F8FC588B
                                                                                                                                                                                                                  • GetProcAddress.KERNEL32(?,00007FF6F8FC64BF,?,00007FF6F8FC336E), ref: 00007FF6F8FC58A4
                                                                                                                                                                                                                  • GetLastError.KERNEL32(?,00007FF6F8FC64BF,?,00007FF6F8FC336E), ref: 00007FF6F8FC58B6
                                                                                                                                                                                                                  • GetProcAddress.KERNEL32(?,00007FF6F8FC64BF,?,00007FF6F8FC336E), ref: 00007FF6F8FC58CF
                                                                                                                                                                                                                  • GetLastError.KERNEL32(?,00007FF6F8FC64BF,?,00007FF6F8FC336E), ref: 00007FF6F8FC58E1
                                                                                                                                                                                                                  • GetProcAddress.KERNEL32(?,00007FF6F8FC64BF,?,00007FF6F8FC336E), ref: 00007FF6F8FC58FD
                                                                                                                                                                                                                  • GetLastError.KERNEL32(?,00007FF6F8FC64BF,?,00007FF6F8FC336E), ref: 00007FF6F8FC590F
                                                                                                                                                                                                                  • GetProcAddress.KERNEL32(?,00007FF6F8FC64BF,?,00007FF6F8FC336E), ref: 00007FF6F8FC592B
                                                                                                                                                                                                                  • GetLastError.KERNEL32(?,00007FF6F8FC64BF,?,00007FF6F8FC336E), ref: 00007FF6F8FC593D
                                                                                                                                                                                                                  • GetProcAddress.KERNEL32(?,00007FF6F8FC64BF,?,00007FF6F8FC336E), ref: 00007FF6F8FC5959
                                                                                                                                                                                                                  • GetLastError.KERNEL32(?,00007FF6F8FC64BF,?,00007FF6F8FC336E), ref: 00007FF6F8FC596B
                                                                                                                                                                                                                  • GetProcAddress.KERNEL32(?,00007FF6F8FC64BF,?,00007FF6F8FC336E), ref: 00007FF6F8FC5987
                                                                                                                                                                                                                  • GetLastError.KERNEL32(?,00007FF6F8FC64BF,?,00007FF6F8FC336E), ref: 00007FF6F8FC5999
                                                                                                                                                                                                                  • GetProcAddress.KERNEL32(?,00007FF6F8FC64BF,?,00007FF6F8FC336E), ref: 00007FF6F8FC59B5
                                                                                                                                                                                                                  • GetLastError.KERNEL32(?,00007FF6F8FC64BF,?,00007FF6F8FC336E), ref: 00007FF6F8FC59C7
                                                                                                                                                                                                                  Strings
                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                  • Source File: 00000000.00000002.1809060909.00007FF6F8FC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6F8FC0000, based on PE: true
                                                                                                                                                                                                                  • Associated: 00000000.00000002.1809003889.00007FF6F8FC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                  • Associated: 00000000.00000002.1809090760.00007FF6F8FEB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                  • Associated: 00000000.00000002.1809148599.00007FF6F8FFE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                  • Associated: 00000000.00000002.1809148599.00007FF6F9002000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                  • Associated: 00000000.00000002.1809223271.00007FF6F9004000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                  • Snapshot File: hcaresult_0_2_7ff6f8fc0000_dipwo1iToJ.jbxd
                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                  • API ID: AddressErrorLastProc
                                                                                                                                                                                                                  • String ID: Failed to get address for %hs$GetProcAddress$PyConfig_Clear$PyConfig_InitIsolatedConfig$PyConfig_Read$PyConfig_SetBytesString$PyConfig_SetString$PyConfig_SetWideStringList$PyErr_Clear$PyErr_Fetch$PyErr_NormalizeException$PyErr_Occurred$PyErr_Print$PyErr_Restore$PyEval_EvalCode$PyImport_AddModule$PyImport_ExecCodeModule$PyImport_ImportModule$PyMarshal_ReadObjectFromString$PyMem_RawFree$PyModule_GetDict$PyObject_CallFunction$PyObject_CallFunctionObjArgs$PyObject_GetAttrString$PyObject_SetAttrString$PyObject_Str$PyPreConfig_InitIsolatedConfig$PyRun_SimpleStringFlags$PyStatus_Exception$PySys_GetObject$PySys_SetObject$PyUnicode_AsUTF8$PyUnicode_Decode$PyUnicode_DecodeFSDefault$PyUnicode_FromFormat$PyUnicode_FromString$PyUnicode_Join$PyUnicode_Replace$Py_DecRef$Py_DecodeLocale$Py_ExitStatusException$Py_Finalize$Py_InitializeFromConfig$Py_IsInitialized$Py_PreInitialize
                                                                                                                                                                                                                  • API String ID: 199729137-653951865
                                                                                                                                                                                                                  • Opcode ID: 3ca4f2c8e8fa74ff45c561f9825c8e8d27386d4e804e1314c270c66bff6859f6
                                                                                                                                                                                                                  • Instruction ID: 2839923c100d93d51db0af3ae7e27babec139cc254b7b0e2366d3da423f9c187
                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 3ca4f2c8e8fa74ff45c561f9825c8e8d27386d4e804e1314c270c66bff6859f6
                                                                                                                                                                                                                  • Instruction Fuzzy Hash: C0228F3491FB4799FB559B75AC6017422A0BF097E1B9414B5D93EA32E1FF3CB248A308
                                                                                                                                                                                                                  Function 00007FF6F8FC81C0 Relevance: 24.6, APIs: 6, Strings: 8, Instructions: 117COMMON
                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                    • Part of subcall function 00007FF6F8FC9400: MultiByteToWideChar.KERNEL32(?,?,?,00007FF6F8FC45E4,00000000,00007FF6F8FC1985), ref: 00007FF6F8FC9439
                                                                                                                                                                                                                  • ExpandEnvironmentStringsW.KERNEL32(?,00007FF6F8FC88A7,?,?,00000000,00007FF6F8FC3CBB), ref: 00007FF6F8FC821C
                                                                                                                                                                                                                    • Part of subcall function 00007FF6F8FC2810: MessageBoxW.USER32 ref: 00007FF6F8FC28EA
                                                                                                                                                                                                                  Strings
                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                  • Source File: 00000000.00000002.1809060909.00007FF6F8FC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6F8FC0000, based on PE: true
                                                                                                                                                                                                                  • Associated: 00000000.00000002.1809003889.00007FF6F8FC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                  • Associated: 00000000.00000002.1809090760.00007FF6F8FEB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                  • Associated: 00000000.00000002.1809148599.00007FF6F8FFE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                  • Associated: 00000000.00000002.1809148599.00007FF6F9002000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                  • Associated: 00000000.00000002.1809223271.00007FF6F9004000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                  • Snapshot File: hcaresult_0_2_7ff6f8fc0000_dipwo1iToJ.jbxd
                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                  • API ID: ByteCharEnvironmentExpandMessageMultiStringsWide
                                                                                                                                                                                                                  • String ID: %.*s$CreateDirectory$LOADER: failed to convert runtime-tmpdir to a wide string.$LOADER: failed to create runtime-tmpdir path %ls!$LOADER: failed to expand environment variables in the runtime-tmpdir.$LOADER: failed to obtain the absolute path of the runtime-tmpdir.$LOADER: runtime-tmpdir points to non-existent drive %ls (type: %d)!$\
                                                                                                                                                                                                                  • API String ID: 1662231829-930877121
                                                                                                                                                                                                                  • Opcode ID: e491f33a4545c5dc9e33b4da933e1c9d98f9a36929a11ac7b8a73595df86892f
                                                                                                                                                                                                                  • Instruction ID: 0a0680fe2af0631febaf8a6eaeaa741b9b9a6a22072283b43a4e9998d575944c
                                                                                                                                                                                                                  • Opcode Fuzzy Hash: e491f33a4545c5dc9e33b4da933e1c9d98f9a36929a11ac7b8a73595df86892f
                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 5151C631B3B64289EB10AB35D8552BA6251EF957E0F440472D62EC36D6FF3CE304A318
                                                                                                                                                                                                                  Function 00007FF6F8FC2180 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 120COMMON
                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                  Strings
                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                  • Source File: 00000000.00000002.1809060909.00007FF6F8FC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6F8FC0000, based on PE: true
                                                                                                                                                                                                                  • Associated: 00000000.00000002.1809003889.00007FF6F8FC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                  • Associated: 00000000.00000002.1809090760.00007FF6F8FEB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                  • Associated: 00000000.00000002.1809148599.00007FF6F8FFE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                  • Associated: 00000000.00000002.1809148599.00007FF6F9002000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                  • Associated: 00000000.00000002.1809223271.00007FF6F9004000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                  • Snapshot File: hcaresult_0_2_7ff6f8fc0000_dipwo1iToJ.jbxd
                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                  • API ID: MoveWindow$ObjectSelect$DrawReleaseText
                                                                                                                                                                                                                  • String ID: P%
                                                                                                                                                                                                                  • API String ID: 2147705588-2959514604
                                                                                                                                                                                                                  • Opcode ID: 044398bc2faddcfc72e28419b1c607044beef288ba0900b5e0371f537bcab75f
                                                                                                                                                                                                                  • Instruction ID: d3a532869f35a9fc1027a11281de787581ce46f089df358a84ab756fbf7ea3a8
                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 044398bc2faddcfc72e28419b1c607044beef288ba0900b5e0371f537bcab75f
                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 985117366047A186D7249F32E4181BAB7A1F798BA1F004121EBEE83794EF3CD145DB14
                                                                                                                                                                                                                  Function 00007FF6F8FC80B0 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 67COMMON
                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                  Strings
                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                  • Source File: 00000000.00000002.1809060909.00007FF6F8FC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6F8FC0000, based on PE: true
                                                                                                                                                                                                                  • Associated: 00000000.00000002.1809003889.00007FF6F8FC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                  • Associated: 00000000.00000002.1809090760.00007FF6F8FEB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                  • Associated: 00000000.00000002.1809148599.00007FF6F8FFE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                  • Associated: 00000000.00000002.1809148599.00007FF6F9002000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                  • Associated: 00000000.00000002.1809223271.00007FF6F9004000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                  • Snapshot File: hcaresult_0_2_7ff6f8fc0000_dipwo1iToJ.jbxd
                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                  • API ID: LongWindow$BlockCreateErrorLastReasonShutdown
                                                                                                                                                                                                                  • String ID: Needs to remove its temporary files.
                                                                                                                                                                                                                  • API String ID: 3975851968-2863640275
                                                                                                                                                                                                                  • Opcode ID: 1b4b32be61da5f45784fe9fe2f7d724fb74bbaf2a32eb33803c40e4204126e7e
                                                                                                                                                                                                                  • Instruction ID: 939262db5b177b7ae8f3bed5257103ccc34cdb214619a5d7d9ba84de179a759a
                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 1b4b32be61da5f45784fe9fe2f7d724fb74bbaf2a32eb33803c40e4204126e7e
                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 3E218631B2AA438AE7454B7AA8541796290EF89BF0F484171DA3DC37D5FE2CD7909309
                                                                                                                                                                                                                  Function 00007FF6F8FD6300 Relevance: 14.5, APIs: 3, Strings: 5, Instructions: 494COMMON
                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                  Strings
                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                  • Source File: 00000000.00000002.1809060909.00007FF6F8FC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6F8FC0000, based on PE: true
                                                                                                                                                                                                                  • Associated: 00000000.00000002.1809003889.00007FF6F8FC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                  • Associated: 00000000.00000002.1809090760.00007FF6F8FEB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                  • Associated: 00000000.00000002.1809148599.00007FF6F8FFE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                  • Associated: 00000000.00000002.1809148599.00007FF6F9002000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                  • Associated: 00000000.00000002.1809223271.00007FF6F9004000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                  • Snapshot File: hcaresult_0_2_7ff6f8fc0000_dipwo1iToJ.jbxd
                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                  • API ID: _invalid_parameter_noinfo
                                                                                                                                                                                                                  • String ID: -$:$f$p$p
                                                                                                                                                                                                                  • API String ID: 3215553584-2013873522
                                                                                                                                                                                                                  • Opcode ID: 75ce3dd5e90789a751ac91fed3db50e3550f512a2f4dec46f6fb30c565ad9a60
                                                                                                                                                                                                                  • Instruction ID: 3213a00004f2362a6eae9eb7c2a77de26c26a0b807dfa1c1298ee1e38b09f59b
                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 75ce3dd5e90789a751ac91fed3db50e3550f512a2f4dec46f6fb30c565ad9a60
                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 4E129673E0E1438AFB605A34D1542797693FB407A4F844175E7AA8B6C4FF3CE580AB89
                                                                                                                                                                                                                  Function 00007FF6F8FD1038 Relevance: 14.5, APIs: 3, Strings: 5, Instructions: 475COMMON
                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                  Strings
                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                  • Source File: 00000000.00000002.1809060909.00007FF6F8FC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6F8FC0000, based on PE: true
                                                                                                                                                                                                                  • Associated: 00000000.00000002.1809003889.00007FF6F8FC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                  • Associated: 00000000.00000002.1809090760.00007FF6F8FEB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                  • Associated: 00000000.00000002.1809148599.00007FF6F8FFE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                  • Associated: 00000000.00000002.1809148599.00007FF6F9002000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                  • Associated: 00000000.00000002.1809223271.00007FF6F9004000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                  • Snapshot File: hcaresult_0_2_7ff6f8fc0000_dipwo1iToJ.jbxd
                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                  • API ID: _invalid_parameter_noinfo
                                                                                                                                                                                                                  • String ID: f$f$p$p$f
                                                                                                                                                                                                                  • API String ID: 3215553584-1325933183
                                                                                                                                                                                                                  • Opcode ID: efdc55b57c7b5823aa39a5abe82f144bbffe385c3037011f7a836833ec2ff017
                                                                                                                                                                                                                  • Instruction ID: 3b1d6e29c0ecb4e37dd093eddd98ac11c1661d28b41c5afbfb8776108275b7a9
                                                                                                                                                                                                                  • Opcode Fuzzy Hash: efdc55b57c7b5823aa39a5abe82f144bbffe385c3037011f7a836833ec2ff017
                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 9C128533E0E14389FB20AA65D054679A263FB417A4F884075E7A9C79C4FF7CE4D0AB18
                                                                                                                                                                                                                  Function 00007FF6F8FC1050 Relevance: 14.1, APIs: 1, Strings: 7, Instructions: 119COMMON
                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                  Strings
                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                  • Source File: 00000000.00000002.1809060909.00007FF6F8FC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6F8FC0000, based on PE: true
                                                                                                                                                                                                                  • Associated: 00000000.00000002.1809003889.00007FF6F8FC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                  • Associated: 00000000.00000002.1809090760.00007FF6F8FEB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                  • Associated: 00000000.00000002.1809148599.00007FF6F8FFE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                  • Associated: 00000000.00000002.1809148599.00007FF6F9002000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                  • Associated: 00000000.00000002.1809223271.00007FF6F9004000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                  • Snapshot File: hcaresult_0_2_7ff6f8fc0000_dipwo1iToJ.jbxd
                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                  • API ID: CurrentProcess
                                                                                                                                                                                                                  • String ID: Failed to extract %s: failed to allocate data buffer (%u bytes)!$Failed to extract %s: failed to open archive file!$Failed to extract %s: failed to read data chunk!$Failed to extract %s: failed to seek to the entry's data!$fread$fseek$malloc
                                                                                                                                                                                                                  • API String ID: 2050909247-3659356012
                                                                                                                                                                                                                  • Opcode ID: 53d1e4d2edf0062f7230160cf0d8e608199b832438cf6a3aedd647e8abf4d892
                                                                                                                                                                                                                  • Instruction ID: ef2aae89ce2ae6569f53a3d5268038138851f9219d73e03bf66616052b828388
                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 53d1e4d2edf0062f7230160cf0d8e608199b832438cf6a3aedd647e8abf4d892
                                                                                                                                                                                                                  • Instruction Fuzzy Hash: B241A132E0A65289EB00DB31A8005B96395FF45BE4F9444B1EE6C877D6FE3CE341A748
                                                                                                                                                                                                                  Function 00007FF6F8FC1470 Relevance: 14.1, APIs: 1, Strings: 7, Instructions: 107COMMON
                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                  Strings
                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                  • Source File: 00000000.00000002.1809060909.00007FF6F8FC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6F8FC0000, based on PE: true
                                                                                                                                                                                                                  • Associated: 00000000.00000002.1809003889.00007FF6F8FC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                  • Associated: 00000000.00000002.1809090760.00007FF6F8FEB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                  • Associated: 00000000.00000002.1809148599.00007FF6F8FFE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                  • Associated: 00000000.00000002.1809148599.00007FF6F9002000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                  • Associated: 00000000.00000002.1809223271.00007FF6F9004000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                  • Snapshot File: hcaresult_0_2_7ff6f8fc0000_dipwo1iToJ.jbxd
                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                  • API ID: CurrentProcess
                                                                                                                                                                                                                  • String ID: Failed to extract %s: failed to allocate data buffer (%u bytes)!$Failed to extract %s: failed to open archive file!$Failed to extract %s: failed to read data chunk!$Failed to extract %s: failed to seek to the entry's data!$fread$fseek$malloc
                                                                                                                                                                                                                  • API String ID: 2050909247-3659356012
                                                                                                                                                                                                                  • Opcode ID: 9c0a33a636d22d269d029a952bcb6a186b4f055325f6749c3ab7856a71983fc4
                                                                                                                                                                                                                  • Instruction ID: 91135368ac85a72a201f5b838733ac467a29f088091ea061453af8780feae2d5
                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 9c0a33a636d22d269d029a952bcb6a186b4f055325f6749c3ab7856a71983fc4
                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 21419F32A0A64289EB10DB3194001B96391EF457E4F844872EE6D97BD6FF3CE752A748
                                                                                                                                                                                                                  Function 00007FF6F8FCEA78 Relevance: 12.6, APIs: 4, Strings: 3, Instructions: 310COMMON
                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                  Strings
                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                  • Source File: 00000000.00000002.1809060909.00007FF6F8FC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6F8FC0000, based on PE: true
                                                                                                                                                                                                                  • Associated: 00000000.00000002.1809003889.00007FF6F8FC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                  • Associated: 00000000.00000002.1809090760.00007FF6F8FEB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                  • Associated: 00000000.00000002.1809148599.00007FF6F8FFE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                  • Associated: 00000000.00000002.1809148599.00007FF6F9002000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                  • Associated: 00000000.00000002.1809223271.00007FF6F9004000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                  • Snapshot File: hcaresult_0_2_7ff6f8fc0000_dipwo1iToJ.jbxd
                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                  • API ID: BlockFrameHandler3::Unwind$CatchExecutionHandlerIs_bad_exception_allowedSearchStatestd::bad_alloc::bad_alloc
                                                                                                                                                                                                                  • String ID: csm$csm$csm
                                                                                                                                                                                                                  • API String ID: 849930591-393685449
                                                                                                                                                                                                                  • Opcode ID: b3973e9ed2b821368333a922871466498bda8290f9160b5e7eff6497ccad0325
                                                                                                                                                                                                                  • Instruction ID: e52eb737f97348e0514fe5449b624122e5ca7df51ce286198ebecb7460d3504d
                                                                                                                                                                                                                  • Opcode Fuzzy Hash: b3973e9ed2b821368333a922871466498bda8290f9160b5e7eff6497ccad0325
                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 11D16E72A097818AEB209B35D4403AD77A0FB467E8F100175EA5EA7BD6EF38E351D704
                                                                                                                                                                                                                  Function 00007FF6F8FC2C50 Relevance: 12.4, APIs: 3, Strings: 4, Instructions: 104windowCOMMON
                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                  • GetCurrentProcessId.KERNEL32(?,?,?,?,?,?,?,?,00007FF6F8FC3706,?,00007FF6F8FC3804), ref: 00007FF6F8FC2C9E
                                                                                                                                                                                                                  • FormatMessageW.KERNEL32(?,?,?,?,?,?,?,?,00007FF6F8FC3706,?,00007FF6F8FC3804), ref: 00007FF6F8FC2D63
                                                                                                                                                                                                                  • MessageBoxW.USER32 ref: 00007FF6F8FC2D99
                                                                                                                                                                                                                  Strings
                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                  • Source File: 00000000.00000002.1809060909.00007FF6F8FC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6F8FC0000, based on PE: true
                                                                                                                                                                                                                  • Associated: 00000000.00000002.1809003889.00007FF6F8FC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                  • Associated: 00000000.00000002.1809090760.00007FF6F8FEB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                  • Associated: 00000000.00000002.1809148599.00007FF6F8FFE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                  • Associated: 00000000.00000002.1809148599.00007FF6F9002000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                  • Associated: 00000000.00000002.1809223271.00007FF6F9004000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                  • Snapshot File: hcaresult_0_2_7ff6f8fc0000_dipwo1iToJ.jbxd
                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                  • API ID: Message$CurrentFormatProcess
                                                                                                                                                                                                                  • String ID: %ls: $<FormatMessageW failed.>$Error$[PYI-%d:ERROR]
                                                                                                                                                                                                                  • API String ID: 3940978338-251083826
                                                                                                                                                                                                                  • Opcode ID: 5cbcdbf458937bec5e084182eea0cc5ea1ed3b872b1d9e6a561cbd57b4752a27
                                                                                                                                                                                                                  • Instruction ID: 27d9f111168e44c07ad699636d844129969e1e976b4f507dfee850a47d5346be
                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 5cbcdbf458937bec5e084182eea0cc5ea1ed3b872b1d9e6a561cbd57b4752a27
                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 8331E533B09A4146E7209B35A8002AA6791BF89BE8F400136EF5DD3799FE3CD606D304
                                                                                                                                                                                                                  Function 00007FF6F8FCDD38 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 88libraryloaderCOMMONLIBRARYCODE
                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                  • LoadLibraryExW.KERNEL32(?,?,?,00007FF6F8FCDFEA,?,?,?,00007FF6F8FCDCDC,?,?,?,00007FF6F8FCD8D9), ref: 00007FF6F8FCDDBD
                                                                                                                                                                                                                  • GetLastError.KERNEL32(?,?,?,00007FF6F8FCDFEA,?,?,?,00007FF6F8FCDCDC,?,?,?,00007FF6F8FCD8D9), ref: 00007FF6F8FCDDCB
                                                                                                                                                                                                                  • LoadLibraryExW.KERNEL32(?,?,?,00007FF6F8FCDFEA,?,?,?,00007FF6F8FCDCDC,?,?,?,00007FF6F8FCD8D9), ref: 00007FF6F8FCDDF5
                                                                                                                                                                                                                  • FreeLibrary.KERNEL32(?,?,?,00007FF6F8FCDFEA,?,?,?,00007FF6F8FCDCDC,?,?,?,00007FF6F8FCD8D9), ref: 00007FF6F8FCDE63
                                                                                                                                                                                                                  • GetProcAddress.KERNEL32(?,?,?,00007FF6F8FCDFEA,?,?,?,00007FF6F8FCDCDC,?,?,?,00007FF6F8FCD8D9), ref: 00007FF6F8FCDE6F
                                                                                                                                                                                                                  Strings
                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                  • Source File: 00000000.00000002.1809060909.00007FF6F8FC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6F8FC0000, based on PE: true
                                                                                                                                                                                                                  • Associated: 00000000.00000002.1809003889.00007FF6F8FC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                  • Associated: 00000000.00000002.1809090760.00007FF6F8FEB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                  • Associated: 00000000.00000002.1809148599.00007FF6F8FFE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                  • Associated: 00000000.00000002.1809148599.00007FF6F9002000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                  • Associated: 00000000.00000002.1809223271.00007FF6F9004000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                  • Snapshot File: hcaresult_0_2_7ff6f8fc0000_dipwo1iToJ.jbxd
                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                  • API ID: Library$Load$AddressErrorFreeLastProc
                                                                                                                                                                                                                  • String ID: api-ms-
                                                                                                                                                                                                                  • API String ID: 2559590344-2084034818
                                                                                                                                                                                                                  • Opcode ID: 7dacba43e0eeea41cb86842b35fa5572bc178a215ab50afad80fbb9160df823c
                                                                                                                                                                                                                  • Instruction ID: 0625260f9fa965aeddc834177eb2ee98137bcfbead27f981c7857cf280a2b435
                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 7dacba43e0eeea41cb86842b35fa5572bc178a215ab50afad80fbb9160df823c
                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 5A318D31B1B60289EF12AB22A8005692394BF59BF0F494575DE3D973C6FF3CE645A318
                                                                                                                                                                                                                  Function 00007FF6F8FC6350 Relevance: 10.6, APIs: 1, Strings: 6, Instructions: 82COMMON
                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                  Strings
                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                  • Source File: 00000000.00000002.1809060909.00007FF6F8FC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6F8FC0000, based on PE: true
                                                                                                                                                                                                                  • Associated: 00000000.00000002.1809003889.00007FF6F8FC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                  • Associated: 00000000.00000002.1809090760.00007FF6F8FEB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                  • Associated: 00000000.00000002.1809148599.00007FF6F8FFE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                  • Associated: 00000000.00000002.1809148599.00007FF6F9002000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                  • Associated: 00000000.00000002.1809223271.00007FF6F9004000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                  • Snapshot File: hcaresult_0_2_7ff6f8fc0000_dipwo1iToJ.jbxd
                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                  • API ID: CurrentProcess
                                                                                                                                                                                                                  • String ID: Failed to load Python DLL '%ls'.$LoadLibrary$Path of Python shared library (%s) and its name (%s) exceed buffer size (%d)$Path of ucrtbase.dll (%s) and its name exceed buffer size (%d)$Reported length (%d) of Python shared library name (%s) exceeds buffer size (%d)$ucrtbase.dll
                                                                                                                                                                                                                  • API String ID: 2050909247-2434346643
                                                                                                                                                                                                                  • Opcode ID: 5c7507e70d60f0fb7e3c9a3209df06ed2678ab3c183624e845013dd92edd1fac
                                                                                                                                                                                                                  • Instruction ID: 782b79d011d6400a48db856800e551c3b91e2d2719bb6b09c579ac48dcdfc214
                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 5c7507e70d60f0fb7e3c9a3209df06ed2678ab3c183624e845013dd92edd1fac
                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 97414C31A1AA8699EB21DB30E4542E96321FB553E4F800172EA6D836D6FF3CE715D344
                                                                                                                                                                                                                  Function 00007FF6F8FC2A50 Relevance: 10.6, APIs: 1, Strings: 5, Instructions: 64COMMON
                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                  • GetCurrentProcessId.KERNEL32(00000000,?,?,?,00000000,00007FF6F8FC351A,?,00000000,00007FF6F8FC3F23), ref: 00007FF6F8FC2AA0
                                                                                                                                                                                                                  Strings
                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                  • Source File: 00000000.00000002.1809060909.00007FF6F8FC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6F8FC0000, based on PE: true
                                                                                                                                                                                                                  • Associated: 00000000.00000002.1809003889.00007FF6F8FC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                  • Associated: 00000000.00000002.1809090760.00007FF6F8FEB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                  • Associated: 00000000.00000002.1809148599.00007FF6F8FFE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                  • Associated: 00000000.00000002.1809148599.00007FF6F9002000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                  • Associated: 00000000.00000002.1809223271.00007FF6F9004000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                  • Snapshot File: hcaresult_0_2_7ff6f8fc0000_dipwo1iToJ.jbxd
                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                  • API ID: CurrentProcess
                                                                                                                                                                                                                  • String ID: 0$WARNING$Warning$Warning [ANSI Fallback]$[PYI-%d:%s]
                                                                                                                                                                                                                  • API String ID: 2050909247-2900015858
                                                                                                                                                                                                                  • Opcode ID: 2c88a21be5af21f56a68c86fdca39687fee9058fd376c6caa55945c458c4d180
                                                                                                                                                                                                                  • Instruction ID: 0a16deca5b66d52f32dd657097456bd85337bf7e49c7b6acb064cf8145156a9a
                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 2c88a21be5af21f56a68c86fdca39687fee9058fd376c6caa55945c458c4d180
                                                                                                                                                                                                                  • Instruction Fuzzy Hash: FF21A132A1A7818AE720DB61B8807E66394FB883D4F400172FE9CD3799EF3CD2499704
                                                                                                                                                                                                                  Function 00007FF6F8FDB1C0 Relevance: 10.6, APIs: 7, Instructions: 62COMMONLIBRARYCODE
                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                  • Source File: 00000000.00000002.1809060909.00007FF6F8FC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6F8FC0000, based on PE: true
                                                                                                                                                                                                                  • Associated: 00000000.00000002.1809003889.00007FF6F8FC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                  • Associated: 00000000.00000002.1809090760.00007FF6F8FEB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                  • Associated: 00000000.00000002.1809148599.00007FF6F8FFE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                  • Associated: 00000000.00000002.1809148599.00007FF6F9002000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                  • Associated: 00000000.00000002.1809223271.00007FF6F9004000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                  • Snapshot File: hcaresult_0_2_7ff6f8fc0000_dipwo1iToJ.jbxd
                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                  • API ID: Value$ErrorLast
                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                  • API String ID: 2506987500-0
                                                                                                                                                                                                                  • Opcode ID: 95e941e89c228e9c604249a81e4247bf93b8921c3316e711f137cef7aac77c3c
                                                                                                                                                                                                                  • Instruction ID: 43464952b94671e58fd755fa5f3fc80385bd0db7ae31e8070c03678b378a3b69
                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 95e941e89c228e9c604249a81e4247bf93b8921c3316e711f137cef7aac77c3c
                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 77215C32E0E2068AF7656B72565513D51439F447F0F8447B4EA3EC7AD6FE2CA401A308
                                                                                                                                                                                                                  Function 00007FF6F8FE7DDC Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 48fileCOMMON
                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                  Strings
                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                  • Source File: 00000000.00000002.1809060909.00007FF6F8FC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6F8FC0000, based on PE: true
                                                                                                                                                                                                                  • Associated: 00000000.00000002.1809003889.00007FF6F8FC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                  • Associated: 00000000.00000002.1809090760.00007FF6F8FEB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                  • Associated: 00000000.00000002.1809148599.00007FF6F8FFE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                  • Associated: 00000000.00000002.1809148599.00007FF6F9002000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                  • Associated: 00000000.00000002.1809223271.00007FF6F9004000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                  • Snapshot File: hcaresult_0_2_7ff6f8fc0000_dipwo1iToJ.jbxd
                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                  • API ID: ConsoleWrite$CloseCreateErrorFileHandleLast
                                                                                                                                                                                                                  • String ID: CONOUT$
                                                                                                                                                                                                                  • API String ID: 3230265001-3130406586
                                                                                                                                                                                                                  • Opcode ID: 5493e4d9a44aaf731d1a805f3958d18bb0ed212be4b6a830fa2bcaabe5bc997c
                                                                                                                                                                                                                  • Instruction ID: 0688a89cb4248425465bac9d5e02a1bd9669e514f77c3768c64e7365bd7bae3e
                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 5493e4d9a44aaf731d1a805f3958d18bb0ed212be4b6a830fa2bcaabe5bc997c
                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 2B119331B19A418AE7518B62F85432962A0FB98BF4F440374EA6DD77E4EF3CD804C748
                                                                                                                                                                                                                  Function 00007FF6F8FC8560 Relevance: 9.1, APIs: 6, Instructions: 127COMMON
                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                  • GetCurrentProcess.KERNEL32(?,?,?,00000000,00007FF6F8FC9216), ref: 00007FF6F8FC8592
                                                                                                                                                                                                                  • K32EnumProcessModules.KERNEL32(?,?,00000000,00007FF6F8FC9216), ref: 00007FF6F8FC85E9
                                                                                                                                                                                                                    • Part of subcall function 00007FF6F8FC9400: MultiByteToWideChar.KERNEL32(?,?,?,00007FF6F8FC45E4,00000000,00007FF6F8FC1985), ref: 00007FF6F8FC9439
                                                                                                                                                                                                                  • K32GetModuleFileNameExW.KERNEL32(?,?,00000000,00007FF6F8FC9216), ref: 00007FF6F8FC8678
                                                                                                                                                                                                                  • K32GetModuleFileNameExW.KERNEL32(?,?,00000000,00007FF6F8FC9216), ref: 00007FF6F8FC86E4
                                                                                                                                                                                                                  • FreeLibrary.KERNEL32(?,?,00000000,00007FF6F8FC9216), ref: 00007FF6F8FC86F5
                                                                                                                                                                                                                  • FreeLibrary.KERNEL32(?,?,00000000,00007FF6F8FC9216), ref: 00007FF6F8FC870A
                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                  • Source File: 00000000.00000002.1809060909.00007FF6F8FC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6F8FC0000, based on PE: true
                                                                                                                                                                                                                  • Associated: 00000000.00000002.1809003889.00007FF6F8FC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                  • Associated: 00000000.00000002.1809090760.00007FF6F8FEB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                  • Associated: 00000000.00000002.1809148599.00007FF6F8FFE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                  • Associated: 00000000.00000002.1809148599.00007FF6F9002000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                  • Associated: 00000000.00000002.1809223271.00007FF6F9004000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                  • Snapshot File: hcaresult_0_2_7ff6f8fc0000_dipwo1iToJ.jbxd
                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                  • API ID: FileFreeLibraryModuleNameProcess$ByteCharCurrentEnumModulesMultiWide
                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                  • API String ID: 3462794448-0
                                                                                                                                                                                                                  • Opcode ID: b52d66e3f6483ee012b3a88bb9869cc1030523c4b2827b1d8d4a1b21ae680e9c
                                                                                                                                                                                                                  • Instruction ID: 79080dbf39dbc966f2599f191691f0844786fb9f2205d050f1160a99c21f3aab
                                                                                                                                                                                                                  • Opcode Fuzzy Hash: b52d66e3f6483ee012b3a88bb9869cc1030523c4b2827b1d8d4a1b21ae680e9c
                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 8741A332B2A68249E7209B21A4406AA6394FF85BE4F440075DF6DD77CAFE3CD701D708
                                                                                                                                                                                                                  Function 00007FF6F8FDB338 Relevance: 9.1, APIs: 6, Instructions: 57COMMONLIBRARYCODE
                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                  • GetLastError.KERNEL32(?,?,?,00007FF6F8FD4F81,?,?,?,?,00007FF6F8FDA4FA,?,?,?,?,00007FF6F8FD71FF), ref: 00007FF6F8FDB347
                                                                                                                                                                                                                  • FlsSetValue.KERNEL32(?,?,?,00007FF6F8FD4F81,?,?,?,?,00007FF6F8FDA4FA,?,?,?,?,00007FF6F8FD71FF), ref: 00007FF6F8FDB37D
                                                                                                                                                                                                                  • FlsSetValue.KERNEL32(?,?,?,00007FF6F8FD4F81,?,?,?,?,00007FF6F8FDA4FA,?,?,?,?,00007FF6F8FD71FF), ref: 00007FF6F8FDB3AA
                                                                                                                                                                                                                  • FlsSetValue.KERNEL32(?,?,?,00007FF6F8FD4F81,?,?,?,?,00007FF6F8FDA4FA,?,?,?,?,00007FF6F8FD71FF), ref: 00007FF6F8FDB3BB
                                                                                                                                                                                                                  • FlsSetValue.KERNEL32(?,?,?,00007FF6F8FD4F81,?,?,?,?,00007FF6F8FDA4FA,?,?,?,?,00007FF6F8FD71FF), ref: 00007FF6F8FDB3CC
                                                                                                                                                                                                                  • SetLastError.KERNEL32(?,?,?,00007FF6F8FD4F81,?,?,?,?,00007FF6F8FDA4FA,?,?,?,?,00007FF6F8FD71FF), ref: 00007FF6F8FDB3E7
                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                  • Source File: 00000000.00000002.1809060909.00007FF6F8FC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6F8FC0000, based on PE: true
                                                                                                                                                                                                                  • Associated: 00000000.00000002.1809003889.00007FF6F8FC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                  • Associated: 00000000.00000002.1809090760.00007FF6F8FEB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                  • Associated: 00000000.00000002.1809148599.00007FF6F8FFE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                  • Associated: 00000000.00000002.1809148599.00007FF6F9002000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                  • Associated: 00000000.00000002.1809223271.00007FF6F9004000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                  • Snapshot File: hcaresult_0_2_7ff6f8fc0000_dipwo1iToJ.jbxd
                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                  • API ID: Value$ErrorLast
                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                  • API String ID: 2506987500-0
                                                                                                                                                                                                                  • Opcode ID: 6d8f3e74ebbb6b3e9df47af100808aa7e96d944c008937dd2b032c21f4d9a902
                                                                                                                                                                                                                  • Instruction ID: bcab04d4469123d0f5c987ffa876864c6b2d648ac1e5d2f3ee3890c17fd8348d
                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 6d8f3e74ebbb6b3e9df47af100808aa7e96d944c008937dd2b032c21f4d9a902
                                                                                                                                                                                                                  • Instruction Fuzzy Hash: AD114F32A0E6428AF7545B31565513D61439F447F0F9447B4EA3EC77D6FE2CA401B309
                                                                                                                                                                                                                  Function 00007FF6F8FC2910 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 86COMMON
                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                  • GetCurrentProcessId.KERNEL32(?,?,?,?,00000000,00000000,?,00000000,00007FF6F8FC1B6A), ref: 00007FF6F8FC295E
                                                                                                                                                                                                                  Strings
                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                  • Source File: 00000000.00000002.1809060909.00007FF6F8FC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6F8FC0000, based on PE: true
                                                                                                                                                                                                                  • Associated: 00000000.00000002.1809003889.00007FF6F8FC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                  • Associated: 00000000.00000002.1809090760.00007FF6F8FEB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                  • Associated: 00000000.00000002.1809148599.00007FF6F8FFE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                  • Associated: 00000000.00000002.1809148599.00007FF6F9002000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                  • Associated: 00000000.00000002.1809223271.00007FF6F9004000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                  • Snapshot File: hcaresult_0_2_7ff6f8fc0000_dipwo1iToJ.jbxd
                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                  • API ID: CurrentProcess
                                                                                                                                                                                                                  • String ID: %s: %s$Error$Error [ANSI Fallback]$[PYI-%d:ERROR]
                                                                                                                                                                                                                  • API String ID: 2050909247-2962405886
                                                                                                                                                                                                                  • Opcode ID: 9e805cce3db004805378da731f60641a61a9f8723a57293993104ba7ce00817f
                                                                                                                                                                                                                  • Instruction ID: 41a62770f2343ee2fab64159cf4fff3e3d426efdebdb940fbb4aae5ff482113f
                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 9e805cce3db004805378da731f60641a61a9f8723a57293993104ba7ce00817f
                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 1031E433B1A6815AE7209771A8402E66295BF897E4F400132FE9DD37DAFF3CD64A9304
                                                                                                                                                                                                                  Function 00007FF6F8FC2390 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 81windowCOMMON
                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                  Strings
                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                  • Source File: 00000000.00000002.1809060909.00007FF6F8FC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6F8FC0000, based on PE: true
                                                                                                                                                                                                                  • Associated: 00000000.00000002.1809003889.00007FF6F8FC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                  • Associated: 00000000.00000002.1809090760.00007FF6F8FEB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                  • Associated: 00000000.00000002.1809148599.00007FF6F8FFE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                  • Associated: 00000000.00000002.1809148599.00007FF6F9002000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                  • Associated: 00000000.00000002.1809223271.00007FF6F9004000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                  • Snapshot File: hcaresult_0_2_7ff6f8fc0000_dipwo1iToJ.jbxd
                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                  • API ID: DeleteDestroyDialogHandleIconIndirectModuleObjectParam
                                                                                                                                                                                                                  • String ID: Unhandled exception in script
                                                                                                                                                                                                                  • API String ID: 3081866767-2699770090
                                                                                                                                                                                                                  • Opcode ID: 39c06ba8bf9b0b274a05e8f7e17acb9149a8f0f807fdaf6a00a55f32f6777a83
                                                                                                                                                                                                                  • Instruction ID: 6a54537275556088d160171c82d4cac8b85a8c2b5722006ec349e286085a14d3
                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 39c06ba8bf9b0b274a05e8f7e17acb9149a8f0f807fdaf6a00a55f32f6777a83
                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 48315F3260A6828DEB20DF31E8552F96361FF897D4F440175EA5D8BB9AEF3CD2059704
                                                                                                                                                                                                                  Function 00007FF6F8FC2B50 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 65windowCOMMON
                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                  • GetCurrentProcessId.KERNEL32(?,00000000,00000000,FFFFFFFF,00000000,00007FF6F8FC918F,?,00007FF6F8FC3C55), ref: 00007FF6F8FC2BA0
                                                                                                                                                                                                                  • MessageBoxW.USER32 ref: 00007FF6F8FC2C2A
                                                                                                                                                                                                                  Strings
                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                  • Source File: 00000000.00000002.1809060909.00007FF6F8FC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6F8FC0000, based on PE: true
                                                                                                                                                                                                                  • Associated: 00000000.00000002.1809003889.00007FF6F8FC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                  • Associated: 00000000.00000002.1809090760.00007FF6F8FEB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                  • Associated: 00000000.00000002.1809148599.00007FF6F8FFE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                  • Associated: 00000000.00000002.1809148599.00007FF6F9002000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                  • Associated: 00000000.00000002.1809223271.00007FF6F9004000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                  • Snapshot File: hcaresult_0_2_7ff6f8fc0000_dipwo1iToJ.jbxd
                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                  • API ID: CurrentMessageProcess
                                                                                                                                                                                                                  • String ID: WARNING$Warning$[PYI-%d:%ls]
                                                                                                                                                                                                                  • API String ID: 1672936522-3797743490
                                                                                                                                                                                                                  • Opcode ID: 9e6d9589c2ecbe46adae8e106eadd318faf54c8367477cb0129d25f7ec3a12f1
                                                                                                                                                                                                                  • Instruction ID: 2fdf9d952f11bbeb2c87154ba9855e54e9b7cd9bfb30fbcc7a6fece1c81f1988
                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 9e6d9589c2ecbe46adae8e106eadd318faf54c8367477cb0129d25f7ec3a12f1
                                                                                                                                                                                                                  • Instruction Fuzzy Hash: F021BF32709B4186E7219B24B8407AA63A4EB887D4F400132EA8D97796EE3CD215D704
                                                                                                                                                                                                                  Function 00007FF6F8FC2710 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 64COMMON
                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                  • GetCurrentProcessId.KERNEL32(?,00000000,00000000,?,00000000,00007FF6F8FC1B99), ref: 00007FF6F8FC2760
                                                                                                                                                                                                                  Strings
                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                  • Source File: 00000000.00000002.1809060909.00007FF6F8FC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6F8FC0000, based on PE: true
                                                                                                                                                                                                                  • Associated: 00000000.00000002.1809003889.00007FF6F8FC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                  • Associated: 00000000.00000002.1809090760.00007FF6F8FEB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                  • Associated: 00000000.00000002.1809148599.00007FF6F8FFE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                  • Associated: 00000000.00000002.1809148599.00007FF6F9002000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                  • Associated: 00000000.00000002.1809223271.00007FF6F9004000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                  • Snapshot File: hcaresult_0_2_7ff6f8fc0000_dipwo1iToJ.jbxd
                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                  • API ID: CurrentProcess
                                                                                                                                                                                                                  • String ID: ERROR$Error$Error [ANSI Fallback]$[PYI-%d:%s]
                                                                                                                                                                                                                  • API String ID: 2050909247-1591803126
                                                                                                                                                                                                                  • Opcode ID: 16defea7d45dc340f891dcb1518e5bd63c50e449678e4b46de0281de23a8290b
                                                                                                                                                                                                                  • Instruction ID: 0c65790412223f43e5fbaf767f8c593027f83f7588817b2579ac89079b7b8773
                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 16defea7d45dc340f891dcb1518e5bd63c50e449678e4b46de0281de23a8290b
                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 2B21A332A1A78186E720DB61B8807E66394FB883D4F400171FE9CD3799EF3CD2559704
                                                                                                                                                                                                                  Function 00007FF6F8FD9AF8 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 27libraryloaderCOMMON
                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                  Strings
                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                  • Source File: 00000000.00000002.1809060909.00007FF6F8FC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6F8FC0000, based on PE: true
                                                                                                                                                                                                                  • Associated: 00000000.00000002.1809003889.00007FF6F8FC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                  • Associated: 00000000.00000002.1809090760.00007FF6F8FEB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                  • Associated: 00000000.00000002.1809148599.00007FF6F8FFE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                  • Associated: 00000000.00000002.1809148599.00007FF6F9002000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                  • Associated: 00000000.00000002.1809223271.00007FF6F9004000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                  • Snapshot File: hcaresult_0_2_7ff6f8fc0000_dipwo1iToJ.jbxd
                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                  • API ID: AddressFreeHandleLibraryModuleProc
                                                                                                                                                                                                                  • String ID: CorExitProcess$mscoree.dll
                                                                                                                                                                                                                  • API String ID: 4061214504-1276376045
                                                                                                                                                                                                                  • Opcode ID: 644f40749f2397ccfee8900b191f86882f652c7814ccefc594fcc00cef1e1075
                                                                                                                                                                                                                  • Instruction ID: bc0b1c3cec218d7142f798507101078a4c050b52984628e5117a98ced27e01a6
                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 644f40749f2397ccfee8900b191f86882f652c7814ccefc594fcc00cef1e1075
                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 46F04F31B0A60685EB118B74E4593796360AF457F1F9402B5CA7EC76E4EF2CE148E308
                                                                                                                                                                                                                  Function 00007FF6F8FE93D8 Relevance: 7.6, APIs: 5, Instructions: 56COMMONLIBRARYCODE
                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                  • Source File: 00000000.00000002.1809060909.00007FF6F8FC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6F8FC0000, based on PE: true
                                                                                                                                                                                                                  • Associated: 00000000.00000002.1809003889.00007FF6F8FC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                  • Associated: 00000000.00000002.1809090760.00007FF6F8FEB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                  • Associated: 00000000.00000002.1809148599.00007FF6F8FFE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                  • Associated: 00000000.00000002.1809148599.00007FF6F9002000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                  • Associated: 00000000.00000002.1809223271.00007FF6F9004000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                  • Snapshot File: hcaresult_0_2_7ff6f8fc0000_dipwo1iToJ.jbxd
                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                  • API ID: _set_statfp
                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                  • API String ID: 1156100317-0
                                                                                                                                                                                                                  • Opcode ID: bce21d2362216a5e504affcf34f2858e363de54600403cac3d1eeb36cb2ab404
                                                                                                                                                                                                                  • Instruction ID: 0d1ffdbf451907a1e6c848d494fe6c87f829ca6a2d069e437cb7a2401328aa42
                                                                                                                                                                                                                  • Opcode Fuzzy Hash: bce21d2362216a5e504affcf34f2858e363de54600403cac3d1eeb36cb2ab404
                                                                                                                                                                                                                  • Instruction Fuzzy Hash: DB11C1B2F2EA1309F7541134D45E37920446F583F0F0486B4EA7E87ADBEE2CA951632C
                                                                                                                                                                                                                  Function 00007FF6F8FDB400 Relevance: 7.6, APIs: 5, Instructions: 54COMMONLIBRARYCODE
                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                  • FlsGetValue.KERNEL32(?,?,?,00007FF6F8FDA613,?,?,00000000,00007FF6F8FDA8AE,?,?,?,?,?,00007FF6F8FDA83A), ref: 00007FF6F8FDB41F
                                                                                                                                                                                                                  • FlsSetValue.KERNEL32(?,?,?,00007FF6F8FDA613,?,?,00000000,00007FF6F8FDA8AE,?,?,?,?,?,00007FF6F8FDA83A), ref: 00007FF6F8FDB43E
                                                                                                                                                                                                                  • FlsSetValue.KERNEL32(?,?,?,00007FF6F8FDA613,?,?,00000000,00007FF6F8FDA8AE,?,?,?,?,?,00007FF6F8FDA83A), ref: 00007FF6F8FDB466
                                                                                                                                                                                                                  • FlsSetValue.KERNEL32(?,?,?,00007FF6F8FDA613,?,?,00000000,00007FF6F8FDA8AE,?,?,?,?,?,00007FF6F8FDA83A), ref: 00007FF6F8FDB477
                                                                                                                                                                                                                  • FlsSetValue.KERNEL32(?,?,?,00007FF6F8FDA613,?,?,00000000,00007FF6F8FDA8AE,?,?,?,?,?,00007FF6F8FDA83A), ref: 00007FF6F8FDB488
                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                  • Source File: 00000000.00000002.1809060909.00007FF6F8FC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6F8FC0000, based on PE: true
                                                                                                                                                                                                                  • Associated: 00000000.00000002.1809003889.00007FF6F8FC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                  • Associated: 00000000.00000002.1809090760.00007FF6F8FEB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                  • Associated: 00000000.00000002.1809148599.00007FF6F8FFE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                  • Associated: 00000000.00000002.1809148599.00007FF6F9002000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                  • Associated: 00000000.00000002.1809223271.00007FF6F9004000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                  • Snapshot File: hcaresult_0_2_7ff6f8fc0000_dipwo1iToJ.jbxd
                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                  • API ID: Value
                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                  • API String ID: 3702945584-0
                                                                                                                                                                                                                  • Opcode ID: 3cf0457813ef902b4d16e29671bd05b92734aec0d3ae5f0b4a86182189680110
                                                                                                                                                                                                                  • Instruction ID: 2287cbe5c270606af21996a8f31e829b33f81638ae6a97d845a9e7f345277490
                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 3cf0457813ef902b4d16e29671bd05b92734aec0d3ae5f0b4a86182189680110
                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 86117F32A0F60249FB58AB32595117961439F857F0F9883B4EA3EC76D7FE2CE411A309
                                                                                                                                                                                                                  Function 00007FF6F8FDB294 Relevance: 7.6, APIs: 5, Instructions: 50COMMON
                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                  • Source File: 00000000.00000002.1809060909.00007FF6F8FC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6F8FC0000, based on PE: true
                                                                                                                                                                                                                  • Associated: 00000000.00000002.1809003889.00007FF6F8FC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                  • Associated: 00000000.00000002.1809090760.00007FF6F8FEB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                  • Associated: 00000000.00000002.1809148599.00007FF6F8FFE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                  • Associated: 00000000.00000002.1809148599.00007FF6F9002000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                  • Associated: 00000000.00000002.1809223271.00007FF6F9004000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                  • Snapshot File: hcaresult_0_2_7ff6f8fc0000_dipwo1iToJ.jbxd
                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                  • API ID: Value
                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                  • API String ID: 3702945584-0
                                                                                                                                                                                                                  • Opcode ID: 58ce09dd5263def6ec13d4cefdd98fc26a3f0444d111e578bd11d526dfe727f7
                                                                                                                                                                                                                  • Instruction ID: e0674b0438cd032f8d8ee9de05014654bc42030cdeeff1e350873a9a72123d04
                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 58ce09dd5263def6ec13d4cefdd98fc26a3f0444d111e578bd11d526dfe727f7
                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 9E110A33A0B2068DFB686632485667911434F553F0F8447B4DA3ECB6C2FD2CB401B319
                                                                                                                                                                                                                  Function 00007FF6F8FD6010 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 242COMMON
                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                  Strings
                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                  • Source File: 00000000.00000002.1809060909.00007FF6F8FC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6F8FC0000, based on PE: true
                                                                                                                                                                                                                  • Associated: 00000000.00000002.1809003889.00007FF6F8FC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                  • Associated: 00000000.00000002.1809090760.00007FF6F8FEB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                  • Associated: 00000000.00000002.1809148599.00007FF6F8FFE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                  • Associated: 00000000.00000002.1809148599.00007FF6F9002000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                  • Associated: 00000000.00000002.1809223271.00007FF6F9004000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                  • Snapshot File: hcaresult_0_2_7ff6f8fc0000_dipwo1iToJ.jbxd
                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                  • API ID: _invalid_parameter_noinfo
                                                                                                                                                                                                                  • String ID: verbose
                                                                                                                                                                                                                  • API String ID: 3215553584-579935070
                                                                                                                                                                                                                  • Opcode ID: 8c3a45f75ca5c0a3459ca2e96ae2fbbf181a3d63a640e770f0a7cf37c7606cec
                                                                                                                                                                                                                  • Instruction ID: d2544c48e40b623fce19f28fdbf6c39a22d397cbde8998cd768fafa83e78c838
                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 8c3a45f75ca5c0a3459ca2e96ae2fbbf181a3d63a640e770f0a7cf37c7606cec
                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 2D91EF33E0AA4689FB218E74D45037D3392AB04BE4F444176DBA9833C5EF3CE409A398
                                                                                                                                                                                                                  Function 00007FF6F8FDFC38 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 219COMMON
                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                  Strings
                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                  • Source File: 00000000.00000002.1809060909.00007FF6F8FC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6F8FC0000, based on PE: true
                                                                                                                                                                                                                  • Associated: 00000000.00000002.1809003889.00007FF6F8FC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                  • Associated: 00000000.00000002.1809090760.00007FF6F8FEB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                  • Associated: 00000000.00000002.1809148599.00007FF6F8FFE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                  • Associated: 00000000.00000002.1809148599.00007FF6F9002000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                  • Associated: 00000000.00000002.1809223271.00007FF6F9004000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                  • Snapshot File: hcaresult_0_2_7ff6f8fc0000_dipwo1iToJ.jbxd
                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                  • API ID: _invalid_parameter_noinfo
                                                                                                                                                                                                                  • String ID: UTF-16LEUNICODE$UTF-8$ccs
                                                                                                                                                                                                                  • API String ID: 3215553584-1196891531
                                                                                                                                                                                                                  • Opcode ID: 4ea7f6e1ba59c177a711b7ec70ee344f27d005a52efb2894dd87f7f788f8515e
                                                                                                                                                                                                                  • Instruction ID: f2e1532bcf665b50175e45d034828ffead6cbe30c0b4d14eaf2d8fadb3b24dbe
                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 4ea7f6e1ba59c177a711b7ec70ee344f27d005a52efb2894dd87f7f788f8515e
                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 0481A033D0A2428EF7644E358110A7836A2EF117F8F5581B5DB29C72D9FF2DE901B249
                                                                                                                                                                                                                  Function 00007FF6F8FCD6B8 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 154COMMON
                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                  Strings
                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                  • Source File: 00000000.00000002.1809060909.00007FF6F8FC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6F8FC0000, based on PE: true
                                                                                                                                                                                                                  • Associated: 00000000.00000002.1809003889.00007FF6F8FC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                  • Associated: 00000000.00000002.1809090760.00007FF6F8FEB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                  • Associated: 00000000.00000002.1809148599.00007FF6F8FFE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                  • Associated: 00000000.00000002.1809148599.00007FF6F9002000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                  • Associated: 00000000.00000002.1809223271.00007FF6F9004000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                  • Snapshot File: hcaresult_0_2_7ff6f8fc0000_dipwo1iToJ.jbxd
                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                  • API ID: CurrentImageNonwritableUnwind__except_validate_context_record
                                                                                                                                                                                                                  • String ID: csm
                                                                                                                                                                                                                  • API String ID: 2395640692-1018135373
                                                                                                                                                                                                                  • Opcode ID: c7f5fdff7c0b40b6635b3f9850cf21a5be83d788788a684f503aa9329af71794
                                                                                                                                                                                                                  • Instruction ID: e38c692e7f5fec0f0df669d2eb9d86f6bfa4a80c087f8b8fa234b8276a4070b8
                                                                                                                                                                                                                  • Opcode Fuzzy Hash: c7f5fdff7c0b40b6635b3f9850cf21a5be83d788788a684f503aa9329af71794
                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 9251B132B1A6028EDB14AB26D404A3C3791EB45BE8F204171DA6E837C6FF7DEA41D704
                                                                                                                                                                                                                  Function 00007FF6F8FCF2F8 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 146COMMON
                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                  Strings
                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                  • Source File: 00000000.00000002.1809060909.00007FF6F8FC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6F8FC0000, based on PE: true
                                                                                                                                                                                                                  • Associated: 00000000.00000002.1809003889.00007FF6F8FC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                  • Associated: 00000000.00000002.1809090760.00007FF6F8FEB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                  • Associated: 00000000.00000002.1809148599.00007FF6F8FFE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                  • Associated: 00000000.00000002.1809148599.00007FF6F9002000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                  • Associated: 00000000.00000002.1809223271.00007FF6F9004000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                  • Snapshot File: hcaresult_0_2_7ff6f8fc0000_dipwo1iToJ.jbxd
                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                  • API ID: Frame$EmptyHandler3::StateUnwind__except_validate_context_record
                                                                                                                                                                                                                  • String ID: csm$csm
                                                                                                                                                                                                                  • API String ID: 3896166516-3733052814
                                                                                                                                                                                                                  • Opcode ID: 1b872e8f6993e9c5779cc40e3c84c693849f7921638dfce8d08fafba9ab8d571
                                                                                                                                                                                                                  • Instruction ID: 96df211bd7e9b2c1cb49423063961cdb6f48e53a7da95b359e11a261c03079dd
                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 1b872e8f6993e9c5779cc40e3c84c693849f7921638dfce8d08fafba9ab8d571
                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 4651C0729092828EEB648E31D044368B6A0EB56BF4F144175DA6DC37D6EF7CE760D708
                                                                                                                                                                                                                  Function 00007FF6F8FCEF48 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 146COMMON
                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                  Strings
                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                  • Source File: 00000000.00000002.1809060909.00007FF6F8FC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6F8FC0000, based on PE: true
                                                                                                                                                                                                                  • Associated: 00000000.00000002.1809003889.00007FF6F8FC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                  • Associated: 00000000.00000002.1809090760.00007FF6F8FEB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                  • Associated: 00000000.00000002.1809148599.00007FF6F8FFE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                  • Associated: 00000000.00000002.1809148599.00007FF6F9002000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                  • Associated: 00000000.00000002.1809223271.00007FF6F9004000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                  • Snapshot File: hcaresult_0_2_7ff6f8fc0000_dipwo1iToJ.jbxd
                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                  • API ID: CallEncodePointerTranslator
                                                                                                                                                                                                                  • String ID: MOC$RCC
                                                                                                                                                                                                                  • API String ID: 3544855599-2084237596
                                                                                                                                                                                                                  • Opcode ID: 1984f943fe60021c6db05f5888f7dd086acc6d0e2a461e0c712dd9be4fa02006
                                                                                                                                                                                                                  • Instruction ID: a32b8235480bca8b18fed944813f1bc66f2e875dac4f0acc57ac0daaeb25dd59
                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 1984f943fe60021c6db05f5888f7dd086acc6d0e2a461e0c712dd9be4fa02006
                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 3D61C532909BC585D7608B25E4403AAB7A0FB85BE4F044275EBAD57B96EF7CD390CB04
                                                                                                                                                                                                                  Function 00007FF6F8FC2810 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 65windowCOMMON
                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                  Strings
                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                  • Source File: 00000000.00000002.1809060909.00007FF6F8FC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6F8FC0000, based on PE: true
                                                                                                                                                                                                                  • Associated: 00000000.00000002.1809003889.00007FF6F8FC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                  • Associated: 00000000.00000002.1809090760.00007FF6F8FEB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                  • Associated: 00000000.00000002.1809148599.00007FF6F8FFE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                  • Associated: 00000000.00000002.1809148599.00007FF6F9002000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                  • Associated: 00000000.00000002.1809223271.00007FF6F9004000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                  • Snapshot File: hcaresult_0_2_7ff6f8fc0000_dipwo1iToJ.jbxd
                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                  • API ID: Message
                                                                                                                                                                                                                  • String ID: ERROR$Error$[PYI-%d:%ls]
                                                                                                                                                                                                                  • API String ID: 2030045667-255084403
                                                                                                                                                                                                                  • Opcode ID: d0f77ace03032ad826a8cfca47aff52564341a40e7b1b64160a5aa56c6ce0663
                                                                                                                                                                                                                  • Instruction ID: fd34865ccc4e96d1cbc8cc089b0745a5e5bb70b0c320feb84ac0ad54ed61f2a3
                                                                                                                                                                                                                  • Opcode Fuzzy Hash: d0f77ace03032ad826a8cfca47aff52564341a40e7b1b64160a5aa56c6ce0663
                                                                                                                                                                                                                  • Instruction Fuzzy Hash: AE21BF72B0AB4186E7219B24B8407AA63A0EB887D4F400132EE8D93796EE3CD259D704
                                                                                                                                                                                                                  Function 00007FF6F8FDC610 Relevance: 6.3, APIs: 4, Instructions: 299fileCOMMON
                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                  • Source File: 00000000.00000002.1809060909.00007FF6F8FC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6F8FC0000, based on PE: true
                                                                                                                                                                                                                  • Associated: 00000000.00000002.1809003889.00007FF6F8FC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                  • Associated: 00000000.00000002.1809090760.00007FF6F8FEB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                  • Associated: 00000000.00000002.1809148599.00007FF6F8FFE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                  • Associated: 00000000.00000002.1809148599.00007FF6F9002000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                  • Associated: 00000000.00000002.1809223271.00007FF6F9004000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                  • Snapshot File: hcaresult_0_2_7ff6f8fc0000_dipwo1iToJ.jbxd
                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                  • API ID: FileWrite$ConsoleErrorLastOutput
                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                  • API String ID: 2718003287-0
                                                                                                                                                                                                                  • Opcode ID: 1ea6e931977968e7606fd026366deb17473f9f47aeaf25dd19fcfb7bb3399e1d
                                                                                                                                                                                                                  • Instruction ID: 72f8f0c9307196707e4c008e444fb4bd89f0cd03714720d84c323caa609966fc
                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 1ea6e931977968e7606fd026366deb17473f9f47aeaf25dd19fcfb7bb3399e1d
                                                                                                                                                                                                                  • Instruction Fuzzy Hash: B8D1EF72B1AA818EE711CF75D4402AC37A2FB457E8B448266DF6D97BC9EE38D006D344
                                                                                                                                                                                                                  Function 00007FF6F8FC20C0 Relevance: 6.1, APIs: 4, Instructions: 52COMMON
                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                  • Source File: 00000000.00000002.1809060909.00007FF6F8FC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6F8FC0000, based on PE: true
                                                                                                                                                                                                                  • Associated: 00000000.00000002.1809003889.00007FF6F8FC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                  • Associated: 00000000.00000002.1809090760.00007FF6F8FEB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                  • Associated: 00000000.00000002.1809148599.00007FF6F8FFE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                  • Associated: 00000000.00000002.1809148599.00007FF6F9002000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                  • Associated: 00000000.00000002.1809223271.00007FF6F9004000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                  • Snapshot File: hcaresult_0_2_7ff6f8fc0000_dipwo1iToJ.jbxd
                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                  • API ID: LongWindow$DialogInvalidateRect
                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                  • API String ID: 1956198572-0
                                                                                                                                                                                                                  • Opcode ID: 3f66ec3ad31a24d6b03c6ecd933265a99c2c3f38e7b83c206d3886b5f9d1bb92
                                                                                                                                                                                                                  • Instruction ID: d5510509f15800fef93886e1727109eb0e1698110381bf2ffb7c754eac7e4016
                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 3f66ec3ad31a24d6b03c6ecd933265a99c2c3f38e7b83c206d3886b5f9d1bb92
                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 34112931E0D14286F7458B7AE5442B91291EF857E0F844071DB69C3BCAED3DD7D0A208
                                                                                                                                                                                                                  Function 00007FF6F8FE5B8C Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 121COMMON
                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                  Strings
                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                  • Source File: 00000000.00000002.1809060909.00007FF6F8FC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6F8FC0000, based on PE: true
                                                                                                                                                                                                                  • Associated: 00000000.00000002.1809003889.00007FF6F8FC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                  • Associated: 00000000.00000002.1809090760.00007FF6F8FEB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                  • Associated: 00000000.00000002.1809148599.00007FF6F8FFE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                  • Associated: 00000000.00000002.1809148599.00007FF6F9002000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                  • Associated: 00000000.00000002.1809223271.00007FF6F9004000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                  • Snapshot File: hcaresult_0_2_7ff6f8fc0000_dipwo1iToJ.jbxd
                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                  • API ID: _get_daylight$_invalid_parameter_noinfo
                                                                                                                                                                                                                  • String ID: ?
                                                                                                                                                                                                                  • API String ID: 1286766494-1684325040
                                                                                                                                                                                                                  • Opcode ID: 49037f27f8a3fd0af602071961786b5c11050eb40cc6520dd4d88adff463e317
                                                                                                                                                                                                                  • Instruction ID: 15827894b1ea18be5239ef27084320fc7d05ab5afffc435a0e9c7cd78b87e503
                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 49037f27f8a3fd0af602071961786b5c11050eb40cc6520dd4d88adff463e317
                                                                                                                                                                                                                  • Instruction Fuzzy Hash: D9412732A0A6824AFB209B35986137A6691EB84BF4F144275EF6C87AD5FF3CD441D704
                                                                                                                                                                                                                  Function 00007FF6F8FD9084 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 111COMMON
                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                  • _invalid_parameter_noinfo.LIBCMT ref: 00007FF6F8FD90B6
                                                                                                                                                                                                                    • Part of subcall function 00007FF6F8FDA9B8: RtlFreeHeap.NTDLL(?,?,?,00007FF6F8FE2D92,?,?,?,00007FF6F8FE2DCF,?,?,00000000,00007FF6F8FE3295,?,?,?,00007FF6F8FE31C7), ref: 00007FF6F8FDA9CE
                                                                                                                                                                                                                    • Part of subcall function 00007FF6F8FDA9B8: GetLastError.KERNEL32(?,?,?,00007FF6F8FE2D92,?,?,?,00007FF6F8FE2DCF,?,?,00000000,00007FF6F8FE3295,?,?,?,00007FF6F8FE31C7), ref: 00007FF6F8FDA9D8
                                                                                                                                                                                                                  • GetModuleFileNameW.KERNEL32(?,?,?,?,?,00007FF6F8FCCC15), ref: 00007FF6F8FD90D4
                                                                                                                                                                                                                  Strings
                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                  • Source File: 00000000.00000002.1809060909.00007FF6F8FC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6F8FC0000, based on PE: true
                                                                                                                                                                                                                  • Associated: 00000000.00000002.1809003889.00007FF6F8FC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                  • Associated: 00000000.00000002.1809090760.00007FF6F8FEB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                  • Associated: 00000000.00000002.1809148599.00007FF6F8FFE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                  • Associated: 00000000.00000002.1809148599.00007FF6F9002000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                  • Associated: 00000000.00000002.1809223271.00007FF6F9004000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                  • Snapshot File: hcaresult_0_2_7ff6f8fc0000_dipwo1iToJ.jbxd
                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                  • API ID: ErrorFileFreeHeapLastModuleName_invalid_parameter_noinfo
                                                                                                                                                                                                                  • String ID: C:\Users\user\Desktop\dipwo1iToJ.exe
                                                                                                                                                                                                                  • API String ID: 3580290477-3430833846
                                                                                                                                                                                                                  • Opcode ID: 6949f310d66ea20a01752be9fefe254e5f7f697695929ffcc1b4329691481a3a
                                                                                                                                                                                                                  • Instruction ID: 72fa5256b6f2b5a8f9787c85d27d651160e60dd8f2ed78ab12e5d1353a9fa9a5
                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 6949f310d66ea20a01752be9fefe254e5f7f697695929ffcc1b4329691481a3a
                                                                                                                                                                                                                  • Instruction Fuzzy Hash: FE41C033B0AB128AEB14DF75A8850BC27E6EF447E0B555075EA5E83BD5EE3CE4819304
                                                                                                                                                                                                                  Function 00007FF6F8FDCCA8 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 100fileCOMMON
                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                  Strings
                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                  • Source File: 00000000.00000002.1809060909.00007FF6F8FC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6F8FC0000, based on PE: true
                                                                                                                                                                                                                  • Associated: 00000000.00000002.1809003889.00007FF6F8FC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                  • Associated: 00000000.00000002.1809090760.00007FF6F8FEB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                  • Associated: 00000000.00000002.1809148599.00007FF6F8FFE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                  • Associated: 00000000.00000002.1809148599.00007FF6F9002000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                  • Associated: 00000000.00000002.1809223271.00007FF6F9004000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                  • Snapshot File: hcaresult_0_2_7ff6f8fc0000_dipwo1iToJ.jbxd
                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                  • API ID: ErrorFileLastWrite
                                                                                                                                                                                                                  • String ID: U
                                                                                                                                                                                                                  • API String ID: 442123175-4171548499
                                                                                                                                                                                                                  • Opcode ID: 476bd95e1daeb27f29af256220462f16043a6e728498dde3caabbd6ec9016d26
                                                                                                                                                                                                                  • Instruction ID: 48fac81d15e44e86d21f11144b192d9ad0b39d90502aab037cf700a9b9876c14
                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 476bd95e1daeb27f29af256220462f16043a6e728498dde3caabbd6ec9016d26
                                                                                                                                                                                                                  • Instruction Fuzzy Hash: F541A233B19A4189DB208F25E8443A96761FB987E4F804031EE5DC7798EF3CD502D744
                                                                                                                                                                                                                  Function 00007FF6F8FDF628 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 66COMMON
                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                  Strings
                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                  • Source File: 00000000.00000002.1809060909.00007FF6F8FC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6F8FC0000, based on PE: true
                                                                                                                                                                                                                  • Associated: 00000000.00000002.1809003889.00007FF6F8FC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                  • Associated: 00000000.00000002.1809090760.00007FF6F8FEB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                  • Associated: 00000000.00000002.1809148599.00007FF6F8FFE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                  • Associated: 00000000.00000002.1809148599.00007FF6F9002000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                  • Associated: 00000000.00000002.1809223271.00007FF6F9004000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                  • Snapshot File: hcaresult_0_2_7ff6f8fc0000_dipwo1iToJ.jbxd
                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                  • API ID: CurrentDirectory
                                                                                                                                                                                                                  • String ID: :
                                                                                                                                                                                                                  • API String ID: 1611563598-336475711
                                                                                                                                                                                                                  • Opcode ID: 3c906c99ff6b46cc0de181ba7a1caf37579b2c2fe8814107475e6c290f9e88a5
                                                                                                                                                                                                                  • Instruction ID: 19cd1f9d902066c444432efdff09eab3f2060ccd7f7c1c505b4ae22b8dddc4c4
                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 3c906c99ff6b46cc0de181ba7a1caf37579b2c2fe8814107475e6c290f9e88a5
                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 1C21F533A092818AEB208B31D04426D63B2FB84BE4F958075D7AD83AD4FF7CE945D744
                                                                                                                                                                                                                  Function 00007FF6F8FCFDB8 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 44COMMON
                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                  Strings
                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                  • Source File: 00000000.00000002.1809060909.00007FF6F8FC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6F8FC0000, based on PE: true
                                                                                                                                                                                                                  • Associated: 00000000.00000002.1809003889.00007FF6F8FC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                  • Associated: 00000000.00000002.1809090760.00007FF6F8FEB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                  • Associated: 00000000.00000002.1809148599.00007FF6F8FFE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                  • Associated: 00000000.00000002.1809148599.00007FF6F9002000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                  • Associated: 00000000.00000002.1809223271.00007FF6F9004000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                  • Snapshot File: hcaresult_0_2_7ff6f8fc0000_dipwo1iToJ.jbxd
                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                  • API ID: ExceptionFileHeaderRaise
                                                                                                                                                                                                                  • String ID: csm
                                                                                                                                                                                                                  • API String ID: 2573137834-1018135373
                                                                                                                                                                                                                  • Opcode ID: 4f0f6445cfedea8dceb7eb9436a550d57130d2c9509dbddfada5299d94659d4a
                                                                                                                                                                                                                  • Instruction ID: 105e95cd6dffc5be0e0ff72d7fe01e896b9adeada32da73cae847c7c3a5ae852
                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 4f0f6445cfedea8dceb7eb9436a550d57130d2c9509dbddfada5299d94659d4a
                                                                                                                                                                                                                  • Instruction Fuzzy Hash: FC116032609B8182EB218F25F440259B7E0FB88BA4F584270DF9D47795EF7CC651CB04
                                                                                                                                                                                                                  Function 00007FF6F8FE07AC Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 36COMMON
                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                  Strings
                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                  • Source File: 00000000.00000002.1809060909.00007FF6F8FC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6F8FC0000, based on PE: true
                                                                                                                                                                                                                  • Associated: 00000000.00000002.1809003889.00007FF6F8FC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                  • Associated: 00000000.00000002.1809090760.00007FF6F8FEB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                  • Associated: 00000000.00000002.1809148599.00007FF6F8FFE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                  • Associated: 00000000.00000002.1809148599.00007FF6F9002000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                  • Associated: 00000000.00000002.1809223271.00007FF6F9004000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                  • Snapshot File: hcaresult_0_2_7ff6f8fc0000_dipwo1iToJ.jbxd
                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                  • API ID: DriveType_invalid_parameter_noinfo
                                                                                                                                                                                                                  • String ID: :
                                                                                                                                                                                                                  • API String ID: 2595371189-336475711
                                                                                                                                                                                                                  • Opcode ID: 12447209ac998d916ea5af24bee96286b8310982615a7f3bb8f9e7bff02e83a7
                                                                                                                                                                                                                  • Instruction ID: 192ce1f34f800994b92a4ed85f54dbaa3021da9638e98fe32a85f3f166ed694e
                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 12447209ac998d916ea5af24bee96286b8310982615a7f3bb8f9e7bff02e83a7
                                                                                                                                                                                                                  • Instruction Fuzzy Hash: BB01713291A20389FB209B70946627E23A0FF947A4F800479D66DC76D1FE2CE505AB1C

                                                                                                                                                                                                                  Execution Graph

                                                                                                                                                                                                                  Execution Coverage:0.1%
                                                                                                                                                                                                                  Dynamic/Decrypted Code Coverage:0%
                                                                                                                                                                                                                  Signature Coverage:0.3%
                                                                                                                                                                                                                  Total number of Nodes:613
                                                                                                                                                                                                                  Total number of Limit Nodes:0
                                                                                                                                                                                                                  execution_graph 10565 7ffdfab30ba0 10566 7ffdfab30bbe 10565->10566 10567 7ffdfab30bd5 10565->10567 10568 7ffdfab30c36 10567->10568 10569 7ffdfab30beb 10567->10569 10575 7ffdfab30c3c 10567->10575 10571 7ffdfaab8c40 6 API calls 10568->10571 10568->10575 10570 7ffdfaab8c40 6 API calls 10569->10570 10572 7ffdfab30c18 10570->10572 10573 7ffdfab30c64 10571->10573 10574 7ffdfaab8c40 6 API calls 10573->10574 10573->10575 10574->10575 9966 7ffdfab01917 9967 7ffdfab0195d 9966->9967 9969 7ffdfab0196b 9966->9969 9970 7ffdfaafabe0 9967->9970 9971 7ffdfaafac03 9970->9971 9971->9971 9972 7ffdfaafad44 memcpy 9971->9972 9973 7ffdfaafad51 memcpy 9971->9973 9986 7ffdfaafae92 9971->9986 9974 7ffdfaafad96 9972->9974 9973->9974 9976 7ffdfaafad81 memset 9973->9976 9977 7ffdfaafadbf memcpy 9974->9977 9978 7ffdfaafaddb 9974->9978 9976->9974 9977->9978 9981 7ffdfaafae17 9978->9981 9982 7ffdfaafaea6 9978->9982 9979 7ffdfaafaece 9983 7ffdfaafabe0 2 API calls 9979->9983 9979->9986 9980 7ffdfaafae73 9980->9986 9990 7ffdfab65940 9980->9990 9981->9980 9984 7ffdfaafae4e 9981->9984 9988 7ffdfaafabe0 2 API calls 9981->9988 9982->9979 9985 7ffdfaafabe0 2 API calls 9982->9985 9982->9986 9983->9986 9984->9980 9989 7ffdfaafabe0 2 API calls 9984->9989 9985->9979 9986->9969 9988->9984 9989->9980 9991 7ffdfab65bec 9990->9991 9993 7ffdfab65960 9990->9993 9991->9986 9992 7ffdfab65a9f 9995 7ffdfaafabe0 4 API calls 9992->9995 9999 7ffdfab65b0a 9992->9999 9994 7ffdfab65a4a 9993->9994 9996 7ffdfab65a80 memcpy 9993->9996 10001 7ffdfab65bc2 9993->10001 9994->9992 9997 7ffdfab65ad2 memcpy 9994->9997 9995->9999 9996->9994 9997->9992 9998 7ffdfab65ba2 9998->10001 10002 7ffdfaafabe0 4 API calls 9998->10002 9999->9998 10000 7ffdfaafabe0 4 API calls 9999->10000 10000->9998 10001->9986 10002->10001 10003 7ffdfaab490d 10004 7ffdfaab4932 10003->10004 10007 7ffdfabdcad0 10004->10007 10008 7ffdfabdcad9 10007->10008 10009 7ffdfabdcb24 IsProcessorFeaturePresent 10008->10009 10010 7ffdfaab4b79 10008->10010 10011 7ffdfabdcb3c 10009->10011 10012 7ffdfabdcb43 capture_previous_context 10009->10012 10011->10012 10015 7ffdfabdcaf0 SetUnhandledExceptionFilter UnhandledExceptionFilter GetCurrentProcess TerminateProcess 10012->10015 10446 7ffdfa991000 10447 7ffdfa993598 _PyArg_BadArgument 10446->10447 10448 7ffdfa99101e 10446->10448 10449 7ffdfa991029 10447->10449 10448->10447 10448->10449 10450 7ffdfa9935ed 10449->10450 10451 7ffdfa9910f0 PyUnicode_FromString 10449->10451 10452 7ffdfa9910d3 PyType_IsSubtype 10449->10452 10452->10451 10453 7ffdfa9910dd 10452->10453 10453->10451 10016 7ffdfaaffb10 10017 7ffdfaaffb2c 10016->10017 10018 7ffdfaaffba4 10016->10018 10019 7ffdfaaffb60 10017->10019 10020 7ffdfaafabe0 6 API calls 10017->10020 10020->10019 10021 7ffdfaaec90d 10022 7ffdfaae9eb0 10021->10022 10022->10021 10023 7ffdfabdcad0 6 API calls 10022->10023 10025 7ffdfaaec9c6 10022->10025 10024 7ffdfaaf0159 10023->10024 10454 7ffdfaaccc10 10455 7ffdfaaccc25 10454->10455 10457 7ffdfaaccc36 10455->10457 10464 7ffdfaacac00 10455->10464 10459 7ffdfaaccc83 10457->10459 10463 7ffdfaaccc89 10457->10463 10470 7ffdfaacca70 10457->10470 10460 7ffdfaaccd31 10459->10460 10461 7ffdfaacac00 2 API calls 10459->10461 10459->10463 10462 7ffdfaacca70 8 API calls 10460->10462 10460->10463 10461->10460 10462->10463 10465 7ffdfaacac26 10464->10465 10466 7ffdfaacac70 10464->10466 10467 7ffdfaacac4c memset 10465->10467 10469 7ffdfaacac42 10465->10469 10468 7ffdfaacac88 memset 10466->10468 10466->10469 10467->10466 10468->10469 10469->10457 10471 7ffdfaaccada memcmp 10470->10471 10472 7ffdfaaccad0 10470->10472 10473 7ffdfaaccb1e 10471->10473 10477 7ffdfaaccb9d 10471->10477 10472->10471 10476 7ffdfaaccb85 memcmp 10473->10476 10473->10477 10474 7ffdfabdcad0 6 API calls 10475 7ffdfaaccbed 10474->10475 10475->10459 10476->10477 10477->10474 10478 7ffdfaad5c10 10479 7ffdfaad5d75 10478->10479 10480 7ffdfaad5c40 10478->10480 10480->10479 10481 7ffdfaad5d16 memset 10480->10481 10482 7ffdfaad5d29 10480->10482 10481->10482 10482->10479 10483 7ffdfaad5eab memset 10482->10483 10483->10479 10223 7ffdfab44ab0 10227 7ffdfab44adb 10223->10227 10228 7ffdfab44e0c 10223->10228 10224 7ffdfaab8c40 6 API calls 10224->10227 10226 7ffdfaafabe0 6 API calls 10226->10227 10227->10224 10227->10226 10227->10228 10229 7ffdfab48aa0 10227->10229 10230 7ffdfab48ab2 10229->10230 10231 7ffdfab48abb 10229->10231 10230->10227 10232 7ffdfab48ade 10231->10232 10233 7ffdfaafabe0 6 API calls 10231->10233 10234 7ffdfab48b01 10232->10234 10235 7ffdfaafabe0 6 API calls 10232->10235 10233->10232 10236 7ffdfab48aa0 6 API calls 10234->10236 10235->10234 10237 7ffdfab48b14 10236->10237 10237->10227 10026 7ffdfaae9909 10028 7ffdfaae97b7 10026->10028 10027 7ffdfaaef967 10030 7ffdfabdcad0 6 API calls 10027->10030 10032 7ffdfaaefb70 10027->10032 10028->10026 10028->10027 10033 7ffdfaab8c40 10028->10033 10031 7ffdfaaf0159 10030->10031 10036 7ffdfaab8b70 10033->10036 10038 7ffdfaab8bcc 10036->10038 10037 7ffdfabdcad0 6 API calls 10039 7ffdfaab8c22 10037->10039 10038->10037 10039->10027 10576 7ffdfab1cbb0 10577 7ffdfab1cbdf 10576->10577 10578 7ffdfab1ce9a 10576->10578 10577->10578 10579 7ffdfab1ce08 memcmp 10577->10579 10580 7ffdfab1ce3b 10577->10580 10579->10577 10580->10578 10581 7ffdfab1ce68 memcmp 10580->10581 10581->10580 10238 7ffdfaaeda87 10239 7ffdfaae9fdc 10238->10239 10240 7ffdfaaedaa2 10238->10240 10241 7ffdfabdcad0 6 API calls 10240->10241 10243 7ffdfaaefb70 10240->10243 10242 7ffdfaaf0159 10241->10242 10040 7ffdfab4ab30 10041 7ffdfab4ab6c 10040->10041 10044 7ffdfab4ab83 10040->10044 10042 7ffdfab4acd3 10041->10042 10041->10044 10043 7ffdfaab8c40 6 API calls 10042->10043 10045 7ffdfab4ace2 10043->10045 10046 7ffdfab4abc5 memcpy 10044->10046 10055 7ffdfab4ad2a 10044->10055 10047 7ffdfab4abde 10046->10047 10048 7ffdfab4acc9 10047->10048 10049 7ffdfab4ae14 10047->10049 10047->10055 10050 7ffdfab4ad52 10048->10050 10051 7ffdfab4ad16 10048->10051 10054 7ffdfaab8c40 6 API calls 10049->10054 10049->10055 10053 7ffdfaab8c40 6 API calls 10050->10053 10052 7ffdfaab8c40 6 API calls 10051->10052 10052->10055 10053->10055 10054->10055 9964 7ffdfaac0180 GetSystemInfo 9965 7ffdfaac01b4 9964->9965 10244 7ffdfa994690 10245 7ffdfa9946a8 _PyArg_BadArgument 10244->10245 10246 7ffdfa9946ca 10244->10246 10247 7ffdfa9946e7 10245->10247 10246->10245 10248 7ffdfa9946d1 10246->10248 10249 7ffdfa994743 PyUnicode_FromString 10248->10249 10250 7ffdfa994720 PyType_IsSubtype 10248->10250 10250->10249 10251 7ffdfa99472a 10250->10251 10251->10249 10484 7ffdfa992610 PyCapsule_GetPointer PyMem_Free 10582 7ffdfa991f90 10583 7ffdfa9921e0 2 API calls 10582->10583 10584 7ffdfa991fa8 10583->10584 10258 7ffdfaae9a7a 10259 7ffdfaae97b7 10258->10259 10260 7ffdfaab8c40 6 API calls 10259->10260 10261 7ffdfaaef967 10259->10261 10260->10261 10262 7ffdfabdcad0 6 API calls 10261->10262 10264 7ffdfaaefb70 10261->10264 10263 7ffdfaaf0159 10262->10263 10056 7ffdfab5bb40 10057 7ffdfab5bb98 10056->10057 10058 7ffdfab5bc65 memset 10057->10058 10059 7ffdfab5bbf4 10057->10059 10061 7ffdfab5bc8a 10057->10061 10058->10061 10060 7ffdfab5c092 memcpy 10060->10061 10061->10059 10061->10060 10062 7ffdfa9926e0 PyModuleDef_Init 10265 7ffdfa992a60 10266 7ffdfa992a7c 10265->10266 10267 7ffdfa992a81 10265->10267 10269 7ffdfa992c1c 10266->10269 10270 7ffdfa992c3f GetSystemTimeAsFileTime GetCurrentThreadId GetCurrentProcessId QueryPerformanceCounter 10269->10270 10271 7ffdfa992cb3 10269->10271 10270->10271 10271->10267 10272 7ffdfa994a64 10273 7ffdfa994aa9 10272->10273 10274 7ffdfa994a8d _PyArg_CheckPositional 10272->10274 10276 7ffdfa994abc _PyArg_BadArgument 10273->10276 10277 7ffdfa994ae6 10273->10277 10274->10273 10275 7ffdfa994ada 10274->10275 10276->10275 10279 7ffdfa994b18 10277->10279 10288 7ffdfa9921e0 10279->10288 10282 7ffdfa994b80 PyUnicode_FromString 10285 7ffdfa994b72 10282->10285 10283 7ffdfa994b52 10284 7ffdfa994b57 PyErr_SetString 10283->10284 10283->10285 10284->10285 10286 7ffdfa992720 8 API calls 10285->10286 10287 7ffdfa994b9b 10286->10287 10287->10275 10289 7ffdfa99220b 10288->10289 10291 7ffdfa99223f 10288->10291 10290 7ffdfa993cab PyType_IsSubtype 10289->10290 10289->10291 10292 7ffdfa99221f 10289->10292 10290->10292 10291->10282 10291->10283 10292->10291 10294 7ffdfa994154 10292->10294 10297 7ffdfa9926f0 10294->10297 10296 7ffdfa99417a __stdio_common_vsprintf 10296->10291 10297->10296 10585 7ffdfa994764 10586 7ffdfa99479a 10585->10586 10587 7ffdfa99477d _PyArg_CheckPositional 10585->10587 10590 7ffdfa9947ef 10586->10590 10591 7ffdfa9947ad _PyArg_BadArgument 10586->10591 10587->10586 10589 7ffdfa9947cb 10587->10589 10593 7ffdfa994804 10590->10593 10591->10589 10594 7ffdfa994830 PyUnicode_CompareWithASCIIString 10593->10594 10603 7ffdfa994824 10593->10603 10595 7ffdfa9948cc PyUnicode_CompareWithASCIIString 10594->10595 10599 7ffdfa994853 10594->10599 10596 7ffdfa9948ec PyUnicode_CompareWithASCIIString 10595->10596 10595->10599 10597 7ffdfa994904 PyUnicode_CompareWithASCIIString 10596->10597 10596->10599 10597->10599 10600 7ffdfa99491f PyErr_SetString 10597->10600 10598 7ffdfa994024 PyType_IsSubtype 10601 7ffdfa99486e 10598->10601 10599->10598 10600->10603 10602 7ffdfa9948a6 PyUnicode_Compare 10601->10602 10601->10603 10602->10603 10604 7ffdfa9948b9 10602->10604 10603->10589 10604->10603 10605 7ffdfa9948bf _Py_Dealloc 10604->10605 10605->10603 10606 7ffdfaacbb70 memset 10608 7ffdfaacbbe0 10606->10608 10612 7ffdfaacbcea 10606->10612 10607 7ffdfaacbde2 10609 7ffdfabdcad0 6 API calls 10607->10609 10611 7ffdfaacbc93 memcpy 10608->10611 10608->10612 10610 7ffdfaacbdfe 10609->10610 10611->10608 10612->10607 10613 7ffdfaacbdae memcpy 10612->10613 10613->10612 10485 7ffdfab35c50 10486 7ffdfab35c7d 10485->10486 10487 7ffdfab35eef 10485->10487 10486->10487 10488 7ffdfaab8c40 6 API calls 10486->10488 10489 7ffdfab35e8f memcpy 10486->10489 10488->10486 10489->10486 10614 7ffdfab1e9d0 10615 7ffdfabdda90 ceil 10614->10615 10616 7ffdfab1dbd0 10617 7ffdfab1dcc4 10616->10617 10618 7ffdfab1dbf4 10616->10618 10618->10617 10619 7ffdfab1dcba 10618->10619 10620 7ffdfab1dc9f memcpy 10618->10620 10619->10617 10621 7ffdfab1dccd memcpy 10619->10621 10620->10619 10621->10617 10063 7ffdfaab68ec 10065 7ffdfaab68aa 10063->10065 10064 7ffdfaab6935 10065->10064 10066 7ffdfabdcad0 6 API calls 10065->10066 10067 7ffdfaab8143 10066->10067 10068 7ffdfab5c950 10069 7ffdfab5c979 10068->10069 10070 7ffdfab5cb6d 10069->10070 10071 7ffdfab5cb34 memcpy 10069->10071 10071->10069 10298 7ffdfaaeca66 10299 7ffdfaae97b7 10298->10299 10300 7ffdfaab8c40 6 API calls 10299->10300 10303 7ffdfaaef0c1 10299->10303 10304 7ffdfaaef0da 10299->10304 10300->10304 10301 7ffdfabdcad0 6 API calls 10302 7ffdfaaf0159 10301->10302 10304->10301 10304->10303 10622 7ffdfab55bd0 10623 7ffdfab55bfb 10622->10623 10624 7ffdfab55e46 10622->10624 10623->10624 10626 7ffdfab55b10 10623->10626 10628 7ffdfab55b64 10626->10628 10627 7ffdfabdcad0 6 API calls 10629 7ffdfab55bb2 10627->10629 10628->10627 10629->10623 10072 7ffdfa9916f0 10073 7ffdfa9938d2 _PyArg_BadArgument 10072->10073 10074 7ffdfa991713 10072->10074 10077 7ffdfa9938f8 10073->10077 10074->10073 10075 7ffdfa99171e 10074->10075 10076 7ffdfa991824 PyUnicode_FromString 10075->10076 10075->10077 10078 7ffdfa9917c8 PyType_IsSubtype 10075->10078 10078->10076 10079 7ffdfa9917d2 10078->10079 10079->10076 10079->10077 10490 7ffdfa9943f0 10491 7ffdfa994408 _PyArg_BadArgument 10490->10491 10492 7ffdfa99442a 10490->10492 10493 7ffdfa994447 10491->10493 10492->10491 10494 7ffdfa994431 10492->10494 10495 7ffdfa994483 PyType_IsSubtype 10494->10495 10496 7ffdfa9944aa memcpy 10494->10496 10495->10496 10497 7ffdfa99448d 10495->10497 10499 7ffdfa994582 PyUnicode_FromStringAndSize 10496->10499 10505 7ffdfa994524 10496->10505 10497->10496 10500 7ffdfa994498 PyUnicode_FromString 10497->10500 10501 7ffdfa994598 10499->10501 10500->10501 10503 7ffdfa992720 8 API calls 10501->10503 10502 7ffdfa99453b PyOS_snprintf 10502->10505 10504 7ffdfa9945a8 10503->10504 10505->10502 10505->10505 10506 7ffdfa99457a 10505->10506 10506->10499 10507 7ffdfa992df4 10508 7ffdfa992e18 __scrt_release_startup_lock 10507->10508 10509 7ffdfa99340e _seh_filter_dll 10508->10509 10510 7ffdfab1e9e0 10511 7ffdfabdda96 floor 10510->10511 10087 7ffdfa99354a __scrt_dllmain_exception_filter 10088 7ffdfaab3b50 10090 7ffdfaab3b72 10088->10090 10089 7ffdfabdcad0 6 API calls 10091 7ffdfaab3ba7 10089->10091 10090->10089 10092 7ffdfaab6950 10096 7ffdfaab6534 10092->10096 10093 7ffdfaab80a1 10094 7ffdfabdcad0 6 API calls 10093->10094 10095 7ffdfaab8143 10094->10095 10096->10093 10097 7ffdfaab804b memcpy 10096->10097 10098 7ffdfaab7ce9 memcpy 10096->10098 10097->10096 10098->10096 10106 7ffdfaab6948 10110 7ffdfaab6534 10106->10110 10107 7ffdfaab80a1 10108 7ffdfabdcad0 6 API calls 10107->10108 10109 7ffdfaab8143 10108->10109 10110->10106 10110->10107 10111 7ffdfaab804b memcpy 10110->10111 10112 7ffdfaab7ce9 memcpy 10110->10112 10111->10110 10112->10110 10305 7ffdfab29a70 10306 7ffdfab29aa6 10305->10306 10307 7ffdfab29a9d 10305->10307 10306->10307 10309 7ffdfab29f1a 10306->10309 10312 7ffdfaae6b10 10306->10312 10310 7ffdfab29fe5 10309->10310 10311 7ffdfab2a00e memcpy 10309->10311 10311->10310 10313 7ffdfaae6b3c 10312->10313 10314 7ffdfaae6b2b 10312->10314 10313->10314 10315 7ffdfaae6f23 memcpy 10313->10315 10314->10306 10315->10314 10512 7ffdfabdcbf8 10515 7ffdfabdcc0c IsProcessorFeaturePresent 10512->10515 10516 7ffdfabdcc2b capture_current_context 10515->10516 10517 7ffdfabdcc23 10515->10517 10520 7ffdfabdcaf0 SetUnhandledExceptionFilter UnhandledExceptionFilter GetCurrentProcess TerminateProcess 10516->10520 10517->10516 10647 7ffdfaab9bc0 10650 7ffdfaab9be3 10647->10650 10648 7ffdfaab9c14 10649 7ffdfaab8b70 6 API calls 10651 7ffdfaab9c9c 10649->10651 10650->10648 10650->10649 10117 7ffdfa991150 10118 7ffdfa9935f4 _PyArg_CheckPositional 10117->10118 10120 7ffdfa99116d 10117->10120 10119 7ffdfa993611 _PyArg_BadArgument 10118->10119 10121 7ffdfa993640 10118->10121 10119->10121 10120->10119 10123 7ffdfa99119c 10120->10123 10126 7ffdfa9911b0 10123->10126 10127 7ffdfa9911d8 PyUnicode_CompareWithASCIIString 10126->10127 10148 7ffdfa9911a4 10126->10148 10128 7ffdfa993648 10127->10128 10129 7ffdfa9911f0 PyUnicode_CompareWithASCIIString 10127->10129 10165 7ffdfa994024 10128->10165 10131 7ffdfa991208 10129->10131 10132 7ffdfa993691 PyUnicode_CompareWithASCIIString 10129->10132 10134 7ffdfa99124d 10131->10134 10139 7ffdfa99121d PyType_IsSubtype 10131->10139 10135 7ffdfa9936a5 10132->10135 10136 7ffdfa9936d7 PyUnicode_CompareWithASCIIString 10132->10136 10133 7ffdfa99365e 10142 7ffdfa9912f0 24 API calls 10133->10142 10133->10148 10144 7ffdfa991227 10134->10144 10134->10148 10150 7ffdfa99368c 10134->10150 10140 7ffdfa994024 PyType_IsSubtype 10135->10140 10137 7ffdfa9936eb 10136->10137 10138 7ffdfa99372c PyErr_SetString 10136->10138 10143 7ffdfa994024 PyType_IsSubtype 10137->10143 10138->10148 10139->10134 10139->10144 10141 7ffdfa9936bb 10140->10141 10141->10148 10169 7ffdfa9918a0 10141->10169 10142->10148 10147 7ffdfa993701 10143->10147 10151 7ffdfa9912f0 10144->10151 10147->10148 10149 7ffdfa9918a0 17 API calls 10147->10149 10149->10148 10150->10132 10152 7ffdfa9918a0 17 API calls 10151->10152 10153 7ffdfa991318 10152->10153 10154 7ffdfa9938ca 10153->10154 10155 7ffdfa9938ad PyErr_NoMemory 10153->10155 10156 7ffdfa99136f PyMem_Malloc 10153->10156 10164 7ffdfa99138e 10153->10164 10155->10154 10157 7ffdfa9938ba 10155->10157 10156->10155 10156->10164 10157->10154 10158 7ffdfa9938c1 _Py_Dealloc 10157->10158 10158->10154 10159 7ffdfa991484 PyMem_Free 10184 7ffdfa992720 10159->10184 10160 7ffdfa99169d PyUnicode_FromKindAndData PyMem_Free 10160->10164 10162 7ffdfa991694 _Py_Dealloc 10162->10160 10164->10159 10164->10160 10164->10162 10166 7ffdfa994048 10165->10166 10168 7ffdfa994066 10165->10168 10167 7ffdfa994058 PyType_IsSubtype 10166->10167 10166->10168 10167->10168 10168->10133 10170 7ffdfa9918df 10169->10170 10171 7ffdfa9918fb PyMem_Malloc 10170->10171 10172 7ffdfa993b13 PyErr_NoMemory 10170->10172 10171->10172 10183 7ffdfa99191a 10171->10183 10173 7ffdfa991b19 PyUnicode_FromKindAndData PyMem_Free 10174 7ffdfa993a39 10173->10174 10173->10183 10174->10148 10175 7ffdfa991bfe PyMem_Realloc 10176 7ffdfa993a28 PyMem_Free PyErr_NoMemory 10175->10176 10175->10183 10176->10174 10177 7ffdfa9919f6 PyType_IsSubtype 10177->10183 10178 7ffdfa991bbf 10180 7ffdfa992720 8 API calls 10178->10180 10179 7ffdfa991a53 PyType_IsSubtype 10182 7ffdfa9939e9 10179->10182 10179->10183 10181 7ffdfa991bf2 10180->10181 10181->10148 10182->10176 10183->10173 10183->10175 10183->10177 10183->10178 10183->10179 10183->10182 10185 7ffdfa992729 10184->10185 10186 7ffdfa9914b0 10185->10186 10187 7ffdfa992ad4 IsProcessorFeaturePresent 10185->10187 10186->10148 10188 7ffdfa992aec 10187->10188 10193 7ffdfa992ba8 RtlCaptureContext 10188->10193 10194 7ffdfa992bc2 RtlLookupFunctionEntry 10193->10194 10195 7ffdfa992bd8 RtlVirtualUnwind 10194->10195 10196 7ffdfa992aff 10194->10196 10195->10194 10195->10196 10197 7ffdfa992aa0 SetUnhandledExceptionFilter UnhandledExceptionFilter GetCurrentProcess TerminateProcess 10196->10197 10321 7ffdfa9924d0 PyModule_AddStringConstant 10322 7ffdfa9924fe PyType_FromSpec 10321->10322 10323 7ffdfa992596 10321->10323 10322->10323 10324 7ffdfa992517 PyModule_AddType 10322->10324 10325 7ffdfa99252b 10324->10325 10334 7ffdfa993e70 10324->10334 10339 7ffdfa9925c0 _PyObject_GC_New 10325->10339 10328 7ffdfa993e86 _Py_Dealloc 10328->10323 10329 7ffdfa992545 10329->10323 10331 7ffdfa99254a PyModule_AddObject 10329->10331 10330 7ffdfa993e92 _Py_Dealloc 10330->10329 10332 7ffdfa992565 10331->10332 10331->10334 10342 7ffdfa992630 PyMem_Malloc 10332->10342 10334->10323 10334->10328 10336 7ffdfa992572 PyModule_AddObjectRef 10336->10323 10337 7ffdfa99258c 10336->10337 10337->10323 10338 7ffdfa993eb9 _Py_Dealloc 10337->10338 10338->10323 10340 7ffdfa992533 10339->10340 10341 7ffdfa9925d4 PyObject_GC_Track 10339->10341 10340->10329 10340->10330 10341->10340 10343 7ffdfa993ec8 PyErr_NoMemory 10342->10343 10344 7ffdfa99264d PyCapsule_New 10342->10344 10345 7ffdfa993ed5 PyMem_Free 10343->10345 10344->10345 10346 7ffdfa99256a 10344->10346 10346->10323 10346->10336 10652 7ffdfaaffbc0 10653 7ffdfaaffbfa 10652->10653 10654 7ffdfaafabe0 6 API calls 10653->10654 10655 7ffdfaaffc9c 10653->10655 10654->10655 10521 7ffdfaaf3c40 10523 7ffdfaaf3c80 10521->10523 10522 7ffdfaaf3d7f 10523->10522 10524 7ffdfaaf3d11 memset 10523->10524 10524->10523 10347 7ffdfab11a80 10350 7ffdfab11ab0 10347->10350 10348 7ffdfab11bcd 10349 7ffdfab122ed strcmp 10349->10348 10350->10348 10351 7ffdfaab8c40 6 API calls 10350->10351 10353 7ffdfab122ad 10350->10353 10354 7ffdfab11fb8 10350->10354 10351->10354 10352 7ffdfaab8c40 6 API calls 10352->10353 10353->10348 10353->10349 10354->10348 10354->10352 10530 7ffdfab65c00 10531 7ffdfab65edd 10530->10531 10534 7ffdfab65c28 10530->10534 10532 7ffdfab65eb2 10533 7ffdfab65d4e memcpy 10533->10534 10534->10532 10534->10533 10535 7ffdfab65da2 memcpy 10534->10535 10536 7ffdfaafabe0 6 API calls 10534->10536 10535->10534 10536->10534 10355 7ffdfaabaab0 10356 7ffdfaabaad5 10355->10356 10359 7ffdfaabab4c 10355->10359 10357 7ffdfabdcad0 6 API calls 10356->10357 10358 7ffdfaabab47 10357->10358 10360 7ffdfabdcad0 6 API calls 10359->10360 10361 7ffdfaababb1 10360->10361 10661 7ffdfaabdbb0 10662 7ffdfaabdbd9 10661->10662 10662->10662 10663 7ffdfaabdc30 memset 10662->10663 10664 7ffdfaabdc5f 10662->10664 10663->10664 10665 7ffdfaab3bb0 10667 7ffdfaab3bd2 10665->10667 10666 7ffdfabdcad0 6 API calls 10668 7ffdfaab3c96 10666->10668 10669 7ffdfaab3c28 10667->10669 10670 7ffdfaab3bee 10667->10670 10671 7ffdfaab3c7c 10667->10671 10669->10671 10672 7ffdfaab3c5e 10669->10672 10673 7ffdfabdcad0 6 API calls 10670->10673 10671->10666 10674 7ffdfabdcad0 6 API calls 10672->10674 10675 7ffdfaab3c22 10673->10675 10676 7ffdfaab3c76 10674->10676 10362 7ffdfa991ea0 _PyArg_Parse_SizeT 10363 7ffdfa991eca 10362->10363 10364 7ffdfa991edc 10362->10364 10366 7ffdfa991ef0 10363->10366 10367 7ffdfa991f06 10366->10367 10368 7ffdfa993b20 PyErr_SetString 10366->10368 10374 7ffdfa991fd0 strncmp 10367->10374 10370 7ffdfa991f18 10371 7ffdfa991f3f PyErr_Format 10370->10371 10372 7ffdfa991f2d PyUnicode_FromOrdinal 10370->10372 10373 7ffdfa991f61 PyUnicode_FromKindAndData 10370->10373 10371->10364 10372->10371 10373->10368 10375 7ffdfa992016 strncmp 10374->10375 10376 7ffdfa993b3e 10374->10376 10381 7ffdfa992034 10375->10381 10386 7ffdfa992070 10375->10386 10392 7ffdfa993f7c 10376->10392 10379 7ffdfa993f7c strncmp 10380 7ffdfa993b9e 10379->10380 10382 7ffdfa993f7c strncmp 10380->10382 10381->10386 10387 7ffdfa992120 10381->10387 10382->10386 10384 7ffdfa99206c 10385 7ffdfa992120 10 API calls 10384->10385 10384->10386 10385->10384 10386->10370 10388 7ffdfa9921e0 2 API calls 10387->10388 10391 7ffdfa992163 10388->10391 10389 7ffdfa992720 8 API calls 10390 7ffdfa9921bd 10389->10390 10390->10384 10391->10389 10393 7ffdfa993b76 10392->10393 10394 7ffdfa993fa8 10392->10394 10393->10379 10394->10393 10395 7ffdfa993fd9 strncmp 10394->10395 10395->10394 10396 7ffdfa9926a0 PyObject_GC_UnTrack PyObject_GC_Del 10397 7ffdfa9926c5 10396->10397 10398 7ffdfa9926cf 10396->10398 10397->10398 10399 7ffdfa993ee4 _Py_Dealloc 10397->10399 10399->10398 10400 7ffdfa9942a0 10401 7ffdfa9942c9 _PyArg_CheckPositional 10400->10401 10403 7ffdfa9942e5 10400->10403 10401->10403 10404 7ffdfa994316 10401->10404 10402 7ffdfa9942f8 _PyArg_BadArgument 10402->10404 10403->10402 10405 7ffdfa994322 10403->10405 10407 7ffdfa994354 10405->10407 10408 7ffdfa99439d _PyUnicode_ToDecimalDigit 10407->10408 10409 7ffdfa994370 10407->10409 10411 7ffdfa9943a5 10408->10411 10409->10408 10410 7ffdfa994380 PyType_IsSubtype 10409->10410 10410->10408 10416 7ffdfa99438a 10410->10416 10412 7ffdfa9943d7 PyLong_FromLong 10411->10412 10413 7ffdfa9943a9 10411->10413 10414 7ffdfa9943c9 10412->10414 10413->10414 10415 7ffdfa9943ae PyErr_SetString 10413->10415 10414->10404 10415->10414 10416->10408 10416->10411 10416->10413 10203 7ffdfab06b30 10204 7ffdfab06b7e 10203->10204 10207 7ffdfaab8c40 6 API calls 10204->10207 10208 7ffdfab0778a 10204->10208 10205 7ffdfabdcad0 6 API calls 10206 7ffdfab0791c 10205->10206 10207->10208 10208->10205 10417 7ffdfab04ab0 10418 7ffdfab04ace 10417->10418 10420 7ffdfab04bc8 10417->10420 10419 7ffdfab04e0a memcpy 10418->10419 10418->10420 10419->10420 10677 7ffdfa994ba4 10678 7ffdfa994bcd _PyArg_CheckPositional 10677->10678 10680 7ffdfa994be9 10677->10680 10678->10680 10681 7ffdfa994c1a 10678->10681 10679 7ffdfa994bfc _PyArg_BadArgument 10679->10681 10680->10679 10682 7ffdfa994c26 10680->10682 10684 7ffdfa994c58 10682->10684 10685 7ffdfa994cb5 _PyUnicode_ToNumeric 10684->10685 10686 7ffdfa994c74 10684->10686 10689 7ffdfa994c99 10685->10689 10686->10685 10687 7ffdfa994c84 PyType_IsSubtype 10686->10687 10687->10685 10693 7ffdfa994c8e 10687->10693 10688 7ffdfa994cf7 PyFloat_FromDouble 10691 7ffdfa994ce9 10688->10691 10689->10688 10690 7ffdfa994cc9 10689->10690 10690->10691 10692 7ffdfa994cce PyErr_SetString 10690->10692 10691->10681 10692->10691 10693->10685 10693->10689 10433 7ffdfab4ba90 10434 7ffdfab4bc07 10433->10434 10435 7ffdfab4bac2 10433->10435 10435->10434 10436 7ffdfab4bb87 memset 10435->10436 10437 7ffdfab4bbe3 memcpy 10436->10437 10438 7ffdfab4bbcd 10436->10438 10437->10434 10438->10437 10541 7ffdfaae9c24 10543 7ffdfaae97b7 10541->10543 10542 7ffdfaaef611 10543->10542 10544 7ffdfaab8c40 6 API calls 10543->10544 10545 7ffdfaaef967 10543->10545 10544->10545 10546 7ffdfabdcad0 6 API calls 10545->10546 10548 7ffdfaaefb70 10545->10548 10547 7ffdfaaf0159 10546->10547 10694 7ffdfaaebba4 10695 7ffdfaae97b7 10694->10695 10696 7ffdfaaebbbe 10694->10696 10698 7ffdfaaebc9f 10695->10698 10702 7ffdfaab8c40 6 API calls 10695->10702 10696->10695 10697 7ffdfaaebc11 memcpy 10696->10697 10696->10698 10697->10695 10699 7ffdfabdcad0 6 API calls 10698->10699 10701 7ffdfaaefb70 10698->10701 10700 7ffdfaaf0159 10699->10700 10702->10698 10703 7ffdfa991fb0 10704 7ffdfa991fd0 13 API calls 10703->10704 10705 7ffdfa991fc9 10704->10705 10215 7ffdfaaf1b20 10216 7ffdfaaf1b4d 10215->10216 10217 7ffdfaaf1b9d memset memcpy 10216->10217 10218 7ffdfaaf1bda 10216->10218 10217->10218 10219 7ffdfaae2b20 10220 7ffdfaae2b70 10219->10220 10221 7ffdfaab8c40 6 API calls 10220->10221 10222 7ffdfaae2c68 10220->10222 10221->10222 10554 7ffdfaad6c20 10555 7ffdfaad6c69 10554->10555 10557 7ffdfaad6c4d 10554->10557 10556 7ffdfaad6dd4 memcpy memcpy 10555->10556 10555->10557 10556->10557 10706 7ffdfa9941b4 10707 7ffdfa9941cc _PyArg_BadArgument 10706->10707 10708 7ffdfa9941ee 10706->10708 10710 7ffdfa99421e 10707->10710 10708->10707 10709 7ffdfa9941f5 10708->10709 10715 7ffdfa994240 10709->10715 10713 7ffdfa994222 PyLong_FromLong 10713->10710 10714 7ffdfa994213 PyErr_Occurred 10714->10710 10714->10713 10716 7ffdfa99425b 10715->10716 10717 7ffdfa99420c 10716->10717 10718 7ffdfa994274 PyType_IsSubtype 10716->10718 10717->10713 10717->10714 10718->10717 10719 7ffdfa9945b4 10720 7ffdfa9945d5 _PyArg_CheckPositional 10719->10720 10721 7ffdfa9945f1 10719->10721 10720->10721 10727 7ffdfa994622 10720->10727 10722 7ffdfa994604 _PyArg_BadArgument 10721->10722 10723 7ffdfa99462d 10721->10723 10722->10727 10724 7ffdfa99463c _PyUnicode_ToDigit 10723->10724 10725 7ffdfa994676 PyLong_FromLong 10724->10725 10726 7ffdfa994648 10724->10726 10725->10727 10726->10727 10728 7ffdfa99464d PyErr_SetString 10726->10728 10728->10727 10729 7ffdfaad7ba0 10730 7ffdfaad7bbd memcpy memcpy 10729->10730 10731 7ffdfaad7c44 10729->10731 10730->10731

                                                                                                                                                                                                                  Executed Functions

                                                                                                                                                                                                                  Function 00007FFDFAAC0180 Relevance: 1.7, APIs: 1, Instructions: 204COMMON
                                                                                                                                                                                                                  Download Yara Rule

                                                                                                                                                                                                                  Control-flow Graph

                                                                                                                                                                                                                  • Executed
                                                                                                                                                                                                                  • Not Executed
                                                                                                                                                                                                                  control_flow_graph 0 7ffdfaac0180-7ffdfaac01b2 GetSystemInfo 1 7ffdfaac01b8-7ffdfaac01c9 0->1 2 7ffdfaac01b4-7ffdfaac01b6 0->2 3 7ffdfaac01d4-7ffdfaac01e5 1->3 7 7ffdfaac01cb 1->7 2->3 5 7ffdfaac01e7-7ffdfaac01ee 3->5 6 7ffdfaac01f0-7ffdfaac01f3 3->6 8 7ffdfaac0225-7ffdfaac0236 5->8 6->8 9 7ffdfaac01f5-7ffdfaac01fd 6->9 7->3 10 7ffdfaac0248-7ffdfaac024f 8->10 11 7ffdfaac0238-7ffdfaac0241 8->11 12 7ffdfaac01ff 9->12 13 7ffdfaac0214-7ffdfaac0218 9->13 15 7ffdfaac0255-7ffdfaac0266 10->15 16 7ffdfaac0251-7ffdfaac0253 10->16 11->10 17 7ffdfaac0203-7ffdfaac0206 12->17 13->8 14 7ffdfaac021a-7ffdfaac0221 13->14 14->8 27 7ffdfaac0268 15->27 28 7ffdfaac0271 15->28 20 7ffdfaac0278-7ffdfaac0282 16->20 17->13 18 7ffdfaac0208-7ffdfaac0212 17->18 18->13 18->17 21 7ffdfaac0294-7ffdfaac0297 20->21 22 7ffdfaac0284-7ffdfaac0292 20->22 25 7ffdfaac0299-7ffdfaac02a1 21->25 26 7ffdfaac02df-7ffdfaac02e9 21->26 24 7ffdfaac02c9-7ffdfaac02cc 22->24 24->26 31 7ffdfaac02ce-7ffdfaac02dd 24->31 29 7ffdfaac02b8-7ffdfaac02bc 25->29 30 7ffdfaac02a3 25->30 32 7ffdfaac02f0-7ffdfaac02f3 26->32 27->28 28->20 29->24 34 7ffdfaac02be-7ffdfaac02c5 29->34 33 7ffdfaac02a7-7ffdfaac02aa 30->33 31->32 35 7ffdfaac0305-7ffdfaac030c 32->35 36 7ffdfaac02f5-7ffdfaac02fe 32->36 33->29 39 7ffdfaac02ac-7ffdfaac02b6 33->39 34->24 37 7ffdfaac030e-7ffdfaac0310 35->37 38 7ffdfaac0312-7ffdfaac0323 35->38 36->35 40 7ffdfaac0335-7ffdfaac033f 37->40 45 7ffdfaac0325 38->45 46 7ffdfaac032e 38->46 39->29 39->33 43 7ffdfaac0351-7ffdfaac0354 40->43 44 7ffdfaac0341-7ffdfaac034f 40->44 48 7ffdfaac0356-7ffdfaac035e 43->48 49 7ffdfaac039c-7ffdfaac03a6 43->49 47 7ffdfaac0386-7ffdfaac0389 44->47 45->46 46->40 47->49 50 7ffdfaac038b-7ffdfaac039a 47->50 52 7ffdfaac0375-7ffdfaac0379 48->52 53 7ffdfaac0360 48->53 51 7ffdfaac03ad-7ffdfaac03b0 49->51 50->51 54 7ffdfaac03c2-7ffdfaac03c9 51->54 55 7ffdfaac03b2-7ffdfaac03bb 51->55 52->47 57 7ffdfaac037b-7ffdfaac0382 52->57 56 7ffdfaac0364-7ffdfaac0367 53->56 58 7ffdfaac03cb-7ffdfaac03cd 54->58 59 7ffdfaac03cf-7ffdfaac03e0 54->59 55->54 56->52 60 7ffdfaac0369-7ffdfaac0373 56->60 57->47 62 7ffdfaac03f2-7ffdfaac03fc 58->62 69 7ffdfaac03eb 59->69 70 7ffdfaac03e2 59->70 60->52 60->56 63 7ffdfaac040e-7ffdfaac0411 62->63 64 7ffdfaac03fe-7ffdfaac040c 62->64 67 7ffdfaac0459-7ffdfaac0460 63->67 68 7ffdfaac0413-7ffdfaac041b 63->68 66 7ffdfaac0443-7ffdfaac0446 64->66 66->67 73 7ffdfaac0448-7ffdfaac0457 66->73 74 7ffdfaac0467-7ffdfaac046a 67->74 71 7ffdfaac041d 68->71 72 7ffdfaac0432-7ffdfaac0436 68->72 69->62 70->69 75 7ffdfaac0421-7ffdfaac0424 71->75 72->66 76 7ffdfaac0438-7ffdfaac043f 72->76 73->74 77 7ffdfaac0475-7ffdfaac047c 74->77 78 7ffdfaac046c 74->78 75->72 79 7ffdfaac0426-7ffdfaac0430 75->79 76->66 80 7ffdfaac047e-7ffdfaac0490 77->80 81 7ffdfaac0491-7ffdfaac04aa 77->81 78->77 79->72 79->75
                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                  • Source File: 00000001.00000002.1790722712.00007FFDFAAB1000.00000020.00000001.01000000.00000017.sdmp, Offset: 00007FFDFAAB0000, based on PE: true
                                                                                                                                                                                                                  • Associated: 00000001.00000002.1790701930.00007FFDFAAB0000.00000002.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                                                                                                  • Associated: 00000001.00000002.1791797724.00007FFDFABDE000.00000002.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                                                                                                  • Associated: 00000001.00000002.1792020766.00007FFDFAC0B000.00000004.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                                                                                                  • Associated: 00000001.00000002.1792149222.00007FFDFAC10000.00000002.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                  • Snapshot File: hcaresult_1_2_7ffdfaab0000_dipwo1iToJ.jbxd
                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                  • API ID: InfoSystem
                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                  • API String ID: 31276548-0
                                                                                                                                                                                                                  • Opcode ID: b0054afb10e4f66619171edf603becae74e7afe6d3d72f3cb96377bce576b712
                                                                                                                                                                                                                  • Instruction ID: b8259677ddcfeb011da559cefd05078b0364df0551de8710204ed560035a049a
                                                                                                                                                                                                                  • Opcode Fuzzy Hash: b0054afb10e4f66619171edf603becae74e7afe6d3d72f3cb96377bce576b712
                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 30A11A28B0EB1785FF5D8B45E470B3932A0BF44B44F1945B5C96E877E8DF2CE5AA8240

                                                                                                                                                                                                                  Non-executed Functions

                                                                                                                                                                                                                  Function 00007FFDFA9918A0 Relevance: 13.9, APIs: 9, Instructions: 426COMMON
                                                                                                                                                                                                                  Download Yara Rule

                                                                                                                                                                                                                  Control-flow Graph

                                                                                                                                                                                                                  • Executed
                                                                                                                                                                                                                  • Not Executed
                                                                                                                                                                                                                  control_flow_graph 659 7ffdfa9918a0-7ffdfa9918d9 660 7ffdfa991d8f-7ffdfa991d9c 659->660 661 7ffdfa9918df 659->661 662 7ffdfa991da2-7ffdfa991da6 660->662 663 7ffdfa9918e3-7ffdfa9918f5 660->663 661->663 662->663 664 7ffdfa9918fb-7ffdfa991914 PyMem_Malloc 663->664 665 7ffdfa993b13-7ffdfa993b19 PyErr_NoMemory 663->665 664->665 666 7ffdfa99191a-7ffdfa991949 664->666 667 7ffdfa993916 666->667 668 7ffdfa99194f-7ffdfa991979 666->668 673 7ffdfa99391f-7ffdfa99399a 667->673 669 7ffdfa991b19-7ffdfa991b3b PyUnicode_FromKindAndData PyMem_Free 668->669 670 7ffdfa99197f 668->670 671 7ffdfa993a39-7ffdfa993a3b 669->671 672 7ffdfa991b41-7ffdfa991b51 669->672 674 7ffdfa991981-7ffdfa991984 670->674 677 7ffdfa991b57-7ffdfa991b59 672->677 678 7ffdfa993a40 672->678 679 7ffdfa991b00-7ffdfa991b03 673->679 680 7ffdfa9939a0-7ffdfa9939a5 673->680 675 7ffdfa991c37 674->675 676 7ffdfa99198a-7ffdfa99198d 674->676 691 7ffdfa991c41-7ffdfa991c45 675->691 681 7ffdfa991d46 676->681 682 7ffdfa991993-7ffdfa9919a8 676->682 685 7ffdfa991b5f 677->685 686 7ffdfa991c53-7ffdfa991c57 677->686 690 7ffdfa993a49 678->690 683 7ffdfa991b09 679->683 684 7ffdfa9919ae-7ffdfa9919ca 679->684 693 7ffdfa9939ae 680->693 700 7ffdfa991d4f-7ffdfa991d52 681->700 682->684 687 7ffdfa991b0e-7ffdfa991b13 682->687 683->687 688 7ffdfa991bfe-7ffdfa991c24 PyMem_Realloc 684->688 689 7ffdfa9919d0-7ffdfa9919db 684->689 692 7ffdfa991b63-7ffdfa991b67 685->692 686->692 687->669 687->691 694 7ffdfa993a28-7ffdfa993a33 PyMem_Free PyErr_NoMemory 688->694 695 7ffdfa991c2a-7ffdfa991c2d 688->695 689->673 696 7ffdfa9919e1-7ffdfa9919e4 689->696 703 7ffdfa993a50-7ffdfa993a53 690->703 691->674 697 7ffdfa991c4a-7ffdfa991c4e 692->697 698 7ffdfa991b6d-7ffdfa991b71 692->698 699 7ffdfa9939b3-7ffdfa9939c8 693->699 694->671 695->675 701 7ffdfa9919e6-7ffdfa9919f4 696->701 702 7ffdfa991a2a-7ffdfa991a30 696->702 704 7ffdfa991b7b-7ffdfa991b81 697->704 698->700 705 7ffdfa991b77 698->705 699->679 700->704 701->702 706 7ffdfa9919f6-7ffdfa9919fe PyType_IsSubtype 701->706 708 7ffdfa991a36-7ffdfa991a39 702->708 709 7ffdfa9939f3-7ffdfa9939fc 702->709 707 7ffdfa991c8a-7ffdfa991c97 703->707 704->690 710 7ffdfa991b87-7ffdfa991bb9 704->710 705->704 706->702 711 7ffdfa991a00-7ffdfa991a0e 706->711 714 7ffdfa993a58 707->714 715 7ffdfa991c9d-7ffdfa991cca 707->715 712 7ffdfa993a1c 708->712 713 7ffdfa991a3f-7ffdfa991a4d 708->713 720 7ffdfa993a03-7ffdfa993a07 709->720 716 7ffdfa991c5c-7ffdfa991c6f 710->716 717 7ffdfa991bbf-7ffdfa991bfd call 7ffdfa992720 710->717 718 7ffdfa9939e9-7ffdfa9939ed 711->718 719 7ffdfa991a14-7ffdfa991a1a 711->719 712->694 713->712 722 7ffdfa991a53-7ffdfa991a5b PyType_IsSubtype 713->722 730 7ffdfa993a5f-7ffdfa993a63 714->730 723 7ffdfa991d2b-7ffdfa991d2e 715->723 724 7ffdfa991ccc 715->724 721 7ffdfa991c73-7ffdfa991c77 716->721 718->709 728 7ffdfa991d57-7ffdfa991d5e 719->728 729 7ffdfa991a20-7ffdfa991a24 719->729 746 7ffdfa993a13-7ffdfa993a15 720->746 732 7ffdfa991d3d-7ffdfa991d41 721->732 733 7ffdfa991c7d-7ffdfa991c81 721->733 722->712 734 7ffdfa991a61-7ffdfa991a6f 722->734 723->724 731 7ffdfa991d30-7ffdfa991d33 723->731 726 7ffdfa991cd0-7ffdfa991ce5 724->726 726->721 737 7ffdfa991ce7 726->737 735 7ffdfa9939e2-7ffdfa9939e7 728->735 736 7ffdfa991d64-7ffdfa991d67 728->736 729->699 729->702 740 7ffdfa993a65-7ffdfa993a79 730->740 741 7ffdfa993a7b-7ffdfa993a7f 730->741 731->724 742 7ffdfa991d35-7ffdfa991d38 731->742 732->707 733->703 743 7ffdfa991c87 733->743 734->720 744 7ffdfa991a75-7ffdfa991ab1 734->744 735->699 747 7ffdfa9939db-7ffdfa9939e0 736->747 748 7ffdfa991d6d-7ffdfa991d72 736->748 752 7ffdfa991cec-7ffdfa991cee 737->752 749 7ffdfa993aab-7ffdfa993aaf 740->749 750 7ffdfa993a99-7ffdfa993aa7 741->750 751 7ffdfa993a81-7ffdfa993a97 741->751 742->730 743->707 745 7ffdfa991ab7-7ffdfa991aeb 744->745 744->746 745->752 753 7ffdfa991af1-7ffdfa991afd 745->753 746->712 747->699 754 7ffdfa991d78-7ffdfa991d7b 748->754 755 7ffdfa9939d4-7ffdfa9939d9 748->755 756 7ffdfa993ae5-7ffdfa993ae9 749->756 757 7ffdfa993ab1-7ffdfa993ab5 749->757 750->749 751->749 762 7ffdfa991cfb-7ffdfa991d0a 752->762 763 7ffdfa991cf0-7ffdfa991cf5 752->763 753->679 760 7ffdfa9939cd-7ffdfa9939d2 754->760 761 7ffdfa991d81-7ffdfa991d84 754->761 755->699 764 7ffdfa993aeb-7ffdfa993aef 756->764 765 7ffdfa993af1-7ffdfa993af5 756->765 758 7ffdfa993ab7-7ffdfa993abc 757->758 759 7ffdfa993abe-7ffdfa993ac2 757->759 766 7ffdfa993acf-7ffdfa993ada call 7ffdfa991e00 758->766 767 7ffdfa993acb 759->767 768 7ffdfa993ac4-7ffdfa993ac9 759->768 760->699 761->729 769 7ffdfa991d8a 761->769 770 7ffdfa991d0d-7ffdfa991d1f 762->770 763->753 763->762 771 7ffdfa993aff-7ffdfa993b0e call 7ffdfa991e00 764->771 772 7ffdfa993af7-7ffdfa993afa 765->772 773 7ffdfa993afc 765->773 766->756 779 7ffdfa993adc-7ffdfa993adf 766->779 767->766 768->766 769->693 770->770 775 7ffdfa991d21-7ffdfa991d26 770->775 771->726 772->771 773->771 775->679 779->730 779->756
                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                  • Source File: 00000001.00000002.1790239989.00007FFDFA991000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FFDFA990000, based on PE: true
                                                                                                                                                                                                                  • Associated: 00000001.00000002.1790215466.00007FFDFA990000.00000002.00000001.01000000.0000001A.sdmpDownload File
                                                                                                                                                                                                                  • Associated: 00000001.00000002.1790259151.00007FFDFA995000.00000002.00000001.01000000.0000001A.sdmpDownload File
                                                                                                                                                                                                                  • Associated: 00000001.00000002.1790259151.00007FFDFA9F2000.00000002.00000001.01000000.0000001A.sdmpDownload File
                                                                                                                                                                                                                  • Associated: 00000001.00000002.1790259151.00007FFDFAA3E000.00000002.00000001.01000000.0000001A.sdmpDownload File
                                                                                                                                                                                                                  • Associated: 00000001.00000002.1790259151.00007FFDFAA42000.00000002.00000001.01000000.0000001A.sdmpDownload File
                                                                                                                                                                                                                  • Associated: 00000001.00000002.1790259151.00007FFDFAA47000.00000002.00000001.01000000.0000001A.sdmpDownload File
                                                                                                                                                                                                                  • Associated: 00000001.00000002.1790259151.00007FFDFAA9F000.00000002.00000001.01000000.0000001A.sdmpDownload File
                                                                                                                                                                                                                  • Associated: 00000001.00000002.1790619887.00007FFDFAAA2000.00000004.00000001.01000000.0000001A.sdmpDownload File
                                                                                                                                                                                                                  • Associated: 00000001.00000002.1790657853.00007FFDFAAA4000.00000002.00000001.01000000.0000001A.sdmpDownload File
                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                  • Snapshot File: hcaresult_1_2_7ffdfa990000_dipwo1iToJ.jbxd
                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                  • API ID: Mem_$FreeSubtypeType_$DataErr_FromKindMallocMemoryReallocUnicode_
                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                  • API String ID: 3719493655-0
                                                                                                                                                                                                                  • Opcode ID: 13b0b1041cca574ca06701db0d45e779ed743a60764eb712a04665505c58f9af
                                                                                                                                                                                                                  • Instruction ID: 2f4357c40de8021982fb4c77d7aea91d0c6d702aa51da5456bf0cdb138713df5
                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 13b0b1041cca574ca06701db0d45e779ed743a60764eb712a04665505c58f9af
                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 4E02C472B0C542A2E76C8F15D464A7A36A5FF4D788FA84179D66EC67D8EF2CE844C300
                                                                                                                                                                                                                  Function 00007FFDFA993068 Relevance: 13.6, APIs: 9, Instructions: 72COMMON
                                                                                                                                                                                                                  Download Yara Rule

                                                                                                                                                                                                                  Control-flow Graph

                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                  • Source File: 00000001.00000002.1790239989.00007FFDFA991000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FFDFA990000, based on PE: true
                                                                                                                                                                                                                  • Associated: 00000001.00000002.1790215466.00007FFDFA990000.00000002.00000001.01000000.0000001A.sdmpDownload File
                                                                                                                                                                                                                  • Associated: 00000001.00000002.1790259151.00007FFDFA995000.00000002.00000001.01000000.0000001A.sdmpDownload File
                                                                                                                                                                                                                  • Associated: 00000001.00000002.1790259151.00007FFDFA9F2000.00000002.00000001.01000000.0000001A.sdmpDownload File
                                                                                                                                                                                                                  • Associated: 00000001.00000002.1790259151.00007FFDFAA3E000.00000002.00000001.01000000.0000001A.sdmpDownload File
                                                                                                                                                                                                                  • Associated: 00000001.00000002.1790259151.00007FFDFAA42000.00000002.00000001.01000000.0000001A.sdmpDownload File
                                                                                                                                                                                                                  • Associated: 00000001.00000002.1790259151.00007FFDFAA47000.00000002.00000001.01000000.0000001A.sdmpDownload File
                                                                                                                                                                                                                  • Associated: 00000001.00000002.1790259151.00007FFDFAA9F000.00000002.00000001.01000000.0000001A.sdmpDownload File
                                                                                                                                                                                                                  • Associated: 00000001.00000002.1790619887.00007FFDFAAA2000.00000004.00000001.01000000.0000001A.sdmpDownload File
                                                                                                                                                                                                                  • Associated: 00000001.00000002.1790657853.00007FFDFAAA4000.00000002.00000001.01000000.0000001A.sdmpDownload File
                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                  • Snapshot File: hcaresult_1_2_7ffdfa990000_dipwo1iToJ.jbxd
                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                  • API ID: ExceptionFilterPresentUnhandledmemset$CaptureContextDebuggerEntryFeatureFunctionLookupProcessorUnwindVirtual
                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                  • API String ID: 313767242-0
                                                                                                                                                                                                                  • Opcode ID: 14da1239b2aff37f2225a2b2eb9612ff8327347efab586c9ed8106aec9f5eecf
                                                                                                                                                                                                                  • Instruction ID: 2dfe41a001f4cc5c3193b8a9da1860b798d5b1370c4c9c27643e745cbcfd4971
                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 14da1239b2aff37f2225a2b2eb9612ff8327347efab586c9ed8106aec9f5eecf
                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 55315D72709B8196EB648F60E8607EE7364FB88748F84443ADA5E87A98DF3CD548C710
                                                                                                                                                                                                                  Function 00007FFDFAB29A70 Relevance: 12.4, APIs: 1, Strings: 7, Instructions: 398COMMON
                                                                                                                                                                                                                  Download Yara Rule

                                                                                                                                                                                                                  Control-flow Graph

                                                                                                                                                                                                                  • Executed
                                                                                                                                                                                                                  • Not Executed
                                                                                                                                                                                                                  control_flow_graph 791 7ffdfab29a70-7ffdfab29a9b 792 7ffdfab29a9d-7ffdfab29aa4 791->792 793 7ffdfab29aa6-7ffdfab29aac 791->793 794 7ffdfab29ac4-7ffdfab29b0f call 7ffdfaab8e10 * 2 792->794 795 7ffdfab29b10-7ffdfab29b41 793->795 796 7ffdfab29aae-7ffdfab29ab0 793->796 797 7ffdfab29b43 795->797 798 7ffdfab29b49-7ffdfab29b5b 795->798 799 7ffdfab29abd 796->799 800 7ffdfab29ab2-7ffdfab29abb 796->800 797->798 803 7ffdfab29b5d-7ffdfab29b67 call 7ffdfaab9ae0 798->803 804 7ffdfab29b69-7ffdfab29b6d 798->804 799->794 800->794 800->799 807 7ffdfab29b70-7ffdfab29b76 803->807 804->807 810 7ffdfab29f1d-7ffdfab29f2a 807->810 811 7ffdfab29b7c-7ffdfab29bba call 7ffdfab31df0 807->811 812 7ffdfab29f45-7ffdfab29f48 810->812 813 7ffdfab29f2c-7ffdfab29f33 810->813 825 7ffdfab29bc0-7ffdfab29bc5 811->825 826 7ffdfab29f1a 811->826 817 7ffdfab29f55-7ffdfab29f59 812->817 818 7ffdfab29f4a-7ffdfab29f50 call 7ffdfaab5930 812->818 815 7ffdfab29f3d-7ffdfab29f40 call 7ffdfaae3aa0 813->815 816 7ffdfab29f35-7ffdfab29f38 call 7ffdfaae3930 813->816 815->812 816->815 823 7ffdfab29fb7-7ffdfab29fc2 call 7ffdfaab6260 817->823 824 7ffdfab29f5b-7ffdfab29f5e 817->824 818->817 833 7ffdfab29fc4-7ffdfab29fcf 823->833 824->823 830 7ffdfab29f60-7ffdfab29f62 824->830 827 7ffdfab29bce-7ffdfab29bd0 825->827 828 7ffdfab29bc7-7ffdfab29bcc 825->828 826->810 831 7ffdfab29bd4-7ffdfab29be4 call 7ffdfaae6b10 827->831 828->807 830->833 842 7ffdfab29e9f-7ffdfab29ea3 831->842 843 7ffdfab29bea-7ffdfab29bed 831->843 835 7ffdfab2a040-7ffdfab2a056 833->835 836 7ffdfab29fd1-7ffdfab29fd3 833->836 838 7ffdfab2a05e-7ffdfab2a073 835->838 839 7ffdfab2a058 835->839 840 7ffdfab29fd5-7ffdfab29fe3 call 7ffdfab6f130 836->840 841 7ffdfab2a039 836->841 839->838 849 7ffdfab29fe5-7ffdfab29fe8 840->849 850 7ffdfab29fea 840->850 841->835 842->831 845 7ffdfab29ea9-7ffdfab29eb8 842->845 846 7ffdfab29bef-7ffdfab29bf2 843->846 847 7ffdfab29c10-7ffdfab29c12 843->847 851 7ffdfab29ec5-7ffdfab29eed call 7ffdfaae3aa0 845->851 852 7ffdfab29eba-7ffdfab29ec2 call 7ffdfaae3930 845->852 846->845 853 7ffdfab29bf8-7ffdfab29bfa 846->853 854 7ffdfab29c18-7ffdfab29c20 847->854 855 7ffdfab29c9b-7ffdfab29ca9 847->855 856 7ffdfab2a025-7ffdfab2a037 call 7ffdfaab9ae0 849->856 857 7ffdfab29ff1-7ffdfab29ffb 850->857 875 7ffdfab29eef 851->875 876 7ffdfab29f01-7ffdfab29f04 851->876 852->851 853->845 860 7ffdfab29c00-7ffdfab29c08 853->860 863 7ffdfab29c22-7ffdfab29c2a 854->863 864 7ffdfab29c2c 854->864 861 7ffdfab29caf 855->861 862 7ffdfab29e68-7ffdfab29e7c 855->862 856->835 857->857 865 7ffdfab29ffd-7ffdfab2a00c call 7ffdfaab56a0 857->865 860->845 869 7ffdfab29c0e 860->869 870 7ffdfab29cb0-7ffdfab29cb8 861->870 872 7ffdfab29e84-7ffdfab29e99 862->872 871 7ffdfab29c2f-7ffdfab29c49 call 7ffdfaab5dc0 863->871 864->871 891 7ffdfab2a01d-7ffdfab2a023 865->891 892 7ffdfab2a00e-7ffdfab2a018 memcpy 865->892 869->854 877 7ffdfab29d0e 870->877 878 7ffdfab29cba-7ffdfab29cc7 870->878 871->810 889 7ffdfab29c4f-7ffdfab29c54 871->889 872->842 890 7ffdfab29f76-7ffdfab29f88 872->890 884 7ffdfab29ef0-7ffdfab29eff 875->884 887 7ffdfab29f11-7ffdfab29f14 876->887 888 7ffdfab29f06-7ffdfab29f0c call 7ffdfaab5930 876->888 883 7ffdfab29d15-7ffdfab29d2a 877->883 885 7ffdfab29ccf-7ffdfab29cd9 878->885 886 7ffdfab29cc9 878->886 893 7ffdfab29d38-7ffdfab29d3b 883->893 894 7ffdfab29d2c-7ffdfab29d30 883->894 884->876 884->884 896 7ffdfab29cdb-7ffdfab29ce4 885->896 897 7ffdfab29cfa-7ffdfab29d09 call 7ffdfaab9ae0 885->897 886->885 887->807 887->826 888->887 901 7ffdfab29c88-7ffdfab29c95 889->901 902 7ffdfab29c56-7ffdfab29c59 889->902 899 7ffdfab29f92-7ffdfab29fb2 call 7ffdfaae3aa0 call 7ffdfaab9ae0 890->899 900 7ffdfab29f8a-7ffdfab29f8d call 7ffdfaae3930 890->900 891->835 891->856 892->891 905 7ffdfab29d3d-7ffdfab29d3f 893->905 906 7ffdfab29d41-7ffdfab29d48 call 7ffdfaadf460 893->906 894->893 904 7ffdfab29d32-7ffdfab29d36 894->904 896->897 898 7ffdfab29ce6-7ffdfab29ce8 896->898 897->877 898->897 907 7ffdfab29cea-7ffdfab29cf4 898->907 899->810 900->899 901->855 901->872 909 7ffdfab29c60-7ffdfab29c7e call 7ffdfaae7de0 902->909 911 7ffdfab29d4b-7ffdfab29d4e 904->911 905->911 906->911 907->883 913 7ffdfab29cf6-7ffdfab29cf8 907->913 927 7ffdfab29c80 909->927 917 7ffdfab29d50-7ffdfab29d5a 911->917 918 7ffdfab29d7e-7ffdfab29d85 911->918 913->917 919 7ffdfab29d64 call 7ffdfaab6260 917->919 920 7ffdfab29d5c-7ffdfab29d5e 917->920 923 7ffdfab29d8b-7ffdfab29d93 918->923 924 7ffdfab29e5a-7ffdfab29e62 918->924 931 7ffdfab29d69-7ffdfab29d76 919->931 920->919 925 7ffdfab29d60-7ffdfab29d62 920->925 929 7ffdfab29db3-7ffdfab29dc2 923->929 930 7ffdfab29d95-7ffdfab29dae 923->930 924->862 924->870 925->931 927->901 933 7ffdfab29dc4 929->933 934 7ffdfab29dca-7ffdfab29dd4 929->934 932 7ffdfab29e50-7ffdfab29e54 930->932 931->918 935 7ffdfab29d78 931->935 932->924 936 7ffdfab29f64-7ffdfab29f74 call 7ffdfaab6180 932->936 933->934 937 7ffdfab29df1-7ffdfab29e05 call 7ffdfaab9ae0 934->937 938 7ffdfab29dd6-7ffdfab29ddf 934->938 935->918 936->810 945 7ffdfab29e0c-7ffdfab29e2c 937->945 938->937 941 7ffdfab29de1-7ffdfab29de3 938->941 941->937 942 7ffdfab29de5-7ffdfab29def 941->942 942->945 946 7ffdfab29e2e-7ffdfab29e30 945->946 947 7ffdfab29e36 call 7ffdfaab6260 945->947 946->947 948 7ffdfab29e32-7ffdfab29e34 946->948 950 7ffdfab29e3b-7ffdfab29e48 947->950 948->950 950->932 951 7ffdfab29e4a 950->951 951->932
                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                  Strings
                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                  • Source File: 00000001.00000002.1790722712.00007FFDFAAB1000.00000020.00000001.01000000.00000017.sdmp, Offset: 00007FFDFAAB0000, based on PE: true
                                                                                                                                                                                                                  • Associated: 00000001.00000002.1790701930.00007FFDFAAB0000.00000002.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                                                                                                  • Associated: 00000001.00000002.1791797724.00007FFDFABDE000.00000002.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                                                                                                  • Associated: 00000001.00000002.1792020766.00007FFDFAC0B000.00000004.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                                                                                                  • Associated: 00000001.00000002.1792149222.00007FFDFAC10000.00000002.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                  • Snapshot File: hcaresult_1_2_7ffdfaab0000_dipwo1iToJ.jbxd
                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                  • API ID: memcpy
                                                                                                                                                                                                                  • String ID: %s at line %d of [%.10s]$831d0fb2836b71c9bc51067c49fee4b8f18047814f2ff22d817d25195cf350b0$API call with %s database connection pointer$NULL$invalid$misuse$unopened
                                                                                                                                                                                                                  • API String ID: 3510742995-863375387
                                                                                                                                                                                                                  • Opcode ID: ebcfd4d320c8a855c25bad2e79043b46f1baa289721c4d7e74e567b371a0d908
                                                                                                                                                                                                                  • Instruction ID: 00f79db9ea3454904e6b6b86bc01703f5340b93b09724bc0b016f2391332a708
                                                                                                                                                                                                                  • Opcode Fuzzy Hash: ebcfd4d320c8a855c25bad2e79043b46f1baa289721c4d7e74e567b371a0d908
                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 2402A129B08A8385FB5A9B119470BBA67D0BF84B84F9441B6DE7E076DDDF3DE4458300
                                                                                                                                                                                                                  Function 00007FFDFA9912F0 Relevance: 10.8, APIs: 7, Instructions: 347COMMON
                                                                                                                                                                                                                  Download Yara Rule

                                                                                                                                                                                                                  Control-flow Graph

                                                                                                                                                                                                                  • Executed
                                                                                                                                                                                                                  • Not Executed
                                                                                                                                                                                                                  control_flow_graph 952 7ffdfa9912f0-7ffdfa991323 call 7ffdfa9918a0 955 7ffdfa991329-7ffdfa99133a 952->955 956 7ffdfa9938ca 952->956 957 7ffdfa99374a 955->957 958 7ffdfa991340-7ffdfa991369 955->958 963 7ffdfa993753-7ffdfa993759 957->963 959 7ffdfa9938ad-7ffdfa9938b8 PyErr_NoMemory 958->959 960 7ffdfa99136f-7ffdfa991388 PyMem_Malloc 958->960 959->956 962 7ffdfa9938ba-7ffdfa9938bf 959->962 960->959 961 7ffdfa99138e-7ffdfa9913b7 960->961 967 7ffdfa9913ba 961->967 962->956 964 7ffdfa9938c1-7ffdfa9938c4 _Py_Dealloc 962->964 965 7ffdfa99375f 963->965 966 7ffdfa991660-7ffdfa99166d 963->966 964->956 971 7ffdfa993764-7ffdfa993767 965->971 966->963 968 7ffdfa991673-7ffdfa991681 966->968 969 7ffdfa9913bf-7ffdfa9913cf 967->969 968->967 970 7ffdfa9913d3-7ffdfa9913d6 969->970 972 7ffdfa9913dc-7ffdfa9913e1 970->972 973 7ffdfa99146e-7ffdfa99147e 970->973 974 7ffdfa99376d-7ffdfa993771 971->974 975 7ffdfa991410-7ffdfa99141a 971->975 972->966 976 7ffdfa9913e7-7ffdfa9913eb 972->976 981 7ffdfa991686-7ffdfa99168b 973->981 982 7ffdfa991484-7ffdfa9914c0 PyMem_Free call 7ffdfa992720 973->982 977 7ffdfa99377a-7ffdfa99377e 974->977 978 7ffdfa993773-7ffdfa993778 974->978 979 7ffdfa99144a 975->979 980 7ffdfa99141c-7ffdfa99141f 975->980 985 7ffdfa99151e 976->985 986 7ffdfa9913f1-7ffdfa9913f5 976->986 988 7ffdfa993786 977->988 989 7ffdfa993780-7ffdfa993784 977->989 987 7ffdfa993789-7ffdfa99378e 978->987 991 7ffdfa99144e-7ffdfa991469 979->991 990 7ffdfa991421-7ffdfa991424 980->990 983 7ffdfa99169d-7ffdfa9916ba PyUnicode_FromKindAndData PyMem_Free 981->983 984 7ffdfa99168d-7ffdfa991692 981->984 999 7ffdfa9916c2 983->999 984->983 993 7ffdfa991694-7ffdfa991697 _Py_Dealloc 984->993 1000 7ffdfa991528-7ffdfa99152c 985->1000 994 7ffdfa9913fb-7ffdfa99140a 986->994 995 7ffdfa9916cc 986->995 987->975 997 7ffdfa993794-7ffdfa993798 987->997 988->987 989->987 990->979 996 7ffdfa991426-7ffdfa991430 990->996 991->969 993->983 994->971 994->975 1008 7ffdfa9916d5 995->1008 1001 7ffdfa991436-7ffdfa991448 996->1001 1002 7ffdfa9914c1-7ffdfa9914da 996->1002 1003 7ffdfa99379a-7ffdfa99379f 997->1003 1004 7ffdfa9937a1-7ffdfa9937a5 997->1004 999->995 1006 7ffdfa99388e 1000->1006 1007 7ffdfa991532-7ffdfa991537 1000->1007 1001->979 1001->990 1002->991 1005 7ffdfa9914e0-7ffdfa9914e9 1002->1005 1009 7ffdfa9937b0-7ffdfa9937b5 1003->1009 1010 7ffdfa9937a7-7ffdfa9937ab 1004->1010 1011 7ffdfa9937ad 1004->1011 1005->1000 1012 7ffdfa9914eb 1005->1012 1020 7ffdfa993897 1006->1020 1013 7ffdfa9914f0-7ffdfa9914fb 1007->1013 1014 7ffdfa9916d7-7ffdfa9916da 1008->1014 1009->975 1015 7ffdfa9937bb-7ffdfa9937bf 1009->1015 1010->1009 1011->1009 1012->1013 1018 7ffdfa991539-7ffdfa991540 1013->1018 1019 7ffdfa9914fd-7ffdfa991519 1013->1019 1021 7ffdfa991649-7ffdfa99164c 1014->1021 1016 7ffdfa9937c8-7ffdfa9937cc 1015->1016 1017 7ffdfa9937c1-7ffdfa9937c6 1015->1017 1023 7ffdfa9937ce-7ffdfa9937d2 1016->1023 1024 7ffdfa9937d4 1016->1024 1022 7ffdfa9937d7-7ffdfa9937f9 1017->1022 1025 7ffdfa991545-7ffdfa991549 1018->1025 1019->969 1031 7ffdfa9938a0-7ffdfa9938a2 1020->1031 1026 7ffdfa9915c8-7ffdfa9915d0 1021->1026 1027 7ffdfa991652 1021->1027 1028 7ffdfa993879-7ffdfa993889 1022->1028 1029 7ffdfa9937fb-7ffdfa9937ff 1022->1029 1023->1022 1024->1022 1025->999 1030 7ffdfa99154f-7ffdfa991553 1025->1030 1026->1019 1027->1025 1028->970 1032 7ffdfa993808-7ffdfa99380c 1029->1032 1033 7ffdfa993801-7ffdfa993806 1029->1033 1030->1020 1034 7ffdfa991559-7ffdfa99156c call 7ffdfa991e00 1030->1034 1031->1014 1035 7ffdfa9938a8 1031->1035 1037 7ffdfa993815 1032->1037 1038 7ffdfa99380e-7ffdfa993813 1032->1038 1036 7ffdfa993819-7ffdfa99381e 1033->1036 1040 7ffdfa991572-7ffdfa991577 1034->1040 1048 7ffdfa9916df-7ffdfa9916e1 1034->1048 1035->1040 1036->1028 1043 7ffdfa993820-7ffdfa993824 1036->1043 1037->1036 1038->1036 1041 7ffdfa991579-7ffdfa99157f 1040->1041 1042 7ffdfa9915c0-7ffdfa9915c2 1040->1042 1045 7ffdfa991581-7ffdfa991584 1041->1045 1042->1008 1042->1026 1046 7ffdfa993826-7ffdfa99382b 1043->1046 1047 7ffdfa99382d-7ffdfa993831 1043->1047 1045->1042 1049 7ffdfa991586-7ffdfa99159f 1045->1049 1051 7ffdfa99383e-7ffdfa993843 1046->1051 1052 7ffdfa99383a 1047->1052 1053 7ffdfa993833-7ffdfa993838 1047->1053 1048->1026 1050 7ffdfa9916e7 1048->1050 1055 7ffdfa9915d5-7ffdfa9915ed 1049->1055 1056 7ffdfa9915a1-7ffdfa9915be 1049->1056 1050->1031 1051->1028 1054 7ffdfa993845-7ffdfa993849 1051->1054 1052->1051 1053->1051 1057 7ffdfa99384b-7ffdfa993850 1054->1057 1058 7ffdfa993852-7ffdfa993856 1054->1058 1055->1042 1059 7ffdfa9915ef-7ffdfa991613 1055->1059 1056->1042 1056->1045 1060 7ffdfa993863-7ffdfa993875 1057->1060 1061 7ffdfa993858-7ffdfa99385d 1058->1061 1062 7ffdfa99385f 1058->1062 1059->1042 1063 7ffdfa991615-7ffdfa991640 call 7ffdfa991e50 1059->1063 1060->1028 1061->1060 1062->1060 1063->1026 1066 7ffdfa991642 1063->1066 1066->1021
                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                  • Source File: 00000001.00000002.1790239989.00007FFDFA991000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FFDFA990000, based on PE: true
                                                                                                                                                                                                                  • Associated: 00000001.00000002.1790215466.00007FFDFA990000.00000002.00000001.01000000.0000001A.sdmpDownload File
                                                                                                                                                                                                                  • Associated: 00000001.00000002.1790259151.00007FFDFA995000.00000002.00000001.01000000.0000001A.sdmpDownload File
                                                                                                                                                                                                                  • Associated: 00000001.00000002.1790259151.00007FFDFA9F2000.00000002.00000001.01000000.0000001A.sdmpDownload File
                                                                                                                                                                                                                  • Associated: 00000001.00000002.1790259151.00007FFDFAA3E000.00000002.00000001.01000000.0000001A.sdmpDownload File
                                                                                                                                                                                                                  • Associated: 00000001.00000002.1790259151.00007FFDFAA42000.00000002.00000001.01000000.0000001A.sdmpDownload File
                                                                                                                                                                                                                  • Associated: 00000001.00000002.1790259151.00007FFDFAA47000.00000002.00000001.01000000.0000001A.sdmpDownload File
                                                                                                                                                                                                                  • Associated: 00000001.00000002.1790259151.00007FFDFAA9F000.00000002.00000001.01000000.0000001A.sdmpDownload File
                                                                                                                                                                                                                  • Associated: 00000001.00000002.1790619887.00007FFDFAAA2000.00000004.00000001.01000000.0000001A.sdmpDownload File
                                                                                                                                                                                                                  • Associated: 00000001.00000002.1790657853.00007FFDFAAA4000.00000002.00000001.01000000.0000001A.sdmpDownload File
                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                  • Snapshot File: hcaresult_1_2_7ffdfa990000_dipwo1iToJ.jbxd
                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                  • API ID: Mem_$MallocSubtypeType_$DeallocErr_FreeMemory
                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                  • API String ID: 4139299733-0
                                                                                                                                                                                                                  • Opcode ID: 4c1ab3a9ee10578f50e5ddcb80cbb1500edbf8f85856d8ea69ee8be7dac4cd66
                                                                                                                                                                                                                  • Instruction ID: fcbf6a4374e7575978f99a24e47b5b06cc555c59cd20e26e669dca6715e7d078
                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 4c1ab3a9ee10578f50e5ddcb80cbb1500edbf8f85856d8ea69ee8be7dac4cd66
                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 2AE1E276F1C552A1EB6C8F159064E7A23A5FF48788FA401B9DA6FC66D8DF2DE841C300
                                                                                                                                                                                                                  Function 00007FFDFAAB6948 Relevance: 9.4, APIs: 2, Strings: 4, Instructions: 441COMMON
                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                  Strings
                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                  • Source File: 00000001.00000002.1790722712.00007FFDFAAB1000.00000020.00000001.01000000.00000017.sdmp, Offset: 00007FFDFAAB0000, based on PE: true
                                                                                                                                                                                                                  • Associated: 00000001.00000002.1790701930.00007FFDFAAB0000.00000002.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                                                                                                  • Associated: 00000001.00000002.1791797724.00007FFDFABDE000.00000002.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                                                                                                  • Associated: 00000001.00000002.1792020766.00007FFDFAC0B000.00000004.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                                                                                                  • Associated: 00000001.00000002.1792149222.00007FFDFAC10000.00000002.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                  • Snapshot File: hcaresult_1_2_7ffdfaab0000_dipwo1iToJ.jbxd
                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                  • API ID:
                                                                                                                                                                                                                  • String ID: -x0$0123456789ABCDEF0123456789abcdef$VUUU$VUUU
                                                                                                                                                                                                                  • API String ID: 0-2031831958
                                                                                                                                                                                                                  • Opcode ID: 3d34d0e7b00230b3be4a4963189f5afe2a8e6f33793eb41f9f926aece0841a0b
                                                                                                                                                                                                                  • Instruction ID: bb936027e455119ccfe1399d621340f0f3a1908a357bce59ebe735d198a67243
                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 3d34d0e7b00230b3be4a4963189f5afe2a8e6f33793eb41f9f926aece0841a0b
                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 3602062270C6C685DB69CB299060ABA7BA0FF497C4F0451B6DA9E437D9DF3DE44AC700
                                                                                                                                                                                                                  Function 00007FFDFA994804 Relevance: 21.1, APIs: 7, Strings: 5, Instructions: 93COMMON
                                                                                                                                                                                                                  Download Yara Rule

                                                                                                                                                                                                                  Control-flow Graph

                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                  Strings
                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                  • Source File: 00000001.00000002.1790239989.00007FFDFA991000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FFDFA990000, based on PE: true
                                                                                                                                                                                                                  • Associated: 00000001.00000002.1790215466.00007FFDFA990000.00000002.00000001.01000000.0000001A.sdmpDownload File
                                                                                                                                                                                                                  • Associated: 00000001.00000002.1790259151.00007FFDFA995000.00000002.00000001.01000000.0000001A.sdmpDownload File
                                                                                                                                                                                                                  • Associated: 00000001.00000002.1790259151.00007FFDFA9F2000.00000002.00000001.01000000.0000001A.sdmpDownload File
                                                                                                                                                                                                                  • Associated: 00000001.00000002.1790259151.00007FFDFAA3E000.00000002.00000001.01000000.0000001A.sdmpDownload File
                                                                                                                                                                                                                  • Associated: 00000001.00000002.1790259151.00007FFDFAA42000.00000002.00000001.01000000.0000001A.sdmpDownload File
                                                                                                                                                                                                                  • Associated: 00000001.00000002.1790259151.00007FFDFAA47000.00000002.00000001.01000000.0000001A.sdmpDownload File
                                                                                                                                                                                                                  • Associated: 00000001.00000002.1790259151.00007FFDFAA9F000.00000002.00000001.01000000.0000001A.sdmpDownload File
                                                                                                                                                                                                                  • Associated: 00000001.00000002.1790619887.00007FFDFAAA2000.00000004.00000001.01000000.0000001A.sdmpDownload File
                                                                                                                                                                                                                  • Associated: 00000001.00000002.1790657853.00007FFDFAAA4000.00000002.00000001.01000000.0000001A.sdmpDownload File
                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                  • Snapshot File: hcaresult_1_2_7ffdfa990000_dipwo1iToJ.jbxd
                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                  • API ID: CompareUnicode_$DeallocStringWith
                                                                                                                                                                                                                  • String ID: NFC$NFD$NFKC$NFKD$invalid normalization form
                                                                                                                                                                                                                  • API String ID: 1004266020-3528878251
                                                                                                                                                                                                                  • Opcode ID: cf64f6b9ab75cd253386f0f7453e80a2405618faa649494653d4230b278f9e28
                                                                                                                                                                                                                  • Instruction ID: e9e541dd42809b4ca0b6a3d789bff9ed439ccdf8a2b29af5a90d395f2ff71b32
                                                                                                                                                                                                                  • Opcode Fuzzy Hash: cf64f6b9ab75cd253386f0f7453e80a2405618faa649494653d4230b278f9e28
                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 45412621B08643A5EB699B11A4B0A396365AF8DB8DFD44075CD6EC77DCDF2DE408D310
                                                                                                                                                                                                                  Function 00007FFDFA9924D0 Relevance: 21.1, APIs: 8, Strings: 4, Instructions: 81COMMON
                                                                                                                                                                                                                  Download Yara Rule

                                                                                                                                                                                                                  Control-flow Graph

                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                  Strings
                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                  • Source File: 00000001.00000002.1790239989.00007FFDFA991000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FFDFA990000, based on PE: true
                                                                                                                                                                                                                  • Associated: 00000001.00000002.1790215466.00007FFDFA990000.00000002.00000001.01000000.0000001A.sdmpDownload File
                                                                                                                                                                                                                  • Associated: 00000001.00000002.1790259151.00007FFDFA995000.00000002.00000001.01000000.0000001A.sdmpDownload File
                                                                                                                                                                                                                  • Associated: 00000001.00000002.1790259151.00007FFDFA9F2000.00000002.00000001.01000000.0000001A.sdmpDownload File
                                                                                                                                                                                                                  • Associated: 00000001.00000002.1790259151.00007FFDFAA3E000.00000002.00000001.01000000.0000001A.sdmpDownload File
                                                                                                                                                                                                                  • Associated: 00000001.00000002.1790259151.00007FFDFAA42000.00000002.00000001.01000000.0000001A.sdmpDownload File
                                                                                                                                                                                                                  • Associated: 00000001.00000002.1790259151.00007FFDFAA47000.00000002.00000001.01000000.0000001A.sdmpDownload File
                                                                                                                                                                                                                  • Associated: 00000001.00000002.1790259151.00007FFDFAA9F000.00000002.00000001.01000000.0000001A.sdmpDownload File
                                                                                                                                                                                                                  • Associated: 00000001.00000002.1790619887.00007FFDFAAA2000.00000004.00000001.01000000.0000001A.sdmpDownload File
                                                                                                                                                                                                                  • Associated: 00000001.00000002.1790657853.00007FFDFAAA4000.00000002.00000001.01000000.0000001A.sdmpDownload File
                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                  • Snapshot File: hcaresult_1_2_7ffdfa990000_dipwo1iToJ.jbxd
                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                  • API ID: Module_$DeallocObjectObject_$ConstantFromSpecStringTrackTypeType_
                                                                                                                                                                                                                  • String ID: 15.0.0$_ucnhash_CAPI$ucd_3_2_0$unidata_version
                                                                                                                                                                                                                  • API String ID: 2663085338-4141011787
                                                                                                                                                                                                                  • Opcode ID: 6b398be3fd63e60b8eeee9a963b5b24ee277b0b0407f88d061c760d12a720801
                                                                                                                                                                                                                  • Instruction ID: beba213a08e2cfadecc3d23717887f62fb0c312ff9d59f8b4b398d56c976d53c
                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 6b398be3fd63e60b8eeee9a963b5b24ee277b0b0407f88d061c760d12a720801
                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 30316325B0D603A6FB1D5F219875A792299AF4DB88FC440B4D92EC6AEDDF2DE4088301
                                                                                                                                                                                                                  Function 00007FFDFA9911B0 Relevance: 19.4, APIs: 6, Strings: 5, Instructions: 152COMMON
                                                                                                                                                                                                                  Download Yara Rule

                                                                                                                                                                                                                  Control-flow Graph

                                                                                                                                                                                                                  • Executed
                                                                                                                                                                                                                  • Not Executed
                                                                                                                                                                                                                  control_flow_graph 335 7ffdfa9911b0-7ffdfa9911d2 336 7ffdfa9912c8-7ffdfa9912ce 335->336 337 7ffdfa9911d8-7ffdfa9911ea PyUnicode_CompareWithASCIIString 335->337 340 7ffdfa9912c0-7ffdfa9912c3 336->340 341 7ffdfa9912d0-7ffdfa9912d3 336->341 338 7ffdfa993648-7ffdfa993660 call 7ffdfa994024 337->338 339 7ffdfa9911f0-7ffdfa991202 PyUnicode_CompareWithASCIIString 337->339 351 7ffdfa9912b7-7ffdfa9912bc 338->351 353 7ffdfa993666-7ffdfa993675 call 7ffdfa9912f0 338->353 343 7ffdfa991208-7ffdfa99120b 339->343 344 7ffdfa993691-7ffdfa9936a3 PyUnicode_CompareWithASCIIString 339->344 345 7ffdfa991238-7ffdfa99124c 340->345 341->340 347 7ffdfa99124d-7ffdfa991252 343->347 348 7ffdfa99120d-7ffdfa99121b 343->348 349 7ffdfa9936a5-7ffdfa9936bd call 7ffdfa994024 344->349 350 7ffdfa9936d7-7ffdfa9936e9 PyUnicode_CompareWithASCIIString 344->350 347->351 352 7ffdfa991254-7ffdfa991267 347->352 348->347 356 7ffdfa99121d-7ffdfa991225 PyType_IsSubtype 348->356 349->351 365 7ffdfa9936c3-7ffdfa9936d2 call 7ffdfa9918a0 349->365 354 7ffdfa9936eb-7ffdfa993703 call 7ffdfa994024 350->354 355 7ffdfa99372c-7ffdfa993745 PyErr_SetString 350->355 351->340 363 7ffdfa9912be 351->363 359 7ffdfa99367a 352->359 360 7ffdfa99126d-7ffdfa99127c 352->360 353->345 373 7ffdfa993715-7ffdfa993727 call 7ffdfa9918a0 354->373 374 7ffdfa993705-7ffdfa99370a 354->374 355->345 356->347 364 7ffdfa991227-7ffdfa991233 call 7ffdfa9912f0 356->364 375 7ffdfa993683-7ffdfa993686 359->375 360->351 366 7ffdfa99127e-7ffdfa991282 360->366 363->340 364->345 365->345 371 7ffdfa9912d5-7ffdfa9912da 366->371 372 7ffdfa991284-7ffdfa991288 366->372 376 7ffdfa99128f-7ffdfa99129d call 7ffdfa991e00 371->376 378 7ffdfa99128a 372->378 379 7ffdfa9912dc-7ffdfa9912e0 372->379 373->345 374->340 380 7ffdfa993710 374->380 375->364 382 7ffdfa99368c 375->382 376->375 386 7ffdfa9912a3-7ffdfa9912ac 376->386 378->376 379->376 380->363 382->344 386->364 387 7ffdfa9912b2-7ffdfa9912b5 386->387 387->351 387->366
                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                  Strings
                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                  • Source File: 00000001.00000002.1790239989.00007FFDFA991000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FFDFA990000, based on PE: true
                                                                                                                                                                                                                  • Associated: 00000001.00000002.1790215466.00007FFDFA990000.00000002.00000001.01000000.0000001A.sdmpDownload File
                                                                                                                                                                                                                  • Associated: 00000001.00000002.1790259151.00007FFDFA995000.00000002.00000001.01000000.0000001A.sdmpDownload File
                                                                                                                                                                                                                  • Associated: 00000001.00000002.1790259151.00007FFDFA9F2000.00000002.00000001.01000000.0000001A.sdmpDownload File
                                                                                                                                                                                                                  • Associated: 00000001.00000002.1790259151.00007FFDFAA3E000.00000002.00000001.01000000.0000001A.sdmpDownload File
                                                                                                                                                                                                                  • Associated: 00000001.00000002.1790259151.00007FFDFAA42000.00000002.00000001.01000000.0000001A.sdmpDownload File
                                                                                                                                                                                                                  • Associated: 00000001.00000002.1790259151.00007FFDFAA47000.00000002.00000001.01000000.0000001A.sdmpDownload File
                                                                                                                                                                                                                  • Associated: 00000001.00000002.1790259151.00007FFDFAA9F000.00000002.00000001.01000000.0000001A.sdmpDownload File
                                                                                                                                                                                                                  • Associated: 00000001.00000002.1790619887.00007FFDFAAA2000.00000004.00000001.01000000.0000001A.sdmpDownload File
                                                                                                                                                                                                                  • Associated: 00000001.00000002.1790657853.00007FFDFAAA4000.00000002.00000001.01000000.0000001A.sdmpDownload File
                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                  • Snapshot File: hcaresult_1_2_7ffdfa990000_dipwo1iToJ.jbxd
                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                  • API ID: CompareStringUnicode_With$Mem_$FreeMallocSubtypeType_
                                                                                                                                                                                                                  • String ID: NFC$NFD$NFKC$NFKD$invalid normalization form
                                                                                                                                                                                                                  • API String ID: 1723213316-3528878251
                                                                                                                                                                                                                  • Opcode ID: 7d9693cf2d06923f90061d591c3b8a3e1c636af1e984342259c0b7d751c99e14
                                                                                                                                                                                                                  • Instruction ID: 32d576ef8a95041be6d1df1877e2c6401b861b7688910244e0a0847e95f9a0f5
                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 7d9693cf2d06923f90061d591c3b8a3e1c636af1e984342259c0b7d751c99e14
                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 9E518421B0C25262FBA8AB159470E7E2295BF5EBCCFA451B5C96EC7ACDDF1CE4058300
                                                                                                                                                                                                                  Function 00007FFDFA9943F0 Relevance: 19.4, APIs: 6, Strings: 5, Instructions: 109COMMON
                                                                                                                                                                                                                  Download Yara Rule

                                                                                                                                                                                                                  Control-flow Graph

                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                  Strings
                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                  • Source File: 00000001.00000002.1790239989.00007FFDFA991000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FFDFA990000, based on PE: true
                                                                                                                                                                                                                  • Associated: 00000001.00000002.1790215466.00007FFDFA990000.00000002.00000001.01000000.0000001A.sdmpDownload File
                                                                                                                                                                                                                  • Associated: 00000001.00000002.1790259151.00007FFDFA995000.00000002.00000001.01000000.0000001A.sdmpDownload File
                                                                                                                                                                                                                  • Associated: 00000001.00000002.1790259151.00007FFDFA9F2000.00000002.00000001.01000000.0000001A.sdmpDownload File
                                                                                                                                                                                                                  • Associated: 00000001.00000002.1790259151.00007FFDFAA3E000.00000002.00000001.01000000.0000001A.sdmpDownload File
                                                                                                                                                                                                                  • Associated: 00000001.00000002.1790259151.00007FFDFAA42000.00000002.00000001.01000000.0000001A.sdmpDownload File
                                                                                                                                                                                                                  • Associated: 00000001.00000002.1790259151.00007FFDFAA47000.00000002.00000001.01000000.0000001A.sdmpDownload File
                                                                                                                                                                                                                  • Associated: 00000001.00000002.1790259151.00007FFDFAA9F000.00000002.00000001.01000000.0000001A.sdmpDownload File
                                                                                                                                                                                                                  • Associated: 00000001.00000002.1790619887.00007FFDFAAA2000.00000004.00000001.01000000.0000001A.sdmpDownload File
                                                                                                                                                                                                                  • Associated: 00000001.00000002.1790657853.00007FFDFAAA4000.00000002.00000001.01000000.0000001A.sdmpDownload File
                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                  • Snapshot File: hcaresult_1_2_7ffdfa990000_dipwo1iToJ.jbxd
                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                  • API ID: Arg_ArgumentFromStringSubtypeType_Unicode_
                                                                                                                                                                                                                  • String ID: $%04X$a unicode character$argument$decomposition
                                                                                                                                                                                                                  • API String ID: 1318908108-4056541097
                                                                                                                                                                                                                  • Opcode ID: a3cef0d0996400cfa83e251a2d781e139d471a14dd81ecf0aeeb3af5fef58597
                                                                                                                                                                                                                  • Instruction ID: 6ea2119098a3d0ba68a4f1dbad3afd815dda4fb8f5f90fc6e2518899e1189858
                                                                                                                                                                                                                  • Opcode Fuzzy Hash: a3cef0d0996400cfa83e251a2d781e139d471a14dd81ecf0aeeb3af5fef58597
                                                                                                                                                                                                                  • Instruction Fuzzy Hash: AA41C961B08682A1EB298B15D4707B923A1FF8D798FC44275D97E876C8DF3CD559C300
                                                                                                                                                                                                                  Function 00007FFDFA992740 Relevance: 16.7, APIs: 11, Instructions: 230COMMON
                                                                                                                                                                                                                  Download Yara Rule

                                                                                                                                                                                                                  Control-flow Graph

                                                                                                                                                                                                                  • Executed
                                                                                                                                                                                                                  • Not Executed
                                                                                                                                                                                                                  control_flow_graph 418 7ffdfa992740-7ffdfa992746 419 7ffdfa992748-7ffdfa99274b 418->419 420 7ffdfa992781-7ffdfa99278b 418->420 421 7ffdfa992775-7ffdfa9927b4 call 7ffdfa992e98 419->421 422 7ffdfa99274d-7ffdfa992750 419->422 423 7ffdfa9928a8-7ffdfa9928bd 420->423 441 7ffdfa9927ba-7ffdfa9927cf call 7ffdfa992d2c 421->441 442 7ffdfa992882 421->442 424 7ffdfa992768 __scrt_dllmain_crt_thread_attach 422->424 425 7ffdfa992752-7ffdfa992755 422->425 426 7ffdfa9928cc-7ffdfa9928e6 call 7ffdfa992d2c 423->426 427 7ffdfa9928bf 423->427 433 7ffdfa99276d-7ffdfa992774 424->433 429 7ffdfa992757-7ffdfa992760 425->429 430 7ffdfa992761-7ffdfa992766 call 7ffdfa992ddc 425->430 439 7ffdfa9928e8-7ffdfa99291d call 7ffdfa992e54 call 7ffdfa992cfc call 7ffdfa9931f0 call 7ffdfa993008 call 7ffdfa99302c call 7ffdfa992e84 426->439 440 7ffdfa99291f-7ffdfa992950 call 7ffdfa993068 426->440 431 7ffdfa9928c1-7ffdfa9928cb 427->431 430->433 439->431 452 7ffdfa992961-7ffdfa992967 440->452 453 7ffdfa992952-7ffdfa992958 440->453 450 7ffdfa9927d5-7ffdfa9927e6 call 7ffdfa992d9c 441->450 451 7ffdfa99289a-7ffdfa9928a7 call 7ffdfa993068 441->451 446 7ffdfa992884-7ffdfa992899 442->446 468 7ffdfa992837-7ffdfa992841 call 7ffdfa993008 450->468 469 7ffdfa9927e8-7ffdfa99280c call 7ffdfa9931b4 call 7ffdfa992cec call 7ffdfa992d10 call 7ffdfa993408 450->469 451->423 458 7ffdfa992969-7ffdfa992973 452->458 459 7ffdfa9929ae-7ffdfa9929c4 call 7ffdfa992cc8 452->459 453->452 457 7ffdfa99295a-7ffdfa99295c 453->457 464 7ffdfa992a4f-7ffdfa992a5c 457->464 465 7ffdfa992975-7ffdfa99297d 458->465 466 7ffdfa99297f-7ffdfa99298d 458->466 478 7ffdfa9929c6-7ffdfa9929c8 459->478 479 7ffdfa9929fc-7ffdfa9929fe 459->479 471 7ffdfa992993-7ffdfa9929a8 call 7ffdfa992740 465->471 466->471 482 7ffdfa992a45-7ffdfa992a4d 466->482 468->442 490 7ffdfa992843-7ffdfa99284f call 7ffdfa993058 468->490 469->468 518 7ffdfa99280e-7ffdfa992815 __scrt_dllmain_after_initialize_c 469->518 471->459 471->482 478->479 487 7ffdfa9929ca-7ffdfa9929ec call 7ffdfa992cc8 call 7ffdfa9928a8 478->487 480 7ffdfa992a05-7ffdfa992a1a call 7ffdfa992740 479->480 481 7ffdfa992a00-7ffdfa992a03 479->481 480->482 499 7ffdfa992a1c-7ffdfa992a26 480->499 481->480 481->482 482->464 487->479 513 7ffdfa9929ee-7ffdfa9929f3 487->513 507 7ffdfa992875-7ffdfa992880 490->507 508 7ffdfa992851-7ffdfa99285b call 7ffdfa992f70 490->508 504 7ffdfa992a28-7ffdfa992a2f 499->504 505 7ffdfa992a31-7ffdfa992a41 499->505 504->482 505->482 507->446 508->507 517 7ffdfa99285d-7ffdfa99286b 508->517 513->479 517->507 518->468 519 7ffdfa992817-7ffdfa992834 call 7ffdfa993402 518->519 519->468
                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                  • Source File: 00000001.00000002.1790239989.00007FFDFA991000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FFDFA990000, based on PE: true
                                                                                                                                                                                                                  • Associated: 00000001.00000002.1790215466.00007FFDFA990000.00000002.00000001.01000000.0000001A.sdmpDownload File
                                                                                                                                                                                                                  • Associated: 00000001.00000002.1790259151.00007FFDFA995000.00000002.00000001.01000000.0000001A.sdmpDownload File
                                                                                                                                                                                                                  • Associated: 00000001.00000002.1790259151.00007FFDFA9F2000.00000002.00000001.01000000.0000001A.sdmpDownload File
                                                                                                                                                                                                                  • Associated: 00000001.00000002.1790259151.00007FFDFAA3E000.00000002.00000001.01000000.0000001A.sdmpDownload File
                                                                                                                                                                                                                  • Associated: 00000001.00000002.1790259151.00007FFDFAA42000.00000002.00000001.01000000.0000001A.sdmpDownload File
                                                                                                                                                                                                                  • Associated: 00000001.00000002.1790259151.00007FFDFAA47000.00000002.00000001.01000000.0000001A.sdmpDownload File
                                                                                                                                                                                                                  • Associated: 00000001.00000002.1790259151.00007FFDFAA9F000.00000002.00000001.01000000.0000001A.sdmpDownload File
                                                                                                                                                                                                                  • Associated: 00000001.00000002.1790619887.00007FFDFAAA2000.00000004.00000001.01000000.0000001A.sdmpDownload File
                                                                                                                                                                                                                  • Associated: 00000001.00000002.1790657853.00007FFDFAAA4000.00000002.00000001.01000000.0000001A.sdmpDownload File
                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                  • Snapshot File: hcaresult_1_2_7ffdfa990000_dipwo1iToJ.jbxd
                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                  • API ID: Initialize__scrt_acquire_startup_lock__scrt_dllmain_after_initialize_c__scrt_dllmain_crt_thread_attach__scrt_initialize_crt__scrt_release_startup_lock
                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                  • API String ID: 349153199-0
                                                                                                                                                                                                                  • Opcode ID: ba629577db6599826cb9fb44cf19b8c727e776d8ab71a1e0ce86f35fe3adb7c8
                                                                                                                                                                                                                  • Instruction ID: 9f7575c6f4b3ce995ea4bfd5010fd311c85b30c5d9933aa7d43a4c0ed2e0e502
                                                                                                                                                                                                                  • Opcode Fuzzy Hash: ba629577db6599826cb9fb44cf19b8c727e776d8ab71a1e0ce86f35fe3adb7c8
                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 52819521F0C643A6F75C9B669461ABA22D4AF4D788FD440B9D92CC77DEDE3CE8498300
                                                                                                                                                                                                                  Function 00007FFDFA9945B4 Relevance: 15.8, APIs: 5, Strings: 4, Instructions: 59COMMON
                                                                                                                                                                                                                  Download Yara Rule

                                                                                                                                                                                                                  Control-flow Graph

                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                  Strings
                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                  • Source File: 00000001.00000002.1790239989.00007FFDFA991000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FFDFA990000, based on PE: true
                                                                                                                                                                                                                  • Associated: 00000001.00000002.1790215466.00007FFDFA990000.00000002.00000001.01000000.0000001A.sdmpDownload File
                                                                                                                                                                                                                  • Associated: 00000001.00000002.1790259151.00007FFDFA995000.00000002.00000001.01000000.0000001A.sdmpDownload File
                                                                                                                                                                                                                  • Associated: 00000001.00000002.1790259151.00007FFDFA9F2000.00000002.00000001.01000000.0000001A.sdmpDownload File
                                                                                                                                                                                                                  • Associated: 00000001.00000002.1790259151.00007FFDFAA3E000.00000002.00000001.01000000.0000001A.sdmpDownload File
                                                                                                                                                                                                                  • Associated: 00000001.00000002.1790259151.00007FFDFAA42000.00000002.00000001.01000000.0000001A.sdmpDownload File
                                                                                                                                                                                                                  • Associated: 00000001.00000002.1790259151.00007FFDFAA47000.00000002.00000001.01000000.0000001A.sdmpDownload File
                                                                                                                                                                                                                  • Associated: 00000001.00000002.1790259151.00007FFDFAA9F000.00000002.00000001.01000000.0000001A.sdmpDownload File
                                                                                                                                                                                                                  • Associated: 00000001.00000002.1790619887.00007FFDFAAA2000.00000004.00000001.01000000.0000001A.sdmpDownload File
                                                                                                                                                                                                                  • Associated: 00000001.00000002.1790657853.00007FFDFAAA4000.00000002.00000001.01000000.0000001A.sdmpDownload File
                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                  • Snapshot File: hcaresult_1_2_7ffdfa990000_dipwo1iToJ.jbxd
                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                  • API ID: Arg_$ArgumentCheckDigitErr_FromLongLong_PositionalStringUnicode_
                                                                                                                                                                                                                  • String ID: a unicode character$argument 1$digit$not a digit
                                                                                                                                                                                                                  • API String ID: 4245020737-4278345224
                                                                                                                                                                                                                  • Opcode ID: 63a51ef3fb3b37699c37d838a5587871e01ab33192532b5daca7f17e7c8dcafb
                                                                                                                                                                                                                  • Instruction ID: d55c76436e2100ade0e6ccc9f0d5d3ed2d91d8e571913bc535b4dd7a2ead898c
                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 63a51ef3fb3b37699c37d838a5587871e01ab33192532b5daca7f17e7c8dcafb
                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 1E214F71B08643A5EF298B65E4649792364EB9CB8CFC440B1C92EC76ECDF2CE449C700
                                                                                                                                                                                                                  Function 00007FFDFAB04AB0 Relevance: 15.3, APIs: 1, Strings: 9, Instructions: 325COMMON
                                                                                                                                                                                                                  Download Yara Rule

                                                                                                                                                                                                                  Control-flow Graph

                                                                                                                                                                                                                  • Executed
                                                                                                                                                                                                                  • Not Executed
                                                                                                                                                                                                                  control_flow_graph 540 7ffdfab04ab0-7ffdfab04ac8 541 7ffdfab04fc4-7ffdfab04fcb 540->541 542 7ffdfab04ace-7ffdfab04af7 540->542 543 7ffdfab04b1b-7ffdfab04b5b 542->543 544 7ffdfab04af9-7ffdfab04b06 542->544 546 7ffdfab04b62-7ffdfab04b66 543->546 547 7ffdfab04b5d-7ffdfab04b60 543->547 544->543 545 7ffdfab04b08 544->545 548 7ffdfab04b10-7ffdfab04b19 545->548 550 7ffdfab04b68-7ffdfab04b6b 546->550 551 7ffdfab04b6d-7ffdfab04b74 546->551 549 7ffdfab04b8d-7ffdfab04bb9 call 7ffdfab0d6a0 call 7ffdfab0cc30 547->549 548->543 548->548 560 7ffdfab04fa3-7ffdfab04fbf 549->560 561 7ffdfab04bbf-7ffdfab04bc6 549->561 550->549 552 7ffdfab04b7b-7ffdfab04b7d 551->552 553 7ffdfab04b76-7ffdfab04b79 551->553 555 7ffdfab04b84-7ffdfab04b88 552->555 556 7ffdfab04b7f-7ffdfab04b82 552->556 553->549 555->549 556->549 560->541 562 7ffdfab04bdc-7ffdfab04be1 561->562 563 7ffdfab04bc8-7ffdfab04bd7 call 7ffdfaab9d60 561->563 565 7ffdfab04bf7-7ffdfab04bf9 562->565 566 7ffdfab04be3-7ffdfab04bf2 call 7ffdfaab9d60 562->566 563->560 569 7ffdfab04db0-7ffdfab04db2 565->569 570 7ffdfab04bff-7ffdfab04c02 565->570 566->560 572 7ffdfab04db4 569->572 573 7ffdfab04dd2-7ffdfab04dec 569->573 574 7ffdfab04c14-7ffdfab04c1d 570->574 575 7ffdfab04c04-7ffdfab04c10 570->575 576 7ffdfab04dbb-7ffdfab04dcd call 7ffdfab0d4d0 572->576 579 7ffdfab04e88-7ffdfab04e8f 573->579 580 7ffdfab04df2-7ffdfab04e04 call 7ffdfaab5dc0 573->580 577 7ffdfab04c49-7ffdfab04c4e 574->577 578 7ffdfab04c1f-7ffdfab04c24 574->578 575->574 576->573 582 7ffdfab04c61-7ffdfab04c64 577->582 583 7ffdfab04c50-7ffdfab04c53 577->583 578->577 587 7ffdfab04c26-7ffdfab04c29 578->587 584 7ffdfab04ebb-7ffdfab04ec1 579->584 585 7ffdfab04e91-7ffdfab04e98 579->585 580->579 598 7ffdfab04e0a-7ffdfab04e35 memcpy 580->598 582->573 592 7ffdfab04c6a-7ffdfab04c94 call 7ffdfaadf570 582->592 583->592 593 7ffdfab04c55-7ffdfab04c5c 583->593 590 7ffdfab04ecc-7ffdfab04ed4 584->590 591 7ffdfab04ec3-7ffdfab04eca 584->591 594 7ffdfab04e9a-7ffdfab04ea1 585->594 595 7ffdfab04ea7-7ffdfab04eb5 call 7ffdfaadfd60 585->595 587->577 588 7ffdfab04c2b-7ffdfab04c44 call 7ffdfab0d4d0 587->588 588->577 599 7ffdfab04edc-7ffdfab04f4e call 7ffdfaae00b0 call 7ffdfaae1900 call 7ffdfaae0200 * 2 call 7ffdfaae00b0 590->599 591->599 592->560 610 7ffdfab04c9a-7ffdfab04ca5 592->610 593->576 594->595 601 7ffdfab04ea3 594->601 595->560 595->584 603 7ffdfab04e58-7ffdfab04e83 call 7ffdfab0d4d0 call 7ffdfaab5930 598->603 604 7ffdfab04e37-7ffdfab04e3e 598->604 647 7ffdfab04f63-7ffdfab04f78 call 7ffdfab04540 599->647 648 7ffdfab04f50-7ffdfab04f56 599->648 601->595 603->579 607 7ffdfab04e40-7ffdfab04e45 604->607 611 7ffdfab04e47-7ffdfab04e4b 607->611 612 7ffdfab04e4d-7ffdfab04e56 607->612 615 7ffdfab04ca7-7ffdfab04cd0 call 7ffdfab0d4d0 610->615 616 7ffdfab04cd6-7ffdfab04cdf 610->616 611->603 611->612 612->603 612->607 615->573 615->616 620 7ffdfab04ce7-7ffdfab04cea call 7ffdfaade5e0 616->620 621 7ffdfab04ce1-7ffdfab04ce5 616->621 625 7ffdfab04cef-7ffdfab04cf6 620->625 621->620 621->625 626 7ffdfab04cf8-7ffdfab04cff 625->626 627 7ffdfab04d53-7ffdfab04d5a 625->627 629 7ffdfab04d01-7ffdfab04d08 626->629 630 7ffdfab04d3f-7ffdfab04d47 626->630 631 7ffdfab04d5c-7ffdfab04d66 627->631 632 7ffdfab04da5-7ffdfab04dae 627->632 634 7ffdfab04d0a-7ffdfab04d1b 629->634 635 7ffdfab04d20-7ffdfab04d27 629->635 630->627 636 7ffdfab04d49-7ffdfab04d51 call 7ffdfaab58c0 630->636 637 7ffdfab04d68 631->637 638 7ffdfab04d6e-7ffdfab04d9b 631->638 632->573 634->573 635->630 640 7ffdfab04d29-7ffdfab04d3a 635->640 636->573 637->638 638->573 653 7ffdfab04d9d-7ffdfab04da3 638->653 640->573 654 7ffdfab04f7a-7ffdfab04f86 647->654 655 7ffdfab04f8e-7ffdfab04f9e call 7ffdfab0d4d0 647->655 648->647 649 7ffdfab04f58-7ffdfab04f60 648->649 649->647 653->573 654->560 656 7ffdfab04f88-7ffdfab04f8c 654->656 655->560 656->560 656->655
                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                  Strings
                                                                                                                                                                                                                  • Cannot add a column with non-constant default, xrefs: 00007FFDFAB04CAF
                                                                                                                                                                                                                  • Cannot add a REFERENCES column with non-NULL default value, xrefs: 00007FFDFAB04C33
                                                                                                                                                                                                                  • Cannot add a NOT NULL column with default value NULL, xrefs: 00007FFDFAB04C55
                                                                                                                                                                                                                  • Cannot add a PRIMARY KEY column, xrefs: 00007FFDFAB04BC8
                                                                                                                                                                                                                  • UPDATE "%w".sqlite_master SET sql = printf('%%.%ds, ',sql) || %Q || substr(sql,1+length(printf('%%.%ds',sql))) WHERE type = 'table' AND name = %Q, xrefs: 00007FFDFAB04E5C
                                                                                                                                                                                                                  • cannot add a STORED column, xrefs: 00007FFDFAB04DB4
                                                                                                                                                                                                                  • SELECT CASE WHEN quick_check GLOB 'CHECK*' THEN raise(ABORT,'CHECK constraint failed') ELSE raise(ABORT,'NOT NULL constraint failed') END FROM pragma_quick_check(%Q,%Q) WHERE quick_check GLOB 'CHECK*' OR quick_check GLOB 'NULL*', xrefs: 00007FFDFAB04F91
                                                                                                                                                                                                                  • SELECT raise(ABORT,%Q) FROM "%w"."%w", xrefs: 00007FFDFAB04C3D, 00007FFDFAB04CB9, 00007FFDFAB04DC3
                                                                                                                                                                                                                  • Cannot add a UNIQUE column, xrefs: 00007FFDFAB04BE3
                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                  • Source File: 00000001.00000002.1790722712.00007FFDFAAB1000.00000020.00000001.01000000.00000017.sdmp, Offset: 00007FFDFAAB0000, based on PE: true
                                                                                                                                                                                                                  • Associated: 00000001.00000002.1790701930.00007FFDFAAB0000.00000002.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                                                                                                  • Associated: 00000001.00000002.1791797724.00007FFDFABDE000.00000002.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                                                                                                  • Associated: 00000001.00000002.1792020766.00007FFDFAC0B000.00000004.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                                                                                                  • Associated: 00000001.00000002.1792149222.00007FFDFAC10000.00000002.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                  • Snapshot File: hcaresult_1_2_7ffdfaab0000_dipwo1iToJ.jbxd
                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                  • API ID: memcpy
                                                                                                                                                                                                                  • String ID: Cannot add a NOT NULL column with default value NULL$Cannot add a PRIMARY KEY column$Cannot add a REFERENCES column with non-NULL default value$Cannot add a UNIQUE column$Cannot add a column with non-constant default$SELECT CASE WHEN quick_check GLOB 'CHECK*' THEN raise(ABORT,'CHECK constraint failed') ELSE raise(ABORT,'NOT NULL constraint failed') END FROM pragma_quick_check(%Q,%Q) WHERE quick_check GLOB 'CHECK*' OR quick_check GLOB 'NULL*'$SELECT raise(ABORT,%Q) FROM "%w"."%w"$UPDATE "%w".sqlite_master SET sql = printf('%%.%ds, ',sql) || %Q || substr(sql,1+length(printf('%%.%ds',sql))) WHERE type = 'table' AND name = %Q$cannot add a STORED column
                                                                                                                                                                                                                  • API String ID: 3510742995-3865411212
                                                                                                                                                                                                                  • Opcode ID: 6145248e7b04b0619e5a8fcb440d0d42fd806850070c73835079349b62662a14
                                                                                                                                                                                                                  • Instruction ID: 3191a7c8aeace2f61cef0745ca32e1677939db9e5404d3cfb8333eaa35f6c712
                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 6145248e7b04b0619e5a8fcb440d0d42fd806850070c73835079349b62662a14
                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 90E1AD61B09B9285EB688B15A164BB933A5FB44BC4F8881B5CEAD077DDDF3CE855C300
                                                                                                                                                                                                                  Function 00007FFDFA9916F0 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 122COMMON
                                                                                                                                                                                                                  Download Yara Rule

                                                                                                                                                                                                                  Control-flow Graph

                                                                                                                                                                                                                  • Executed
                                                                                                                                                                                                                  • Not Executed
                                                                                                                                                                                                                  control_flow_graph 1067 7ffdfa9916f0-7ffdfa99170d 1068 7ffdfa9938d2-7ffdfa9938f0 _PyArg_BadArgument 1067->1068 1069 7ffdfa991713-7ffdfa991718 1067->1069 1073 7ffdfa9938f8 1068->1073 1069->1068 1070 7ffdfa99171e-7ffdfa99173e 1069->1070 1071 7ffdfa99184c-7ffdfa99184e 1070->1071 1072 7ffdfa991744-7ffdfa99174b 1070->1072 1074 7ffdfa991850-7ffdfa991863 1071->1074 1075 7ffdfa991892-7ffdfa991896 1071->1075 1076 7ffdfa99186e-7ffdfa991870 1072->1076 1077 7ffdfa991751-7ffdfa991753 1072->1077 1078 7ffdfa993901 1073->1078 1079 7ffdfa991866-7ffdfa991869 1074->1079 1075->1079 1080 7ffdfa991898-7ffdfa99189c 1076->1080 1081 7ffdfa991872-7ffdfa991883 1076->1081 1077->1073 1082 7ffdfa991759-7ffdfa99176e 1077->1082 1085 7ffdfa993909-7ffdfa99390d 1078->1085 1083 7ffdfa991771-7ffdfa99177e 1079->1083 1084 7ffdfa991887-7ffdfa991889 1080->1084 1081->1084 1082->1083 1083->1078 1086 7ffdfa991784-7ffdfa9917b6 1083->1086 1084->1083 1087 7ffdfa9917b8-7ffdfa9917c6 1086->1087 1088 7ffdfa991824-7ffdfa99184b PyUnicode_FromString 1086->1088 1087->1088 1090 7ffdfa9917c8-7ffdfa9917d0 PyType_IsSubtype 1087->1090 1090->1088 1091 7ffdfa9917d2-7ffdfa9917e0 1090->1091 1091->1085 1092 7ffdfa9917e6-7ffdfa9917ec 1091->1092 1093 7ffdfa99180e-7ffdfa991822 1092->1093 1094 7ffdfa9917ee-7ffdfa991805 1092->1094 1093->1088 1095 7ffdfa99188e-7ffdfa991890 1093->1095 1094->1093 1095->1088
                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                  Strings
                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                  • Source File: 00000001.00000002.1790239989.00007FFDFA991000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FFDFA990000, based on PE: true
                                                                                                                                                                                                                  • Associated: 00000001.00000002.1790215466.00007FFDFA990000.00000002.00000001.01000000.0000001A.sdmpDownload File
                                                                                                                                                                                                                  • Associated: 00000001.00000002.1790259151.00007FFDFA995000.00000002.00000001.01000000.0000001A.sdmpDownload File
                                                                                                                                                                                                                  • Associated: 00000001.00000002.1790259151.00007FFDFA9F2000.00000002.00000001.01000000.0000001A.sdmpDownload File
                                                                                                                                                                                                                  • Associated: 00000001.00000002.1790259151.00007FFDFAA3E000.00000002.00000001.01000000.0000001A.sdmpDownload File
                                                                                                                                                                                                                  • Associated: 00000001.00000002.1790259151.00007FFDFAA42000.00000002.00000001.01000000.0000001A.sdmpDownload File
                                                                                                                                                                                                                  • Associated: 00000001.00000002.1790259151.00007FFDFAA47000.00000002.00000001.01000000.0000001A.sdmpDownload File
                                                                                                                                                                                                                  • Associated: 00000001.00000002.1790259151.00007FFDFAA9F000.00000002.00000001.01000000.0000001A.sdmpDownload File
                                                                                                                                                                                                                  • Associated: 00000001.00000002.1790619887.00007FFDFAAA2000.00000004.00000001.01000000.0000001A.sdmpDownload File
                                                                                                                                                                                                                  • Associated: 00000001.00000002.1790657853.00007FFDFAAA4000.00000002.00000001.01000000.0000001A.sdmpDownload File
                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                  • Snapshot File: hcaresult_1_2_7ffdfa990000_dipwo1iToJ.jbxd
                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                  • API ID: Arg_ArgumentFromStringSubtypeType_Unicode_
                                                                                                                                                                                                                  • String ID: a unicode character$argument$category
                                                                                                                                                                                                                  • API String ID: 1318908108-2068800536
                                                                                                                                                                                                                  • Opcode ID: 75ddb3696b46489ca6549d465876fca1f165cfd7b87c949410c65a543f1dc5fb
                                                                                                                                                                                                                  • Instruction ID: 085b22d9d41dd734e83d84fd49114e0f74a225cc7100149c7a93adbaa2a29e7d
                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 75ddb3696b46489ca6549d465876fca1f165cfd7b87c949410c65a543f1dc5fb
                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 3751D962B1864662EB5D8B06D470AB963A1FF48B88F940075DA6FCB7D8DF2CE855D300
                                                                                                                                                                                                                  Function 00007FFDFA991000 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 106COMMON
                                                                                                                                                                                                                  Download Yara Rule

                                                                                                                                                                                                                  Control-flow Graph

                                                                                                                                                                                                                  • Executed
                                                                                                                                                                                                                  • Not Executed
                                                                                                                                                                                                                  control_flow_graph 1096 7ffdfa991000-7ffdfa991018 1097 7ffdfa993598-7ffdfa9935b6 _PyArg_BadArgument 1096->1097 1098 7ffdfa99101e-7ffdfa991023 1096->1098 1100 7ffdfa9935bd 1097->1100 1098->1097 1099 7ffdfa991029-7ffdfa991049 1098->1099 1101 7ffdfa99104f-7ffdfa991056 1099->1101 1102 7ffdfa991113-7ffdfa991115 1099->1102 1105 7ffdfa9935c6-7ffdfa9935c8 1100->1105 1101->1105 1106 7ffdfa99105c-7ffdfa99105e 1101->1106 1103 7ffdfa991135-7ffdfa991139 1102->1103 1104 7ffdfa991117-7ffdfa99112a 1102->1104 1109 7ffdfa99112d-7ffdfa991130 1103->1109 1104->1109 1107 7ffdfa9935ca-7ffdfa9935e0 1105->1107 1108 7ffdfa9935e2 1105->1108 1106->1100 1110 7ffdfa991064-7ffdfa991079 1106->1110 1112 7ffdfa9935e6-7ffdfa9935e8 1107->1112 1108->1112 1111 7ffdfa99107c-7ffdfa991089 1109->1111 1110->1111 1113 7ffdfa9935ed 1111->1113 1114 7ffdfa99108f-7ffdfa9910c1 1111->1114 1112->1111 1115 7ffdfa9910f0-7ffdfa991112 PyUnicode_FromString 1114->1115 1116 7ffdfa9910c3-7ffdfa9910d1 1114->1116 1116->1115 1117 7ffdfa9910d3-7ffdfa9910db PyType_IsSubtype 1116->1117 1117->1115 1118 7ffdfa9910dd-7ffdfa9910e6 1117->1118 1120 7ffdfa9910e8-7ffdfa9910ee 1118->1120 1121 7ffdfa99113b-7ffdfa99113d 1118->1121 1120->1115 1122 7ffdfa99113f-7ffdfa991141 1120->1122 1121->1115 1122->1115
                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                  Strings
                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                  • Source File: 00000001.00000002.1790239989.00007FFDFA991000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FFDFA990000, based on PE: true
                                                                                                                                                                                                                  • Associated: 00000001.00000002.1790215466.00007FFDFA990000.00000002.00000001.01000000.0000001A.sdmpDownload File
                                                                                                                                                                                                                  • Associated: 00000001.00000002.1790259151.00007FFDFA995000.00000002.00000001.01000000.0000001A.sdmpDownload File
                                                                                                                                                                                                                  • Associated: 00000001.00000002.1790259151.00007FFDFA9F2000.00000002.00000001.01000000.0000001A.sdmpDownload File
                                                                                                                                                                                                                  • Associated: 00000001.00000002.1790259151.00007FFDFAA3E000.00000002.00000001.01000000.0000001A.sdmpDownload File
                                                                                                                                                                                                                  • Associated: 00000001.00000002.1790259151.00007FFDFAA42000.00000002.00000001.01000000.0000001A.sdmpDownload File
                                                                                                                                                                                                                  • Associated: 00000001.00000002.1790259151.00007FFDFAA47000.00000002.00000001.01000000.0000001A.sdmpDownload File
                                                                                                                                                                                                                  • Associated: 00000001.00000002.1790259151.00007FFDFAA9F000.00000002.00000001.01000000.0000001A.sdmpDownload File
                                                                                                                                                                                                                  • Associated: 00000001.00000002.1790619887.00007FFDFAAA2000.00000004.00000001.01000000.0000001A.sdmpDownload File
                                                                                                                                                                                                                  • Associated: 00000001.00000002.1790657853.00007FFDFAAA4000.00000002.00000001.01000000.0000001A.sdmpDownload File
                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                  • Snapshot File: hcaresult_1_2_7ffdfa990000_dipwo1iToJ.jbxd
                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                  • API ID: Arg_ArgumentFromStringSubtypeType_Unicode_
                                                                                                                                                                                                                  • String ID: a unicode character$argument$bidirectional
                                                                                                                                                                                                                  • API String ID: 1318908108-2110215792
                                                                                                                                                                                                                  • Opcode ID: 6f7a0223ee0090118d1ffdd6d95c782b73d4ddee4bbf01c7b704a6e76ba36895
                                                                                                                                                                                                                  • Instruction ID: 9e245fa9d0ebf974f6e4c019eec2f8b9f2b39a721fa3f7680717be1515acc6a5
                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 6f7a0223ee0090118d1ffdd6d95c782b73d4ddee4bbf01c7b704a6e76ba36895
                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 3241A265B1858262FBAC8B15C4B5B792361FF48798FD41079DA6FC36D8CF2DD8958300
                                                                                                                                                                                                                  Function 00007FFDFA991150 Relevance: 10.5, APIs: 2, Strings: 4, Instructions: 40COMMON
                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                  • _PyArg_CheckPositional.PYTHON312 ref: 00007FFDFA993607
                                                                                                                                                                                                                  • _PyArg_BadArgument.PYTHON312 ref: 00007FFDFA99363A
                                                                                                                                                                                                                    • Part of subcall function 00007FFDFA9911B0: PyUnicode_CompareWithASCIIString.PYTHON312 ref: 00007FFDFA9911E2
                                                                                                                                                                                                                    • Part of subcall function 00007FFDFA9911B0: PyUnicode_CompareWithASCIIString.PYTHON312 ref: 00007FFDFA9911FA
                                                                                                                                                                                                                    • Part of subcall function 00007FFDFA9911B0: PyType_IsSubtype.PYTHON312 ref: 00007FFDFA99121D
                                                                                                                                                                                                                  Strings
                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                  • Source File: 00000001.00000002.1790239989.00007FFDFA991000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FFDFA990000, based on PE: true
                                                                                                                                                                                                                  • Associated: 00000001.00000002.1790215466.00007FFDFA990000.00000002.00000001.01000000.0000001A.sdmpDownload File
                                                                                                                                                                                                                  • Associated: 00000001.00000002.1790259151.00007FFDFA995000.00000002.00000001.01000000.0000001A.sdmpDownload File
                                                                                                                                                                                                                  • Associated: 00000001.00000002.1790259151.00007FFDFA9F2000.00000002.00000001.01000000.0000001A.sdmpDownload File
                                                                                                                                                                                                                  • Associated: 00000001.00000002.1790259151.00007FFDFAA3E000.00000002.00000001.01000000.0000001A.sdmpDownload File
                                                                                                                                                                                                                  • Associated: 00000001.00000002.1790259151.00007FFDFAA42000.00000002.00000001.01000000.0000001A.sdmpDownload File
                                                                                                                                                                                                                  • Associated: 00000001.00000002.1790259151.00007FFDFAA47000.00000002.00000001.01000000.0000001A.sdmpDownload File
                                                                                                                                                                                                                  • Associated: 00000001.00000002.1790259151.00007FFDFAA9F000.00000002.00000001.01000000.0000001A.sdmpDownload File
                                                                                                                                                                                                                  • Associated: 00000001.00000002.1790619887.00007FFDFAAA2000.00000004.00000001.01000000.0000001A.sdmpDownload File
                                                                                                                                                                                                                  • Associated: 00000001.00000002.1790657853.00007FFDFAAA4000.00000002.00000001.01000000.0000001A.sdmpDownload File
                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                  • Snapshot File: hcaresult_1_2_7ffdfa990000_dipwo1iToJ.jbxd
                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                  • API ID: Arg_CompareStringUnicode_With$ArgumentCheckPositionalSubtypeType_
                                                                                                                                                                                                                  • String ID: argument 1$argument 2$normalize$str
                                                                                                                                                                                                                  • API String ID: 4101545800-1320425463
                                                                                                                                                                                                                  • Opcode ID: 2dbf24b9019d36270aeee854f5eb720b9aec5d3fd397e623ab08701816bde558
                                                                                                                                                                                                                  • Instruction ID: 469ab091ce4425b4194197d3526d0406cccbdcc53dd07648e7f012fbbc7ec5e1
                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 2dbf24b9019d36270aeee854f5eb720b9aec5d3fd397e623ab08701816bde558
                                                                                                                                                                                                                  • Instruction Fuzzy Hash: B9115A60B08642A4EB588F16E4A1EBA2350BF09FC8FD48076D92D877DCDF2CD549C740
                                                                                                                                                                                                                  Function 00007FFDFA994764 Relevance: 10.5, APIs: 2, Strings: 4, Instructions: 39COMMON
                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                  Strings
                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                  • Source File: 00000001.00000002.1790239989.00007FFDFA991000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FFDFA990000, based on PE: true
                                                                                                                                                                                                                  • Associated: 00000001.00000002.1790215466.00007FFDFA990000.00000002.00000001.01000000.0000001A.sdmpDownload File
                                                                                                                                                                                                                  • Associated: 00000001.00000002.1790259151.00007FFDFA995000.00000002.00000001.01000000.0000001A.sdmpDownload File
                                                                                                                                                                                                                  • Associated: 00000001.00000002.1790259151.00007FFDFA9F2000.00000002.00000001.01000000.0000001A.sdmpDownload File
                                                                                                                                                                                                                  • Associated: 00000001.00000002.1790259151.00007FFDFAA3E000.00000002.00000001.01000000.0000001A.sdmpDownload File
                                                                                                                                                                                                                  • Associated: 00000001.00000002.1790259151.00007FFDFAA42000.00000002.00000001.01000000.0000001A.sdmpDownload File
                                                                                                                                                                                                                  • Associated: 00000001.00000002.1790259151.00007FFDFAA47000.00000002.00000001.01000000.0000001A.sdmpDownload File
                                                                                                                                                                                                                  • Associated: 00000001.00000002.1790259151.00007FFDFAA9F000.00000002.00000001.01000000.0000001A.sdmpDownload File
                                                                                                                                                                                                                  • Associated: 00000001.00000002.1790619887.00007FFDFAAA2000.00000004.00000001.01000000.0000001A.sdmpDownload File
                                                                                                                                                                                                                  • Associated: 00000001.00000002.1790657853.00007FFDFAAA4000.00000002.00000001.01000000.0000001A.sdmpDownload File
                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                  • Snapshot File: hcaresult_1_2_7ffdfa990000_dipwo1iToJ.jbxd
                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                  • API ID: Arg_$ArgumentCheckPositional
                                                                                                                                                                                                                  • String ID: argument 1$argument 2$is_normalized$str
                                                                                                                                                                                                                  • API String ID: 3876575403-184702317
                                                                                                                                                                                                                  • Opcode ID: a144f24e6de5b7cccd567b51e7b194ed070cb538066fb7292dbf1d4aae94f326
                                                                                                                                                                                                                  • Instruction ID: 47877c697a82d1056138eaadb761b6e51d1d4752e7144382586f687758aaff80
                                                                                                                                                                                                                  • Opcode Fuzzy Hash: a144f24e6de5b7cccd567b51e7b194ed070cb538066fb7292dbf1d4aae94f326
                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 0E016564B0868AA4EB588B12E4A0EB92350EB49FC8FD484B2D92D877DCDF2CD549C300
                                                                                                                                                                                                                  Function 00007FFDFAAEBBA4 Relevance: 9.4, APIs: 1, Strings: 5, Instructions: 354COMMON
                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                  Strings
                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                  • Source File: 00000001.00000002.1790722712.00007FFDFAAB1000.00000020.00000001.01000000.00000017.sdmp, Offset: 00007FFDFAAB0000, based on PE: true
                                                                                                                                                                                                                  • Associated: 00000001.00000002.1790701930.00007FFDFAAB0000.00000002.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                                                                                                  • Associated: 00000001.00000002.1791797724.00007FFDFABDE000.00000002.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                                                                                                  • Associated: 00000001.00000002.1792020766.00007FFDFAC0B000.00000004.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                                                                                                  • Associated: 00000001.00000002.1792149222.00007FFDFAC10000.00000002.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                  • Snapshot File: hcaresult_1_2_7ffdfaab0000_dipwo1iToJ.jbxd
                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                  • API ID: memcpy
                                                                                                                                                                                                                  • String ID: 831d0fb2836b71c9bc51067c49fee4b8f18047814f2ff22d817d25195cf350b0$cannot open savepoint - SQL statements in progress$cannot release savepoint - SQL statements in progress$no such savepoint: %s$statement aborts at %d: [%s] %s
                                                                                                                                                                                                                  • API String ID: 3510742995-2526444651
                                                                                                                                                                                                                  • Opcode ID: c9d744cff9dc738ede1e2a386e920d6a7cb1c7740c9bf092cb904dc52b4c502a
                                                                                                                                                                                                                  • Instruction ID: 83af84e35f060d2b2b919a921dffa423fa828a436be69683e1eee2aace3132b5
                                                                                                                                                                                                                  • Opcode Fuzzy Hash: c9d744cff9dc738ede1e2a386e920d6a7cb1c7740c9bf092cb904dc52b4c502a
                                                                                                                                                                                                                  • Instruction Fuzzy Hash: A0F1C032B0869685EB68CB26D0A4A7E77A4FB45B84F014071DE6D477D9DF3DE84ACB00
                                                                                                                                                                                                                  Function 00007FFDFAAE6B10 Relevance: 9.3, APIs: 1, Strings: 5, Instructions: 278COMMON
                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                  Strings
                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                  • Source File: 00000001.00000002.1790722712.00007FFDFAAB1000.00000020.00000001.01000000.00000017.sdmp, Offset: 00007FFDFAAB0000, based on PE: true
                                                                                                                                                                                                                  • Associated: 00000001.00000002.1790701930.00007FFDFAAB0000.00000002.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                                                                                                  • Associated: 00000001.00000002.1791797724.00007FFDFABDE000.00000002.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                                                                                                  • Associated: 00000001.00000002.1792020766.00007FFDFAC0B000.00000004.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                                                                                                  • Associated: 00000001.00000002.1792149222.00007FFDFAC10000.00000002.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                  • Snapshot File: hcaresult_1_2_7ffdfaab0000_dipwo1iToJ.jbxd
                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                  • API ID: memcpy
                                                                                                                                                                                                                  • String ID: %s at line %d of [%.10s]$831d0fb2836b71c9bc51067c49fee4b8f18047814f2ff22d817d25195cf350b0$API called with NULL prepared statement$API called with finalized prepared statement$misuse
                                                                                                                                                                                                                  • API String ID: 3510742995-774319783
                                                                                                                                                                                                                  • Opcode ID: c1f2e72d02041f634680d4dfe94196d23bd266405e708ce222b3484ffe9b10a2
                                                                                                                                                                                                                  • Instruction ID: 9bd640ffffb9585e9bf70af9f11f27dc575a665d7f71242267a22291c02d17e1
                                                                                                                                                                                                                  • Opcode Fuzzy Hash: c1f2e72d02041f634680d4dfe94196d23bd266405e708ce222b3484ffe9b10a2
                                                                                                                                                                                                                  • Instruction Fuzzy Hash: DDE19122F09BC581E7198B29C6547BC7360FBA9B48F14A675DF9C13296EF38E5D98300
                                                                                                                                                                                                                  Function 00007FFDFA994690 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 57COMMON
                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                  Strings
                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                  • Source File: 00000001.00000002.1790239989.00007FFDFA991000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FFDFA990000, based on PE: true
                                                                                                                                                                                                                  • Associated: 00000001.00000002.1790215466.00007FFDFA990000.00000002.00000001.01000000.0000001A.sdmpDownload File
                                                                                                                                                                                                                  • Associated: 00000001.00000002.1790259151.00007FFDFA995000.00000002.00000001.01000000.0000001A.sdmpDownload File
                                                                                                                                                                                                                  • Associated: 00000001.00000002.1790259151.00007FFDFA9F2000.00000002.00000001.01000000.0000001A.sdmpDownload File
                                                                                                                                                                                                                  • Associated: 00000001.00000002.1790259151.00007FFDFAA3E000.00000002.00000001.01000000.0000001A.sdmpDownload File
                                                                                                                                                                                                                  • Associated: 00000001.00000002.1790259151.00007FFDFAA42000.00000002.00000001.01000000.0000001A.sdmpDownload File
                                                                                                                                                                                                                  • Associated: 00000001.00000002.1790259151.00007FFDFAA47000.00000002.00000001.01000000.0000001A.sdmpDownload File
                                                                                                                                                                                                                  • Associated: 00000001.00000002.1790259151.00007FFDFAA9F000.00000002.00000001.01000000.0000001A.sdmpDownload File
                                                                                                                                                                                                                  • Associated: 00000001.00000002.1790619887.00007FFDFAAA2000.00000004.00000001.01000000.0000001A.sdmpDownload File
                                                                                                                                                                                                                  • Associated: 00000001.00000002.1790657853.00007FFDFAAA4000.00000002.00000001.01000000.0000001A.sdmpDownload File
                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                  • Snapshot File: hcaresult_1_2_7ffdfa990000_dipwo1iToJ.jbxd
                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                  • API ID: Arg_ArgumentSubtypeType_
                                                                                                                                                                                                                  • String ID: a unicode character$argument$east_asian_width
                                                                                                                                                                                                                  • API String ID: 1522575347-3913127203
                                                                                                                                                                                                                  • Opcode ID: f8fe7d2390cefcda47379d0bc21b213a30bcd05f20e1989e4018474eb32f17be
                                                                                                                                                                                                                  • Instruction ID: 23974e79e31051b3134d504bcecfbd40843bd7fdd54ac3d68cbd2b61b0f64ba2
                                                                                                                                                                                                                  • Opcode Fuzzy Hash: f8fe7d2390cefcda47379d0bc21b213a30bcd05f20e1989e4018474eb32f17be
                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 6421C565F0CA82A1EB1D8B11947097D27A1EB8DB88FC480B1D62E836DCDF2CD595C740
                                                                                                                                                                                                                  Function 00007FFDFA994C58 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 53COMMON
                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                  Strings
                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                  • Source File: 00000001.00000002.1790239989.00007FFDFA991000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FFDFA990000, based on PE: true
                                                                                                                                                                                                                  • Associated: 00000001.00000002.1790215466.00007FFDFA990000.00000002.00000001.01000000.0000001A.sdmpDownload File
                                                                                                                                                                                                                  • Associated: 00000001.00000002.1790259151.00007FFDFA995000.00000002.00000001.01000000.0000001A.sdmpDownload File
                                                                                                                                                                                                                  • Associated: 00000001.00000002.1790259151.00007FFDFA9F2000.00000002.00000001.01000000.0000001A.sdmpDownload File
                                                                                                                                                                                                                  • Associated: 00000001.00000002.1790259151.00007FFDFAA3E000.00000002.00000001.01000000.0000001A.sdmpDownload File
                                                                                                                                                                                                                  • Associated: 00000001.00000002.1790259151.00007FFDFAA42000.00000002.00000001.01000000.0000001A.sdmpDownload File
                                                                                                                                                                                                                  • Associated: 00000001.00000002.1790259151.00007FFDFAA47000.00000002.00000001.01000000.0000001A.sdmpDownload File
                                                                                                                                                                                                                  • Associated: 00000001.00000002.1790259151.00007FFDFAA9F000.00000002.00000001.01000000.0000001A.sdmpDownload File
                                                                                                                                                                                                                  • Associated: 00000001.00000002.1790619887.00007FFDFAAA2000.00000004.00000001.01000000.0000001A.sdmpDownload File
                                                                                                                                                                                                                  • Associated: 00000001.00000002.1790657853.00007FFDFAAA4000.00000002.00000001.01000000.0000001A.sdmpDownload File
                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                  • Snapshot File: hcaresult_1_2_7ffdfa990000_dipwo1iToJ.jbxd
                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                  • API ID: DoubleErr_Float_FromNumericStringSubtypeType_Unicode_
                                                                                                                                                                                                                  • String ID: not a numeric character
                                                                                                                                                                                                                  • API String ID: 1034370217-2058156748
                                                                                                                                                                                                                  • Opcode ID: 7ac3b2fdf3478d2374b08fe415c3a12b63c61252479e25d1cab849eb02e47f53
                                                                                                                                                                                                                  • Instruction ID: e2ab323e57c8665bb2ac4427c65f17cc189c7135d8b1f30ab5a35928fe1cba94
                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 7ac3b2fdf3478d2374b08fe415c3a12b63c61252479e25d1cab849eb02e47f53
                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 77214821F18942A9E75E8B25D4709797294AF8CB8CF9480B1C93ED66DCEF2CE445C740
                                                                                                                                                                                                                  Function 00007FFDFA994354 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 48COMMON
                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                  Strings
                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                  • Source File: 00000001.00000002.1790239989.00007FFDFA991000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FFDFA990000, based on PE: true
                                                                                                                                                                                                                  • Associated: 00000001.00000002.1790215466.00007FFDFA990000.00000002.00000001.01000000.0000001A.sdmpDownload File
                                                                                                                                                                                                                  • Associated: 00000001.00000002.1790259151.00007FFDFA995000.00000002.00000001.01000000.0000001A.sdmpDownload File
                                                                                                                                                                                                                  • Associated: 00000001.00000002.1790259151.00007FFDFA9F2000.00000002.00000001.01000000.0000001A.sdmpDownload File
                                                                                                                                                                                                                  • Associated: 00000001.00000002.1790259151.00007FFDFAA3E000.00000002.00000001.01000000.0000001A.sdmpDownload File
                                                                                                                                                                                                                  • Associated: 00000001.00000002.1790259151.00007FFDFAA42000.00000002.00000001.01000000.0000001A.sdmpDownload File
                                                                                                                                                                                                                  • Associated: 00000001.00000002.1790259151.00007FFDFAA47000.00000002.00000001.01000000.0000001A.sdmpDownload File
                                                                                                                                                                                                                  • Associated: 00000001.00000002.1790259151.00007FFDFAA9F000.00000002.00000001.01000000.0000001A.sdmpDownload File
                                                                                                                                                                                                                  • Associated: 00000001.00000002.1790619887.00007FFDFAAA2000.00000004.00000001.01000000.0000001A.sdmpDownload File
                                                                                                                                                                                                                  • Associated: 00000001.00000002.1790657853.00007FFDFAAA4000.00000002.00000001.01000000.0000001A.sdmpDownload File
                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                  • Snapshot File: hcaresult_1_2_7ffdfa990000_dipwo1iToJ.jbxd
                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                  • API ID: DecimalDigitErr_FromLongLong_StringSubtypeType_Unicode_
                                                                                                                                                                                                                  • String ID: not a decimal
                                                                                                                                                                                                                  • API String ID: 3750391552-3590249192
                                                                                                                                                                                                                  • Opcode ID: babd95680f3a021cdbe90a8980b0a1372c723c98da362c4ed99ce49efb4cea9f
                                                                                                                                                                                                                  • Instruction ID: 27225e001389b67dab779b459e81962898eb3d31d4131d2c8021c7d502917326
                                                                                                                                                                                                                  • Opcode Fuzzy Hash: babd95680f3a021cdbe90a8980b0a1372c723c98da362c4ed99ce49efb4cea9f
                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 0A118921B18542A2EB1D9B35D57553D2395AF8CB8CF844470C96EC76D8DF2CE854C300
                                                                                                                                                                                                                  Function 00007FFDFA994A64 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 46COMMON
                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                  Strings
                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                  • Source File: 00000001.00000002.1790239989.00007FFDFA991000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FFDFA990000, based on PE: true
                                                                                                                                                                                                                  • Associated: 00000001.00000002.1790215466.00007FFDFA990000.00000002.00000001.01000000.0000001A.sdmpDownload File
                                                                                                                                                                                                                  • Associated: 00000001.00000002.1790259151.00007FFDFA995000.00000002.00000001.01000000.0000001A.sdmpDownload File
                                                                                                                                                                                                                  • Associated: 00000001.00000002.1790259151.00007FFDFA9F2000.00000002.00000001.01000000.0000001A.sdmpDownload File
                                                                                                                                                                                                                  • Associated: 00000001.00000002.1790259151.00007FFDFAA3E000.00000002.00000001.01000000.0000001A.sdmpDownload File
                                                                                                                                                                                                                  • Associated: 00000001.00000002.1790259151.00007FFDFAA42000.00000002.00000001.01000000.0000001A.sdmpDownload File
                                                                                                                                                                                                                  • Associated: 00000001.00000002.1790259151.00007FFDFAA47000.00000002.00000001.01000000.0000001A.sdmpDownload File
                                                                                                                                                                                                                  • Associated: 00000001.00000002.1790259151.00007FFDFAA9F000.00000002.00000001.01000000.0000001A.sdmpDownload File
                                                                                                                                                                                                                  • Associated: 00000001.00000002.1790619887.00007FFDFAAA2000.00000004.00000001.01000000.0000001A.sdmpDownload File
                                                                                                                                                                                                                  • Associated: 00000001.00000002.1790657853.00007FFDFAAA4000.00000002.00000001.01000000.0000001A.sdmpDownload File
                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                  • Snapshot File: hcaresult_1_2_7ffdfa990000_dipwo1iToJ.jbxd
                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                  • API ID: Arg_$ArgumentCheckPositional
                                                                                                                                                                                                                  • String ID: a unicode character$argument 1$name
                                                                                                                                                                                                                  • API String ID: 3876575403-4190364640
                                                                                                                                                                                                                  • Opcode ID: 788619a113f5b482446816568c8a6ce6929a34ab923ea752a318f2ec33933934
                                                                                                                                                                                                                  • Instruction ID: 5fc2e56081311acc216506c79001e623a2c26be43e7c1ae4a9f817478b2d993e
                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 788619a113f5b482446816568c8a6ce6929a34ab923ea752a318f2ec33933934
                                                                                                                                                                                                                  • Instruction Fuzzy Hash: C0118631B08642A5DB589F52E4519A97360FB8CBC8F984076DB2D8779DCF3CE595C700
                                                                                                                                                                                                                  Function 00007FFDFA9942A0 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 46COMMON
                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                  Strings
                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                  • Source File: 00000001.00000002.1790239989.00007FFDFA991000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FFDFA990000, based on PE: true
                                                                                                                                                                                                                  • Associated: 00000001.00000002.1790215466.00007FFDFA990000.00000002.00000001.01000000.0000001A.sdmpDownload File
                                                                                                                                                                                                                  • Associated: 00000001.00000002.1790259151.00007FFDFA995000.00000002.00000001.01000000.0000001A.sdmpDownload File
                                                                                                                                                                                                                  • Associated: 00000001.00000002.1790259151.00007FFDFA9F2000.00000002.00000001.01000000.0000001A.sdmpDownload File
                                                                                                                                                                                                                  • Associated: 00000001.00000002.1790259151.00007FFDFAA3E000.00000002.00000001.01000000.0000001A.sdmpDownload File
                                                                                                                                                                                                                  • Associated: 00000001.00000002.1790259151.00007FFDFAA42000.00000002.00000001.01000000.0000001A.sdmpDownload File
                                                                                                                                                                                                                  • Associated: 00000001.00000002.1790259151.00007FFDFAA47000.00000002.00000001.01000000.0000001A.sdmpDownload File
                                                                                                                                                                                                                  • Associated: 00000001.00000002.1790259151.00007FFDFAA9F000.00000002.00000001.01000000.0000001A.sdmpDownload File
                                                                                                                                                                                                                  • Associated: 00000001.00000002.1790619887.00007FFDFAAA2000.00000004.00000001.01000000.0000001A.sdmpDownload File
                                                                                                                                                                                                                  • Associated: 00000001.00000002.1790657853.00007FFDFAAA4000.00000002.00000001.01000000.0000001A.sdmpDownload File
                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                  • Snapshot File: hcaresult_1_2_7ffdfa990000_dipwo1iToJ.jbxd
                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                  • API ID: Arg_$ArgumentCheckPositional
                                                                                                                                                                                                                  • String ID: a unicode character$argument 1$decimal
                                                                                                                                                                                                                  • API String ID: 3876575403-2474051849
                                                                                                                                                                                                                  • Opcode ID: 1e4fff75323d13296d4f9873b31303b2eb894daa88b12eee96b04a04f0936518
                                                                                                                                                                                                                  • Instruction ID: 59709fff1c1aab12176d27fb75844f296243026fb494c7d32b6b9a2c3c8462ad
                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 1e4fff75323d13296d4f9873b31303b2eb894daa88b12eee96b04a04f0936518
                                                                                                                                                                                                                  • Instruction Fuzzy Hash: A811B631B18652A5DB58DF52E5519AD7364FB88B88FC84072DA2D8379DCF3CD585C700
                                                                                                                                                                                                                  Function 00007FFDFA994BA4 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 46COMMON
                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                  Strings
                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                  • Source File: 00000001.00000002.1790239989.00007FFDFA991000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FFDFA990000, based on PE: true
                                                                                                                                                                                                                  • Associated: 00000001.00000002.1790215466.00007FFDFA990000.00000002.00000001.01000000.0000001A.sdmpDownload File
                                                                                                                                                                                                                  • Associated: 00000001.00000002.1790259151.00007FFDFA995000.00000002.00000001.01000000.0000001A.sdmpDownload File
                                                                                                                                                                                                                  • Associated: 00000001.00000002.1790259151.00007FFDFA9F2000.00000002.00000001.01000000.0000001A.sdmpDownload File
                                                                                                                                                                                                                  • Associated: 00000001.00000002.1790259151.00007FFDFAA3E000.00000002.00000001.01000000.0000001A.sdmpDownload File
                                                                                                                                                                                                                  • Associated: 00000001.00000002.1790259151.00007FFDFAA42000.00000002.00000001.01000000.0000001A.sdmpDownload File
                                                                                                                                                                                                                  • Associated: 00000001.00000002.1790259151.00007FFDFAA47000.00000002.00000001.01000000.0000001A.sdmpDownload File
                                                                                                                                                                                                                  • Associated: 00000001.00000002.1790259151.00007FFDFAA9F000.00000002.00000001.01000000.0000001A.sdmpDownload File
                                                                                                                                                                                                                  • Associated: 00000001.00000002.1790619887.00007FFDFAAA2000.00000004.00000001.01000000.0000001A.sdmpDownload File
                                                                                                                                                                                                                  • Associated: 00000001.00000002.1790657853.00007FFDFAAA4000.00000002.00000001.01000000.0000001A.sdmpDownload File
                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                  • Snapshot File: hcaresult_1_2_7ffdfa990000_dipwo1iToJ.jbxd
                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                  • API ID: Arg_$ArgumentCheckPositional
                                                                                                                                                                                                                  • String ID: a unicode character$argument 1$numeric
                                                                                                                                                                                                                  • API String ID: 3876575403-2385192657
                                                                                                                                                                                                                  • Opcode ID: bbdd109889d573d2d770b99f749a56ec45e44fab925d66d6427c2491f45a32cb
                                                                                                                                                                                                                  • Instruction ID: 719a18f2965c1399069ce6cf3d9315ed2a6bb554ff81682274db70872e2949ae
                                                                                                                                                                                                                  • Opcode Fuzzy Hash: bbdd109889d573d2d770b99f749a56ec45e44fab925d66d6427c2491f45a32cb
                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 32118631B08A52A5DB589F52E4519E97360FB8CBC8F984072DA2D8379DDF3CE599C700
                                                                                                                                                                                                                  Function 00007FFDFA994970 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 35COMMON
                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                  Strings
                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                  • Source File: 00000001.00000002.1790239989.00007FFDFA991000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FFDFA990000, based on PE: true
                                                                                                                                                                                                                  • Associated: 00000001.00000002.1790215466.00007FFDFA990000.00000002.00000001.01000000.0000001A.sdmpDownload File
                                                                                                                                                                                                                  • Associated: 00000001.00000002.1790259151.00007FFDFA995000.00000002.00000001.01000000.0000001A.sdmpDownload File
                                                                                                                                                                                                                  • Associated: 00000001.00000002.1790259151.00007FFDFA9F2000.00000002.00000001.01000000.0000001A.sdmpDownload File
                                                                                                                                                                                                                  • Associated: 00000001.00000002.1790259151.00007FFDFAA3E000.00000002.00000001.01000000.0000001A.sdmpDownload File
                                                                                                                                                                                                                  • Associated: 00000001.00000002.1790259151.00007FFDFAA42000.00000002.00000001.01000000.0000001A.sdmpDownload File
                                                                                                                                                                                                                  • Associated: 00000001.00000002.1790259151.00007FFDFAA47000.00000002.00000001.01000000.0000001A.sdmpDownload File
                                                                                                                                                                                                                  • Associated: 00000001.00000002.1790259151.00007FFDFAA9F000.00000002.00000001.01000000.0000001A.sdmpDownload File
                                                                                                                                                                                                                  • Associated: 00000001.00000002.1790619887.00007FFDFAAA2000.00000004.00000001.01000000.0000001A.sdmpDownload File
                                                                                                                                                                                                                  • Associated: 00000001.00000002.1790657853.00007FFDFAAA4000.00000002.00000001.01000000.0000001A.sdmpDownload File
                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                  • Snapshot File: hcaresult_1_2_7ffdfa990000_dipwo1iToJ.jbxd
                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                  • API ID: Arg_ArgumentErr_Occurred
                                                                                                                                                                                                                  • String ID: a unicode character$argument$mirrored
                                                                                                                                                                                                                  • API String ID: 3979797681-4001128513
                                                                                                                                                                                                                  • Opcode ID: 450df9025a0dac1254f35d1cfdfe59c877f6086a6bdfc57fc8ee28b17aa84801
                                                                                                                                                                                                                  • Instruction ID: cff5a692ca282c043eff092c8ea46b8aac95efc57c4c8e7013e47b7f0ba23bc7
                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 450df9025a0dac1254f35d1cfdfe59c877f6086a6bdfc57fc8ee28b17aa84801
                                                                                                                                                                                                                  • Instruction Fuzzy Hash: A901B520F08A42A2EB1C8B2598709B92290FF8CB5CFC082B1D56DC32DDCE2CD595C300
                                                                                                                                                                                                                  Function 00007FFDFA9941B4 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 35COMMON
                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                  Strings
                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                  • Source File: 00000001.00000002.1790239989.00007FFDFA991000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FFDFA990000, based on PE: true
                                                                                                                                                                                                                  • Associated: 00000001.00000002.1790215466.00007FFDFA990000.00000002.00000001.01000000.0000001A.sdmpDownload File
                                                                                                                                                                                                                  • Associated: 00000001.00000002.1790259151.00007FFDFA995000.00000002.00000001.01000000.0000001A.sdmpDownload File
                                                                                                                                                                                                                  • Associated: 00000001.00000002.1790259151.00007FFDFA9F2000.00000002.00000001.01000000.0000001A.sdmpDownload File
                                                                                                                                                                                                                  • Associated: 00000001.00000002.1790259151.00007FFDFAA3E000.00000002.00000001.01000000.0000001A.sdmpDownload File
                                                                                                                                                                                                                  • Associated: 00000001.00000002.1790259151.00007FFDFAA42000.00000002.00000001.01000000.0000001A.sdmpDownload File
                                                                                                                                                                                                                  • Associated: 00000001.00000002.1790259151.00007FFDFAA47000.00000002.00000001.01000000.0000001A.sdmpDownload File
                                                                                                                                                                                                                  • Associated: 00000001.00000002.1790259151.00007FFDFAA9F000.00000002.00000001.01000000.0000001A.sdmpDownload File
                                                                                                                                                                                                                  • Associated: 00000001.00000002.1790619887.00007FFDFAAA2000.00000004.00000001.01000000.0000001A.sdmpDownload File
                                                                                                                                                                                                                  • Associated: 00000001.00000002.1790657853.00007FFDFAAA4000.00000002.00000001.01000000.0000001A.sdmpDownload File
                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                  • Snapshot File: hcaresult_1_2_7ffdfa990000_dipwo1iToJ.jbxd
                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                  • API ID: Arg_ArgumentErr_Occurred
                                                                                                                                                                                                                  • String ID: a unicode character$argument$combining
                                                                                                                                                                                                                  • API String ID: 3979797681-4202047184
                                                                                                                                                                                                                  • Opcode ID: 23a79bd7f21a28e7400453b17a2d46dedd5221c58aaec7069aa9642920e7cd67
                                                                                                                                                                                                                  • Instruction ID: 581b5b514f03b4108751be0e575d21a9df1cf57e8471f51823c687d3f15b6ca4
                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 23a79bd7f21a28e7400453b17a2d46dedd5221c58aaec7069aa9642920e7cd67
                                                                                                                                                                                                                  • Instruction Fuzzy Hash: A2019E24F08642A1EB2C8B61A8709BD22A0FF9D75CFC006B5C52DC32CCDE2CE598C710
                                                                                                                                                                                                                  Function 00007FFDFA992630 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 31COMMON
                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                  Strings
                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                  • Source File: 00000001.00000002.1790239989.00007FFDFA991000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FFDFA990000, based on PE: true
                                                                                                                                                                                                                  • Associated: 00000001.00000002.1790215466.00007FFDFA990000.00000002.00000001.01000000.0000001A.sdmpDownload File
                                                                                                                                                                                                                  • Associated: 00000001.00000002.1790259151.00007FFDFA995000.00000002.00000001.01000000.0000001A.sdmpDownload File
                                                                                                                                                                                                                  • Associated: 00000001.00000002.1790259151.00007FFDFA9F2000.00000002.00000001.01000000.0000001A.sdmpDownload File
                                                                                                                                                                                                                  • Associated: 00000001.00000002.1790259151.00007FFDFAA3E000.00000002.00000001.01000000.0000001A.sdmpDownload File
                                                                                                                                                                                                                  • Associated: 00000001.00000002.1790259151.00007FFDFAA42000.00000002.00000001.01000000.0000001A.sdmpDownload File
                                                                                                                                                                                                                  • Associated: 00000001.00000002.1790259151.00007FFDFAA47000.00000002.00000001.01000000.0000001A.sdmpDownload File
                                                                                                                                                                                                                  • Associated: 00000001.00000002.1790259151.00007FFDFAA9F000.00000002.00000001.01000000.0000001A.sdmpDownload File
                                                                                                                                                                                                                  • Associated: 00000001.00000002.1790619887.00007FFDFAAA2000.00000004.00000001.01000000.0000001A.sdmpDownload File
                                                                                                                                                                                                                  • Associated: 00000001.00000002.1790657853.00007FFDFAAA4000.00000002.00000001.01000000.0000001A.sdmpDownload File
                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                  • Snapshot File: hcaresult_1_2_7ffdfa990000_dipwo1iToJ.jbxd
                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                  • API ID: Mem_$Capsule_Err_FreeMallocMemory
                                                                                                                                                                                                                  • String ID: unicodedata._ucnhash_CAPI
                                                                                                                                                                                                                  • API String ID: 3673501854-3989975041
                                                                                                                                                                                                                  • Opcode ID: 89b48c636968bcc96ff5c1323bcf06e5fb317347bf56e69214e0fa8ba2ac5adf
                                                                                                                                                                                                                  • Instruction ID: 3c6473db594e42c2fc08e21c88d0700ccfbfaed2465757146215adb96ec88f2d
                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 89b48c636968bcc96ff5c1323bcf06e5fb317347bf56e69214e0fa8ba2ac5adf
                                                                                                                                                                                                                  • Instruction Fuzzy Hash: D7F01D21B09B46B5FF195B51A46487A63A8BF1C789FC81476C96E867ECEF3CE0488300
                                                                                                                                                                                                                  Function 00007FFDFAB4AB30 Relevance: 7.9, APIs: 1, Strings: 4, Instructions: 381COMMON
                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                  Strings
                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                  • Source File: 00000001.00000002.1790722712.00007FFDFAAB1000.00000020.00000001.01000000.00000017.sdmp, Offset: 00007FFDFAAB0000, based on PE: true
                                                                                                                                                                                                                  • Associated: 00000001.00000002.1790701930.00007FFDFAAB0000.00000002.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                                                                                                  • Associated: 00000001.00000002.1791797724.00007FFDFABDE000.00000002.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                                                                                                  • Associated: 00000001.00000002.1792020766.00007FFDFAC0B000.00000004.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                                                                                                  • Associated: 00000001.00000002.1792149222.00007FFDFAC10000.00000002.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                  • Snapshot File: hcaresult_1_2_7ffdfaab0000_dipwo1iToJ.jbxd
                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                  • API ID: memcpy
                                                                                                                                                                                                                  • String ID: hidden$vtable constructor called recursively: %s$vtable constructor did not declare schema: %s$vtable constructor failed: %s
                                                                                                                                                                                                                  • API String ID: 3510742995-1299490920
                                                                                                                                                                                                                  • Opcode ID: 2623641340c733b794af5866e5bcb4bdb6316ec65f5e7f2dcf12a73dcdb92bb2
                                                                                                                                                                                                                  • Instruction ID: 02c88d46f5424e8872825ecd2db5d1f5a36fbe8bff5236b0b2f9723c823101ac
                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 2623641340c733b794af5866e5bcb4bdb6316ec65f5e7f2dcf12a73dcdb92bb2
                                                                                                                                                                                                                  • Instruction Fuzzy Hash: A1F11B22B08B8281EB598F11D060B7A77A0FB44B94F9482BADE6E477D9DF3CE545C300
                                                                                                                                                                                                                  Function 00007FFDFAAD5C10 Relevance: 7.8, APIs: 2, Strings: 3, Instructions: 311COMMON
                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                  Strings
                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                  • Source File: 00000001.00000002.1790722712.00007FFDFAAB1000.00000020.00000001.01000000.00000017.sdmp, Offset: 00007FFDFAAB0000, based on PE: true
                                                                                                                                                                                                                  • Associated: 00000001.00000002.1790701930.00007FFDFAAB0000.00000002.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                                                                                                  • Associated: 00000001.00000002.1791797724.00007FFDFABDE000.00000002.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                                                                                                  • Associated: 00000001.00000002.1792020766.00007FFDFAC0B000.00000004.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                                                                                                  • Associated: 00000001.00000002.1792149222.00007FFDFAC10000.00000002.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                  • Snapshot File: hcaresult_1_2_7ffdfaab0000_dipwo1iToJ.jbxd
                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                  • API ID: memset
                                                                                                                                                                                                                  • String ID: %s at line %d of [%.10s]$831d0fb2836b71c9bc51067c49fee4b8f18047814f2ff22d817d25195cf350b0$database corruption
                                                                                                                                                                                                                  • API String ID: 2221118986-3764764234
                                                                                                                                                                                                                  • Opcode ID: ba5d2802316911a7491cadce116daa97ccd6123211c9d747203731b79c4598ca
                                                                                                                                                                                                                  • Instruction ID: 940e13d9475137233c59498f06e4a72c050a83a452329e2ee4b38d57f48cf52c
                                                                                                                                                                                                                  • Opcode Fuzzy Hash: ba5d2802316911a7491cadce116daa97ccd6123211c9d747203731b79c4598ca
                                                                                                                                                                                                                  • Instruction Fuzzy Hash: D4D1C17370878686D768DF26D024AA977A8FB88B84F558076DF9D47798DF38D44AC300
                                                                                                                                                                                                                  Function 00007FFDFAAD6C20 Relevance: 7.7, APIs: 2, Strings: 3, Instructions: 191COMMON
                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                  Strings
                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                  • Source File: 00000001.00000002.1790722712.00007FFDFAAB1000.00000020.00000001.01000000.00000017.sdmp, Offset: 00007FFDFAAB0000, based on PE: true
                                                                                                                                                                                                                  • Associated: 00000001.00000002.1790701930.00007FFDFAAB0000.00000002.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                                                                                                  • Associated: 00000001.00000002.1791797724.00007FFDFABDE000.00000002.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                                                                                                  • Associated: 00000001.00000002.1792020766.00007FFDFAC0B000.00000004.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                                                                                                  • Associated: 00000001.00000002.1792149222.00007FFDFAC10000.00000002.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                  • Snapshot File: hcaresult_1_2_7ffdfaab0000_dipwo1iToJ.jbxd
                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                  • API ID:
                                                                                                                                                                                                                  • String ID: %s at line %d of [%.10s]$831d0fb2836b71c9bc51067c49fee4b8f18047814f2ff22d817d25195cf350b0$database corruption
                                                                                                                                                                                                                  • API String ID: 0-3764764234
                                                                                                                                                                                                                  • Opcode ID: d7bbc113d95c405dff7a55cfefdeaeb98036685461038bdd9bca21eed79271cd
                                                                                                                                                                                                                  • Instruction ID: 6aa08f3202f88e7391578588758413b916747d8b98c3fcef648c6093d2f3b878
                                                                                                                                                                                                                  • Opcode Fuzzy Hash: d7bbc113d95c405dff7a55cfefdeaeb98036685461038bdd9bca21eed79271cd
                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 8B81E622B086D15ADB28CB25D1A0ABD7BA0FB40B84F044176DBED476C9DF3CE45AC750
                                                                                                                                                                                                                  Function 00007FFDFA991EF0 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 42COMMON
                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                  • PyErr_SetString.PYTHON312(?,?,?,?,?,00007FFDFA991EDC), ref: 00007FFDFA993B31
                                                                                                                                                                                                                    • Part of subcall function 00007FFDFA991FD0: strncmp.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FFDFA992008
                                                                                                                                                                                                                    • Part of subcall function 00007FFDFA991FD0: strncmp.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FFDFA992026
                                                                                                                                                                                                                  • PyErr_Format.PYTHON312 ref: 00007FFDFA991F53
                                                                                                                                                                                                                  Strings
                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                  • Source File: 00000001.00000002.1790239989.00007FFDFA991000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FFDFA990000, based on PE: true
                                                                                                                                                                                                                  • Associated: 00000001.00000002.1790215466.00007FFDFA990000.00000002.00000001.01000000.0000001A.sdmpDownload File
                                                                                                                                                                                                                  • Associated: 00000001.00000002.1790259151.00007FFDFA995000.00000002.00000001.01000000.0000001A.sdmpDownload File
                                                                                                                                                                                                                  • Associated: 00000001.00000002.1790259151.00007FFDFA9F2000.00000002.00000001.01000000.0000001A.sdmpDownload File
                                                                                                                                                                                                                  • Associated: 00000001.00000002.1790259151.00007FFDFAA3E000.00000002.00000001.01000000.0000001A.sdmpDownload File
                                                                                                                                                                                                                  • Associated: 00000001.00000002.1790259151.00007FFDFAA42000.00000002.00000001.01000000.0000001A.sdmpDownload File
                                                                                                                                                                                                                  • Associated: 00000001.00000002.1790259151.00007FFDFAA47000.00000002.00000001.01000000.0000001A.sdmpDownload File
                                                                                                                                                                                                                  • Associated: 00000001.00000002.1790259151.00007FFDFAA9F000.00000002.00000001.01000000.0000001A.sdmpDownload File
                                                                                                                                                                                                                  • Associated: 00000001.00000002.1790619887.00007FFDFAAA2000.00000004.00000001.01000000.0000001A.sdmpDownload File
                                                                                                                                                                                                                  • Associated: 00000001.00000002.1790657853.00007FFDFAAA4000.00000002.00000001.01000000.0000001A.sdmpDownload File
                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                  • Snapshot File: hcaresult_1_2_7ffdfa990000_dipwo1iToJ.jbxd
                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                  • API ID: Err_strncmp$FormatString
                                                                                                                                                                                                                  • String ID: name too long$undefined character name '%s'
                                                                                                                                                                                                                  • API String ID: 3882229318-4056717002
                                                                                                                                                                                                                  • Opcode ID: fe9fd46e1f898954a40cc435b1b2d9c6909a3f099c322250393b7a83e7c0a7cf
                                                                                                                                                                                                                  • Instruction ID: 5197ca66aa711716471240d363486a7e95d731969f83f1395681d761b43b7675
                                                                                                                                                                                                                  • Opcode Fuzzy Hash: fe9fd46e1f898954a40cc435b1b2d9c6909a3f099c322250393b7a83e7c0a7cf
                                                                                                                                                                                                                  • Instruction Fuzzy Hash: D1112176B1894BE1EB448F14E4A4AB96364FB9C78CFD00471CA2E862E8DF6DD54AC700
                                                                                                                                                                                                                  Function 00007FFDFAABDBB0 Relevance: 6.2, APIs: 1, Strings: 3, Instructions: 249COMMON
                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                  Strings
                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                  • Source File: 00000001.00000002.1790722712.00007FFDFAAB1000.00000020.00000001.01000000.00000017.sdmp, Offset: 00007FFDFAAB0000, based on PE: true
                                                                                                                                                                                                                  • Associated: 00000001.00000002.1790701930.00007FFDFAAB0000.00000002.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                                                                                                  • Associated: 00000001.00000002.1791797724.00007FFDFABDE000.00000002.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                                                                                                  • Associated: 00000001.00000002.1792020766.00007FFDFAC0B000.00000004.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                                                                                                  • Associated: 00000001.00000002.1792149222.00007FFDFAC10000.00000002.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                  • Snapshot File: hcaresult_1_2_7ffdfaab0000_dipwo1iToJ.jbxd
                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                  • API ID: memset
                                                                                                                                                                                                                  • String ID: %s-shm$readonly_shm$winOpenShm
                                                                                                                                                                                                                  • API String ID: 2221118986-2815843928
                                                                                                                                                                                                                  • Opcode ID: 8d2a6488cfe544708466a8bb6c48c74f0afd239d4f67e3118775d9e63ad55e06
                                                                                                                                                                                                                  • Instruction ID: b66be408215a0316388190e319896042f6847a5d4f5c61f15b6f03a19a9f29fd
                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 8d2a6488cfe544708466a8bb6c48c74f0afd239d4f67e3118775d9e63ad55e06
                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 5BC14D25B0DA5285EB5D9B21E470A7D33B0BF44B94F4881B6DA7E862D8DF3CE44AC350
                                                                                                                                                                                                                  Function 00007FFDFAB35C50 Relevance: 6.2, APIs: 1, Strings: 3, Instructions: 197COMMON
                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                  Strings
                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                  • Source File: 00000001.00000002.1790722712.00007FFDFAAB1000.00000020.00000001.01000000.00000017.sdmp, Offset: 00007FFDFAAB0000, based on PE: true
                                                                                                                                                                                                                  • Associated: 00000001.00000002.1790701930.00007FFDFAAB0000.00000002.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                                                                                                  • Associated: 00000001.00000002.1791797724.00007FFDFABDE000.00000002.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                                                                                                  • Associated: 00000001.00000002.1792020766.00007FFDFAC0B000.00000004.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                                                                                                  • Associated: 00000001.00000002.1792149222.00007FFDFAC10000.00000002.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                  • Snapshot File: hcaresult_1_2_7ffdfaab0000_dipwo1iToJ.jbxd
                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                  • API ID:
                                                                                                                                                                                                                  • String ID: %s.%s$column%d$rowid
                                                                                                                                                                                                                  • API String ID: 0-1505470444
                                                                                                                                                                                                                  • Opcode ID: d1fe2ab18ba4c5494ba92163807286c015e8439aac513501ae0b7842bd63adfc
                                                                                                                                                                                                                  • Instruction ID: 5bd8689ad2a6cf2f3497ecd3e9ec0db122c490586b9350d4b31ece9495909986
                                                                                                                                                                                                                  • Opcode Fuzzy Hash: d1fe2ab18ba4c5494ba92163807286c015e8439aac513501ae0b7842bd63adfc
                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 24919C72B08B8189EB68DB15D4647A963A8FB45BA4F944366DEBC473C8DF38D485C300
                                                                                                                                                                                                                  Function 00007FFDFA991FD0 Relevance: 6.2, APIs: 2, Strings: 2, Instructions: 173stringCOMMON
                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                  Strings
                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                  • Source File: 00000001.00000002.1790239989.00007FFDFA991000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FFDFA990000, based on PE: true
                                                                                                                                                                                                                  • Associated: 00000001.00000002.1790215466.00007FFDFA990000.00000002.00000001.01000000.0000001A.sdmpDownload File
                                                                                                                                                                                                                  • Associated: 00000001.00000002.1790259151.00007FFDFA995000.00000002.00000001.01000000.0000001A.sdmpDownload File
                                                                                                                                                                                                                  • Associated: 00000001.00000002.1790259151.00007FFDFA9F2000.00000002.00000001.01000000.0000001A.sdmpDownload File
                                                                                                                                                                                                                  • Associated: 00000001.00000002.1790259151.00007FFDFAA3E000.00000002.00000001.01000000.0000001A.sdmpDownload File
                                                                                                                                                                                                                  • Associated: 00000001.00000002.1790259151.00007FFDFAA42000.00000002.00000001.01000000.0000001A.sdmpDownload File
                                                                                                                                                                                                                  • Associated: 00000001.00000002.1790259151.00007FFDFAA47000.00000002.00000001.01000000.0000001A.sdmpDownload File
                                                                                                                                                                                                                  • Associated: 00000001.00000002.1790259151.00007FFDFAA9F000.00000002.00000001.01000000.0000001A.sdmpDownload File
                                                                                                                                                                                                                  • Associated: 00000001.00000002.1790619887.00007FFDFAAA2000.00000004.00000001.01000000.0000001A.sdmpDownload File
                                                                                                                                                                                                                  • Associated: 00000001.00000002.1790657853.00007FFDFAAA4000.00000002.00000001.01000000.0000001A.sdmpDownload File
                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                  • Snapshot File: hcaresult_1_2_7ffdfa990000_dipwo1iToJ.jbxd
                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                  • API ID: strncmp
                                                                                                                                                                                                                  • String ID: CJK UNIFIED IDEOGRAPH-$HANGUL SYLLABLE
                                                                                                                                                                                                                  • API String ID: 1114863663-87138338
                                                                                                                                                                                                                  • Opcode ID: d800521c55394c3ad25b6a38125f6762d0e11982fd6218b3e6ef33505340922b
                                                                                                                                                                                                                  • Instruction ID: e6f48bf7e82ede682b57316a9a77682f7e328b11ef19c7737573888e1be41a1c
                                                                                                                                                                                                                  • Opcode Fuzzy Hash: d800521c55394c3ad25b6a38125f6762d0e11982fd6218b3e6ef33505340922b
                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 5461F772B1864256F7688A19A850A7A7252EB88B98FC44275EA7DC7BDDEF3CD4018700
                                                                                                                                                                                                                  Function 00007FFDFA994B18 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 34COMMON
                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                  Strings
                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                  • Source File: 00000001.00000002.1790239989.00007FFDFA991000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FFDFA990000, based on PE: true
                                                                                                                                                                                                                  • Associated: 00000001.00000002.1790215466.00007FFDFA990000.00000002.00000001.01000000.0000001A.sdmpDownload File
                                                                                                                                                                                                                  • Associated: 00000001.00000002.1790259151.00007FFDFA995000.00000002.00000001.01000000.0000001A.sdmpDownload File
                                                                                                                                                                                                                  • Associated: 00000001.00000002.1790259151.00007FFDFA9F2000.00000002.00000001.01000000.0000001A.sdmpDownload File
                                                                                                                                                                                                                  • Associated: 00000001.00000002.1790259151.00007FFDFAA3E000.00000002.00000001.01000000.0000001A.sdmpDownload File
                                                                                                                                                                                                                  • Associated: 00000001.00000002.1790259151.00007FFDFAA42000.00000002.00000001.01000000.0000001A.sdmpDownload File
                                                                                                                                                                                                                  • Associated: 00000001.00000002.1790259151.00007FFDFAA47000.00000002.00000001.01000000.0000001A.sdmpDownload File
                                                                                                                                                                                                                  • Associated: 00000001.00000002.1790259151.00007FFDFAA9F000.00000002.00000001.01000000.0000001A.sdmpDownload File
                                                                                                                                                                                                                  • Associated: 00000001.00000002.1790619887.00007FFDFAAA2000.00000004.00000001.01000000.0000001A.sdmpDownload File
                                                                                                                                                                                                                  • Associated: 00000001.00000002.1790657853.00007FFDFAAA4000.00000002.00000001.01000000.0000001A.sdmpDownload File
                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                  • Snapshot File: hcaresult_1_2_7ffdfa990000_dipwo1iToJ.jbxd
                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                  • API ID: String$Err_FromUnicode_
                                                                                                                                                                                                                  • String ID: no such name
                                                                                                                                                                                                                  • API String ID: 3678473424-4211486178
                                                                                                                                                                                                                  • Opcode ID: ac25febba8f5bdc0c9cfa2e9817e8debf067cef10677f4d15bb58f151aba3dd9
                                                                                                                                                                                                                  • Instruction ID: 0b7a02c91e0f9e3d2736bd282f231472441c45838ed95f4e584401a3c397dac8
                                                                                                                                                                                                                  • Opcode Fuzzy Hash: ac25febba8f5bdc0c9cfa2e9817e8debf067cef10677f4d15bb58f151aba3dd9
                                                                                                                                                                                                                  • Instruction Fuzzy Hash: BA01127171D642A1FB658B21E8B0BA92294BB9C78CF840071DA5E867E8DF2CE119C700
                                                                                                                                                                                                                  Function 00007FFDFA9925C0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 19COMMON
                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                  • _PyObject_GC_New.PYTHON312(?,?,00000000,00007FFDFA992533), ref: 00007FFDFA9925C6
                                                                                                                                                                                                                  • PyObject_GC_Track.PYTHON312(?,?,00000000,00007FFDFA992533), ref: 00007FFDFA9925F8
                                                                                                                                                                                                                  Strings
                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                  • Source File: 00000001.00000002.1790239989.00007FFDFA991000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FFDFA990000, based on PE: true
                                                                                                                                                                                                                  • Associated: 00000001.00000002.1790215466.00007FFDFA990000.00000002.00000001.01000000.0000001A.sdmpDownload File
                                                                                                                                                                                                                  • Associated: 00000001.00000002.1790259151.00007FFDFA995000.00000002.00000001.01000000.0000001A.sdmpDownload File
                                                                                                                                                                                                                  • Associated: 00000001.00000002.1790259151.00007FFDFA9F2000.00000002.00000001.01000000.0000001A.sdmpDownload File
                                                                                                                                                                                                                  • Associated: 00000001.00000002.1790259151.00007FFDFAA3E000.00000002.00000001.01000000.0000001A.sdmpDownload File
                                                                                                                                                                                                                  • Associated: 00000001.00000002.1790259151.00007FFDFAA42000.00000002.00000001.01000000.0000001A.sdmpDownload File
                                                                                                                                                                                                                  • Associated: 00000001.00000002.1790259151.00007FFDFAA47000.00000002.00000001.01000000.0000001A.sdmpDownload File
                                                                                                                                                                                                                  • Associated: 00000001.00000002.1790259151.00007FFDFAA9F000.00000002.00000001.01000000.0000001A.sdmpDownload File
                                                                                                                                                                                                                  • Associated: 00000001.00000002.1790619887.00007FFDFAAA2000.00000004.00000001.01000000.0000001A.sdmpDownload File
                                                                                                                                                                                                                  • Associated: 00000001.00000002.1790657853.00007FFDFAAA4000.00000002.00000001.01000000.0000001A.sdmpDownload File
                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                  • Snapshot File: hcaresult_1_2_7ffdfa990000_dipwo1iToJ.jbxd
                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                  • API ID: Object_$Track
                                                                                                                                                                                                                  • String ID: 3.2.0
                                                                                                                                                                                                                  • API String ID: 16854473-1786766648
                                                                                                                                                                                                                  • Opcode ID: f91d149df4c654f8be0df0ef2da4b36c9d06b56ee9d54162962ccaca08fa2000
                                                                                                                                                                                                                  • Instruction ID: a82899de7ad601a6e0fd5bd295d44f3155c66dd5037de511ac91e3a525926571
                                                                                                                                                                                                                  • Opcode Fuzzy Hash: f91d149df4c654f8be0df0ef2da4b36c9d06b56ee9d54162962ccaca08fa2000
                                                                                                                                                                                                                  • Instruction Fuzzy Hash: F3E0ED64B55B02B1FF298B11E86446523A8BF1C748B9401B6CD6D82398EF3CE1A8C240
                                                                                                                                                                                                                  Function 00007FFDFAAFABE0 Relevance: 5.2, APIs: 4, Instructions: 223COMMON
                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                  • Source File: 00000001.00000002.1790722712.00007FFDFAAB1000.00000020.00000001.01000000.00000017.sdmp, Offset: 00007FFDFAAB0000, based on PE: true
                                                                                                                                                                                                                  • Associated: 00000001.00000002.1790701930.00007FFDFAAB0000.00000002.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                                                                                                  • Associated: 00000001.00000002.1791797724.00007FFDFABDE000.00000002.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                                                                                                  • Associated: 00000001.00000002.1792020766.00007FFDFAC0B000.00000004.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                                                                                                  • Associated: 00000001.00000002.1792149222.00007FFDFAC10000.00000002.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                  • Snapshot File: hcaresult_1_2_7ffdfaab0000_dipwo1iToJ.jbxd
                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                  • API ID: memcpy$memset
                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                  • API String ID: 438689982-0
                                                                                                                                                                                                                  • Opcode ID: 063867daf08dc840c18da87f71504e9cfd181ef9bf5db64338ac6d78780bbdb1
                                                                                                                                                                                                                  • Instruction ID: 8f1a0e13bde6b1665ee109442d944172e8e3b086aea4909abc996287cc19ff38
                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 063867daf08dc840c18da87f71504e9cfd181ef9bf5db64338ac6d78780bbdb1
                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 4791B132B19B8286E76D8A159160AAA77A0FB44BD0F048175EE6D47BCDEF3CD4568700